ToothPicker

ToothPicker is an in-process, coverage-guided fuzzer for iOS. It was developed to specifically targets iOS's Bluetooth daemon

bluetoothd

This repository also includes an over-the-air fuzzer with an exemplary implementation to fuzz Apple's MagicPairing protocol using InternalBlue. Additionally, it contains the

ReplayCrashFile.py

New: Inplace Fuzzer (ToothFlipper)

This is a very simple fuzzer that only flips bits and bytes in active connections. No coverage-guidance, no injection, but nice as a demo and stateful. Runs just with Python+Frida, no modules or installation required. Tested on iOS 13.5-14.3. See inplace-fuzzer.

In-Process Fuzzer

The In-Process Fuzzer works out-of-the-box on various iOS versions (13.3-13.7 tested), but symbols need to be specified. Other iOS versions require adaptions to function addresses. Additionally, it seems like FRIDA's stalker has some problems with the iPhone 8. On newer iPhones that support PAC, the performance significantly suffers from signing pointers. Thus, it is recommended to run this on an iPhone 7.

ToothPicker

Prerequesits:

On the iPhone: - https://frida.re/docs/ios/

On Linux: - usbmuxd - libimobiledevice - Optional but recommended: virtualenv - radamsa (needed by frizzer)

For Arch-based Linux: ```bash

usbmuxd typically comes with libimobiledevice

but just to be sure, we manually install it as well

sudo pacman -S usbmuxd libimobiledevice python-virtualenv radamsa

Connect the iPhone to the computer

Unlock it.

If a pairing message pops up, click "Trust"

If no pairing message pops up:

idevicepair pair

Now there should be the pop up, accept and then again:

idevicepair pair

In case of connection errors:

sudo systemctl restart usbmuxd

or pair phone and computer again

Other useful commands

To ssh into the iPhone:

Checkra1n comes with an SSH server listening on Port 44

Proxy the phone's SSH port to 4444 localport:

iproxy 4444 44

Connect:

ssh [email protected] -p 4444

Default password: alpine

To fetch some device information of the phone:

ideviceinfo ```

For Debian Linux:

Almost the same as above. Exceptions:

• radamsa

  needs to be installed from the git repository because it is not packaged.
• The command

  iproxy

  requires the additional package

  libusbmuxd-tools

  .

For macOS:

Slightly different commands compared to the Arch Linux setup...

bash
brew install libimobiledevice usbmuxd radamsa npm
idevicepair pair
npm install frida-compile
pip3 install frida-tools

On macOS, PacketLogger, which is part of the Additional Tools for Xcode, can decode various packets once the Bluetooth Debug Profile is installed. Moreover, if you open iOS crash logs with Xcode, it will add some symbols.

Setup and Fuzzing

Setup: - It is recommended to set up a virtual Python environment for

frizzer

frizzer

projects

MagicPairing

MagicPairing

cd

harness

frida-compile

npm install frida-compile

frida-compile ../projects/YOUR_PROJECT/YOUR_SPECIALIZED_HARNESS.JS -o ../projects/YOUR_PROJECT/harness.js

npx frida-compile

frida-compile

Fuzzing: - Connect an iOS device to your computer. - It is advisable to put the phone in flight mode and turn on the "Do not disturb" feature to limit any other activity on the phone. - Run

killall -9 bluetoothd

bluetoothd

cd

mkdir crashes

../../frizzer/fuzzer.py fuzz -p .

In short, for starting a new project, run:

bash
cd harness
npx frida-compile ../projects/YOUR_PROJECT/YOUR_SPECIALIZED_HARNESS.JS -o ../projects/YOUR_PROJECT/harness.js
cd ../projects/YOUR_PROJECT/
mkdir crashes
../../frizzer/fuzzer.py fuzz -p .

You can start with a different seed by using

frizzer/fuzzer.py fuzz --seed 1234 -p .

Adding new iOS versions:

Currently, different versions of iOS are defined in

bluetoothd.js

bluetoothd.js

frida-compile

Increasing bluetoothd capacities:

iOS crash logs are stored in

Settings -> Privacy -> Analytics & Improvements -> Analytics Data

bluetoothd

bluetoothd.cpu_resource-*.ips

On an iPhone 7, run:

bash
cd /System/Library/LaunchDaemons/
plistutil -i com.apple.jetsamproperties.D10.plist -o com.apple.jetsamproperties.D10.plist.txt
plistutil -i com.apple.jetsamproperties.D101.plist -o com.apple.jetsamproperties.D101.plist.txt

On iPhone SE2, these are in

com.apple.jetsamproperties.D79.plist

bash
cd /System/Library/LaunchDaemons/
plistutil -i com.apple.jetsamproperties.D79.plist -o com.apple.jetsamproperties.D79.plist.txt

Search for

bluetoothd

       ActiveSoftMemoryLimit
       24000
       InactiveHardMemoryLimit
       24000
       EnablePressuredExit
       
       JetsamPriority
       19

Write the changes back and restart

bluetoothd

bash
plistutil -i com.apple.jetsamproperties.D10.plist.txt -o com.apple.jetsamproperties.D10.plist
plistutil -i com.apple.jetsamproperties.D101.plist.txt -o com.apple.jetsamproperties.D101.plist
killall -9 bluetoothd

Respectively on the iPhone SE2:

bash
plistutil -i com.apple.jetsamproperties.D79.plist.txt -o com.apple.jetsamproperties.D79.plist
killall -9 bluetoothd

Deleting old logs:

iOS stops saving crash logs for one program after the limit of 25 is reached. If loading a crash log with Xcode (via Simulators&Devices), some symbols are added to the stack trace. Once the limit is reached, the logs can either be removed via Xcode or directly on the iOS device by deleting them in the folder

/var/mobile/Library/Logs/CrashReporter/

A12+:

Starting from the iPhone XR/Xs, PAC has been introduced. This requires calling

sign()

NativeFunction

Over-the-Air Fuzzer and Crash Replay

The

MagicPairing

python MagicPairingFuzzer.py TARGET_BD_ADDR

If you want to reproduce crashes, use the ReplayCrashFile.py script, which can take a crash file and initiates an over-the-air connection with a payload based on the crash.