passionfruit: Crappy iOS app analyzer

by do son · Published October 17, 2017 · Updated November 4, 2024

Passionfruit

Simple iOS app blackbox assessment tool. Powered by frida.re and vuejs.

Features

Fully web-based GUI!
Only supports jailbroken device now. A non-jailbroken solution is on the way.
List all url schemes.
Screenshot.
List humanly readable app meta info (Info.plist).
Checksec: see if target app is encrypted, and has enabled PIE, ARC and stack canary.
App sandbox file browser. Directly preview images, SQLite databases and plist files on the device. You can always download the file for further investigation.
Check the loaded frameworks. Hook exported native functions from this dylib to print the arguments and stack trace.
Log SQLite operations.
Log and try to bypass jailbreak detection.
List Objective-C classes from the app, hook the methods and inspect the arguments and stack trace.
Read keychain items.
Read cookies.
Read UserDefaults.
Simple ui dump.

Setup

Requirements:

Latest node.js and yarn (or npm if you prefer) to run the api server and web gui
libimobiledevice brew install libimobiledevice on macOS
Any desktop browser you like

Starting the gui

This is the easiest way to start if you don’t want to modify the project.

Open the terminal and cd into the project directory.
If it is the first time you cloned this project, you need to install npm dependencies and build the frontend. Run npm install or yarn for the node.js requirements for the first time. Then npm run build (or yarn run build) to build the bundle.
Then use npm start or yarn start
Open http://localhost:31337 in your browser. If the port 31337 is in use, set an environment variable PORT to use an alternative port: PORT=12345 npm start

Setup

Desktop requirements:

Latest node.js (>=7.10.1) and npm to run the api server and web gui
Any modern desktop browser you like

Passionfruit is now available on npm, so just type the following command to install:

npm install -g passionfruit

Then launch it:

passionfruit

Note that if the port 31337 is in use, set environment variable PORT to use an alternative port. Also, setting HOST can force to listen on an alternative interface, but be careful because it has no authentication yet: