├── Makefile
├── Makefile.io5
├── Makefile.io6
├── README
├── README.md
├── removePIE.c
└── removePIE.xcent


/Makefile:
--------------------------------------------------------------------------------
 1 | CSNAME="iPhone Developer"
 2 | 
 3 | DEVELOPER=/Applications/Xcode.app/Contents/Developer
 4 | PLATFORM=$(DEVELOPER)/Platforms/iPhoneOS.platform/Developer
 5 | SDKVER = $(shell ls $(PLATFORM)/SDKs/ | tail -n 1)
 6 | SDK=$(PLATFORM)/SDKs/$(SDKVER)
 7 | 
 8 | CC=$(PLATFORM)/usr/bin/arm-apple-darwin10-llvm-gcc-4.2 
 9 | CFLAGS=-ggdb -Wall -isysroot $(SDK) -I../include
10 | 
11 | MACOSX=$(DEVELOPER)/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.7.sdk/System/Library/Frameworks
12 | 
13 | PROGS= removePIE
14 | 
15 | all: $(PROGS)
16 | 
17 | removePIE: removePIE.o 
18 | 	$(CC) $(CFLAGS) -o $@ $^
19 | 	codesign -f -s $(CSNAME) --entitlements removePIE.xcent $@
20 | 
21 | clean:
22 | 	rm -rf *.o *.dSYM $(PROGS)
23 | 
24 | 


--------------------------------------------------------------------------------
/Makefile.io5:
--------------------------------------------------------------------------------
 1 | SDKVER?=5.0
 2 | 
 3 | CSNAME="iPhone Developer"
 4 | 
 5 | DEVELOPER=/Developer
 6 | PLATFORM=$(DEVELOPER)/Platforms/iPhoneOS.platform/Developer
 7 | SDK=$(PLATFORM)/SDKs/iPhoneOS$(SDKVER).sdk
 8 | 
 9 | CC=$(PLATFORM)/usr/bin/arm-apple-darwin10-llvm-gcc-4.2 
10 | CFLAGS=-ggdb -Wall -isysroot $(SDK) -I../include
11 | 
12 | MACOSX=$(DEVELOPER)/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.7.sdk/System/Library/Frameworks
13 | 
14 | PROGS= removePIE
15 | 
16 | all: $(PROGS)
17 | 
18 | removePIE: removePIE.o 
19 | 	$(CC) $(CFLAGS) -o $@ $^
20 | 	codesign -f -s $(CSNAME) --entitlements removePIE.xcent $@
21 | 
22 | clean:
23 | 	rm -rf *.o *.dSYM $(PROGS)
24 | 
25 | 


--------------------------------------------------------------------------------
/Makefile.io6:
--------------------------------------------------------------------------------
 1 | SDKVER?=6.0
 2 | 
 3 | CSNAME="iPhone Developer"
 4 | 
 5 | DEVELOPER=/Applications/Xcode.app/Contents/Developer
 6 | PLATFORM=$(DEVELOPER)/Platforms/iPhoneOS.platform/Developer
 7 | SDK=$(PLATFORM)/SDKs/iPhoneOS$(SDKVER).sdk
 8 | 
 9 | CC=$(PLATFORM)/usr/bin/arm-apple-darwin10-llvm-gcc-4.2 
10 | CFLAGS=-ggdb -Wall -isysroot $(SDK) -I../include
11 | 
12 | MACOSX=$(DEVELOPER)/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.7.sdk/System/Library/Frameworks
13 | 
14 | PROGS= removePIE
15 | 
16 | all: $(PROGS)
17 | 
18 | removePIE: removePIE.o 
19 | 	$(CC) $(CFLAGS) -o $@ $^
20 | 	codesign -f -s $(CSNAME) --entitlements removePIE.xcent $@
21 | 
22 | clean:
23 | 	rm -rf *.o *.dSYM $(PROGS)
24 | 
25 | 


