Sunday, 20 January 2013

removePIE - a tool for disabling ASLR on iOS applications

I've put together this small tool which removes ASLR from iOS applications.

This works by flipping the MH_PIE bit used in the MACH-O header of the application.
Since iOS 6.0 this bit is enabled by default in xcode when compiling applications.

Still works for the iOS 6.1 update, doesn't require resigning of the binary if using the evasi0n jailbreak as i believe signature checking of apps is patched out.

1 comment:

  1. This is really brilliant work. Never thought of something like this :)

    If I run the removePIE by copying into .app directory, it works perfectly.
    Ex: removePIE Facebook

    But If I run the removePIE by supplying the binary path it is ending with segmentation fault:11.
    Ex: removePIE /var/mobile/Applications/[uuid]/