Fortunately, there is a way to use Frida without jailbreaking your iOS device, even if it is running the latest iOS version (12.1.4 at the time of writing). In this article, we will show you how to set up Frida without jailbreak on devices running iOS 12.1.4 using a tool called Cydia Impactor.
What is Cydia Impactor?
Cydia Impactor is a tool developed by Saurik, the creator of Cydia, the most popular app store for jailbroken iOS devices. Cydia Impactor allows you to sideload IPA files (iOS applications) onto your device using your Apple ID and password. This means that you can install apps that are not available on the App Store without jailbreaking your device.
Cydia Impactor works by exploiting a feature called "free provisioning", which allows developers to test their apps on their own devices without paying for an Apple Developer Program membership. However, there are some limitations to this method:
You need to re-sign and re-install the app every 7 days, unless you have a paid Apple Developer account.
You can only install up to 3 apps per device using the same Apple ID.
You may encounter some errors or warnings during the installation process.
Despite these drawbacks, Cydia Impactor is still a useful tool for installing Frida without jailbreak on your iOS device.
How to install Frida using Cydia Impactor?
To install Frida using Cydia Impactor, you need to follow these steps:
Download and install the latest version of Cydia Impactor from [here].
Download the latest version of Frida IPA file from [here].
Connect your iOS device to your computer using a USB cable.
Launch Cydia Impactor and select your device from the drop-down menu.
Drag and drop the Frida IPA file onto the Cydia Impactor window.
Enter your Apple ID and password when prompted. If you have enabled two-factor authentication for your Apple ID, you need to generate an app-specific password from [here] and use it instead of your regular password.
Wait for Cydia Impactor to sign and install the Frida app onto your device.
Once the installation is complete, go to Settings > General > Device Management on your device and trust the developer certificate associated with your Apple ID.
You can now launch the Frida app from your home screen and start using it.
How to use Frida?
To use Frida, you need to have a computer and an iOS device connected to the same network. You also need to install frida-server on your device and frida-tools on your computer. You can find detailed instructions on how to do that [here].
Once you have everything set up, you can use frida-ps command on your computer to list all the processes running on your device. For example:
$ frida-ps -U PID Name ---- ---------------- 976 AppStore 1238 Calculator
1409 Camera
405 CommCenter
frida-server
412 identityservicesd 293 installd 758 Mail 784 MobileMail 344 SpringBoard
You can then use frida command to attach to any process and inject your own JavaScript code to manipulate its behavior. For example, to attach to the Calculator app and hook the function that calculates the result of an expression, you can use this command:
$ frida -U -n Calculator ____ / _ Frida 12.8.20 - A world-class dynamic instrumentation toolkit (_ > _ Commands: /_/ _ help -> Displays the help system . . . . object? -> Display information about 'object' . . . . exit/quit -> Exit . . . . . . . . More info at https://www.frida.re/docs/home/ [Local::Calculator]-> var calc = ObjC.classes.CalculatorModel.sharedCalculator(); [Local::Calculator]-> Interceptor.attach(calc['- evaluateExpressionWithSubstitutions:error:'].implementation, onEnter: function(args) console.log('Expression: ' + ObjC.Object(args[2]).toString()); , onLeave: function(retval) console.log('Result: ' + retval.toString()); ); [Local::Calculator]-> Expression: (3 + 4) * 5 Result: 35
Expression: 2 ^ 10
Result: 1024
You can also use frida-trace command to trace the execution of specific functions or methods. For example, to trace all the Objective-C methods in the Camera app, you can use this command:
$ frida-trace -U -m "-[Camera* *]" Camera Instrumenting functions...
-[CameraAppDelegate applicationDidFinishLaunching:] onEnter -[CameraAppDelegate applicationDidFinishLaunching:] onLeave -[CameraViewController viewDidLoad] onEnter -[CameraViewController viewDidLoad] onLeave -[CameraViewController viewWillAppear:] onEnter -[CameraViewController viewWillAppear:] onLeave -[CameraViewController viewDidAppear:] onEnter -[CameraViewController viewDidAppear:] onLeave
For more information on how to use Frida, you can check out the official documentation [here] and some tutorials [here].
Conclusion
In this article, we have shown you how to set up Frida without jailbreak on devices running iOS 12.1.4 using Cydia Impactor. We have also given you a brief introduction on how to use Frida to perform dynamic analysis and instrumentation of iOS applications. We hope that this article has been helpful and informative for you. If you have any questions or feedback, please feel free to leave a comment below.
a104e7fe7e