--------------------------------------------------------------------------------
/README:
--------------------------------------------------------------------------------
 1 | removePIE
 2 | =========
 3 | 
 4 | This is an iOS tool which flips the MH_PIE bit in an application. This disables the Address Space Layout Randomization of an application.
 5 | 
 6 | Building
 7 | ========
 8 | 	Building has been set-up to use OS-X, xCode and the iOS 6.0 SDK in default directories. 
 9 | 	execute "make" from the command line to execute the included makefile.
10 | 	This file includes the location of the iOS 6.0 SDK and the location of the ARM compiler of the SDK. The makefile also signs the compiled executable using the "codesign" tool provided by xCode.
11 | Alterations will need to be made to the makefile for compiling on Windows or Linux systems.
12 | 
13 | Usage
14 | =====
15 | 	copy the compiled executable using scp i.e 
16 | 	desktop $ scp ./removePIE root@<IP address of phone>:/usr/bin/removePIE
17 | 	root # ./removePIE <application binary>
18 | 	the <application binary> is most likely located in a sub-directory of /private/var/mobile/Applications/ on the iphone 
19 | 
20 | License
21 | =======
22 | 
23 | Copyright (c) 2013 Peter Fillmore
24 | 
25 | Permission is hereby granted, free of charge, to any person
26 | obtaining a copy of this software and associated documentation
27 | files (the "Software"), to deal in the Software without
28 | restriction, including without limitation the rights to use,
29 | copy, modify, merge, publish, distribute, sublicense, and/or sell
30 | copies of the Software, and to permit persons to whom the
31 | Software is furnished to do so, subject to the following
32 | conditions:
33 | 
34 | The above copyright notice and this permission notice shall be
35 | included in all copies or substantial portions of the Software.
36 | 
37 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
38 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
39 | OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
40 | NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
41 | HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
42 | WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
43 | FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
44 | OTHER DEALINGS IN THE SOFTWARE.
45 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | removePIE
 2 | =========
 3 | This is an iOS tool which flips the MH_PIE bit in an application. 
 4 | This disables the Address Space Layout Randomization of an application.
 5 | 
 6 | Building
 7 | ========
 8 | Building has been set-up to use OS-X, xCode and the iOS 6.0 SDK in 
 9 | default directories. execute "make" from the command line to execute the included makefile.
10 | This file includes the location of the iOS 6.0 SDK and the location of the ARM compiler of the SDK. The makefile also signs the compiled executable using the "codesign" tool provided by xCode.
11 | Alterations will need to be made to the makefile for compiling on Windows or Linux systems.
12 | 
13 | Usage
14 | =====
15 | copy the compiled executable using scp i.e 
16 | ```bash
17 | desktop $ scp ./removePIE root@<IP address of phone>:/usr/bin/removePIE
18 | root \# ./removePIE <application binary>
19 | ```
20 | The <application binary> is most likely located in a sub-directory of /private/var/mobile/Applications/ on the iphone 
21 | 
22 | Issues
23 | ======
24 | Issues have been found with applications on ios 5.1.1, i have found that you have to resign the application binary using the "codesign" tool in xcode to get it to execute. i have no idea as yet to why ldone or ldid doesn't work. ios 6.0.1 did not require re-signing of the application binary.
25 | '
26 | 
27 | License
28 | =======
29 | 
30 | Copyright (c) 2013 Peter Fillmore
31 | 
32 | Permission is hereby granted, free of charge, to any person
33 | obtaining a copy of this software and associated documentation
34 | files (the "Software"), to deal in the Software without
35 | restriction, including without limitation the rights to use,
36 | copy, modify, merge, publish, distribute, sublicense, and/or sell
37 | copies of the Software, and to permit persons to whom the
38 | Software is furnished to do so, subject to the following
39 | conditions:
40 | 
41 | The above copyright notice and this permission notice shall be
42 | included in all copies or substantial portions of the Software.
43 | 
44 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
45 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
46 | OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
47 | NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
48 | HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
49 | WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
50 | FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
51 | OTHER DEALINGS IN THE SOFTWARE.
52 | 


--------------------------------------------------------------------------------
/removePIE.c:
--------------------------------------------------------------------------------
 1 | #include <stdio.h> 
 2 | #include <stdlib.h> 
 3 | #include <string.h> 
 4 | #include <stdint.h>
 5 | #include <mach-o/loader.h>
 6 | 
 7 | void hexify(unsigned char *data, uint32_t size){
 8 | 	while(size--)
 9 | 		printf("%02x", *data++);}
10 | 
11 | void fcopy(FILE *f1, FILE *f2){
12 |     char            buffer[BUFSIZ];
13 |     size_t          n;
14 | 
15 |     while ((n = fread(buffer, sizeof(char), sizeof(buffer), f1)) > 0){
16 |         if (fwrite(buffer, sizeof(char), n, f2) != n)
17 |             printf("Error copying backup");}
18 | }
19 | 
20 | int main(int argc, char *argv[]){
21 | 	struct mach_header currentHeader;
22 | 	//int32_t magic = 0;
23 | 	FILE *fp; //edited file pointer
24 | 	FILE *fw; //backup file pointer
25 | 	char fwName[80];
26 | 	char fwPrefix[4] = ".bak"; //app.bak
27 | 	
28 | 	if(argc < 1){	
29 | 		printf("Please enter the filename binary: in the format removePIE filename");
30 | 		return EXIT_FAILURE;}
31 | 	if((fp = fopen(argv[1], "rb+")) == NULL) {
32 | 		printf("Error, unable to open file\n");
33 | 		return EXIT_FAILURE; }
34 | 	//create app.bak filename
35 | 	strlcpy(fwName, argv[1], strlen(argv[1])+1);
36 | 	strlcat(fwName, fwPrefix, strlen(fwPrefix)+1);
37 | 	if((fw = fopen(fwName, "wb")) == NULL){
38 | 	return EXIT_FAILURE;}
39 | 	
40 | 	if((fread(&currentHeader.magic, sizeof(int32_t), 1, fp)) == (int)NULL)
41 | 	{printf("Error reading magic constant in file\n");
42 | 		return EXIT_FAILURE;}
43 | 	if(currentHeader.magic == MH_MAGIC){ //little endian
44 | 		printf("loading header\n");
45 | 		fseek(fp, 0, SEEK_SET);
46 | 		if((fread(&currentHeader, sizeof(currentHeader), 1, fp)) == (int)NULL)
47 | 		{
48 | 			printf("Error reading MACH-O header");
49 | 			return EXIT_FAILURE;
50 | 		}	
51 | 		fseek(fp, 0, SEEK_SET); //set fp back to 0 to get full copy
52 | 		printf("\nbacking up application binary...\n");
53 | 		fcopy(fp, fw);
54 | 		fclose(fw);
55 | 		printf("\nbinary backed up to:\t%s\n", fwName);
56 | 		printf("\nmach_header:\t");
57 | 		hexify((unsigned char *)&currentHeader,sizeof(currentHeader));	
58 | 		printf("\noriginal flags:\t");
59 | 		hexify((unsigned char *)&currentHeader.flags, sizeof(currentHeader.flags));
60 | 		printf("\nDisabling ASLR/PIE ...\n");
61 | 		currentHeader.flags &= ~MH_PIE;
62 | 		printf("new flags:\t");
63 | 		hexify((unsigned char *)&currentHeader.flags, sizeof(currentHeader.flags));
64 | 		
65 | 		fseek(fp, 0, SEEK_SET);
66 | 		if((fwrite(&currentHeader, sizeof(char), 28, fp)) == (int)NULL)
67 | 		{
68 | 			printf("Error writing to application file %s\n",fwName);
69 | 		}
70 | 		printf("\nASLR has been disabled for %s\n", argv[1]);
71 | 		//exit and close memory
72 | 		//free(mach_header);
73 | 		fclose(fp);
74 | 		return EXIT_SUCCESS;	
75 | 	}
76 | 	else if(currentHeader.magic == MH_CIGAM) // big endian
77 | 	{
78 | 		printf("file is big-endian, not an iOS binary");
79 | 		return EXIT_FAILURE;
80 | 	}
81 | 	else
82 | 	{
83 | 		printf("File is not a MACH_O binary"); 
84 | 		return EXIT_FAILURE;
85 | 	}
86 | 	//exit
87 | 	return EXIT_FAILURE;	 
88 | }
89 | 


--------------------------------------------------------------------------------
/removePIE.xcent:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/peterfillmore/removePIE/e3d5bdb48a0f071e18eaa33d3a63a777346d5935/removePIE.xcent


--------------------------------------------------------------------------------