Today, I am happy to share with you that `ipatool` has been rebuilt using Go, which allowed me to fulfill a popular
feature request: Linux support.
Using Go cross-platform compilation support, the tool can now run on macOS, Windows and Linux.


If you are not yet familiar with [ipatool](https://github.com/majd/ipatool), it is a command-line tool which lets you
search for apps on the iOS App Store, obtain a license for an app and download a copy of the app package
(known as _ipa file_) using your Apple ID.

![Demo](https://raw.githubusercontent.com/majd/ipatool/8dd1a8508dc89f25f69c922f14292f15d0adda36/demo.gif)

In addition to cross-platform support, this release brings many enhancements to the CLI such as structured
logging/formatting, and automatic country detection. See below for the full changes list.

## What's Changed
- Added support for Windows.
- Added support for Linux.
- Added support for generating autocompletion script using the `completion` command.
- Implemented new `auth info` command.
- Implemented `--verbose` flag that replaces the `--debug-level` flag to enable verbose logging.
- Implemented `--format` which allows specifying logs output format to either text or json (default: text).
- Implemented `--non-interactive` flag to disable running the tool in an interactive session.
- The relevant command (i.e. purchase) will now automatically determine the country and the device family from the 
authenticated account. The following flags have been deprecated.
    - `--country`
    - `--device-family`
- Improved structured logging.
- Improved error handling.
- Improved support for automated systems.
- Added unit tests to cover the majority of the private App Store API logic.

As a reminder, the tool is fully open-source and is available [on GitHub](https://github.com/majd/ipatool).
ipatool is licensed under the [MIT license](https://github.com/majd/ipatool/blob/main/LICENSE).


ipatool: cross-platform support

Today, I have released `ipatool`, a command-line tool which lets you search for apps on the iOS App Store and download a copy of the app package (known as _ipa file_) using your Apple ID.


The tool is fully open-source and is available [on GitHub](https://github.com/majd/ipatool). ipatool is licensed under the [MIT license](https://github.com/majd/ipatool/blob/main/LICENSE).

![Demo](https://raw.githubusercontent.com/majd/ipatool/102f510ddba7ac87e4da206b69268596d05d7ad2/demo.gif)


ipatool: CLI tool for downloading ipa packages

You must have read about MDSec's Black Box that manages to gain access to iPhones running up to iOS 8.1 by brute-forcing the passcode over a USB connection to simulate keypad entry. These kind of attacks are not very practical because iOS's protection against bruteforce attacks blocks passcode entry after 10 failed attempts.


I tried to replicate the attack while covering the entire process without using hardware hacks, so the device has to be jailbroken to gain unsigned code execution privilege (or you might as well use your own exploit for that ;p). 

![TransLock](https://majd.dev/assets/blog/translock.png "TransLock")

I wrote the [following code](https://gist.github.com/majd/b20f2a238e3547bf98eed6a8e1f1cd52) that loops through every possible 4-digit passcode, starting from **0000** up to **9999**.

Then I made a class-dump of SpringBoard and found a class called SBDeviceLockController with an interesting method:

```objectivec
- (BOOL)attemptDeviceUnlockWithPassword:(NSString *)password
                           appRequested:(BOOL)requested;
```

After that, I wrote a dynamic library that hooks into the SpringBoard process and runs the above code when SpringBoard did finish launching, including calling the method above for every generated pin.

Once it returns a Boolean value of `true`, we can assure that it's the working pin.

I relaunched the SpringBoard process to test my code at runtime, and as expected it worked. Well, for the most part...

When watching syslog, I found that it's only running the first 10 passcode entry attempts then it's getting blocked by the operating system and throwing an *iPhone is Disabled* alert on the lock-screen. I had to find a workaround.

I looked back at the earlier class-dump in a class called `SBFDeviceLockController` and found those related methods:

```objectivec
- (BOOL)_temporarilyBlocked;
- (BOOL)isPasscodeLockedOrBlocked;
- (BOOL)isBlocked;
```

I hooked that class and overrided the return value of those methods to `false`, I then ran my code again... The device no longer disables passcode entry after 10 failed attempts. My code was able to try a pin every 5 seconds, if you do the math, that means it'll take 14 hours at most to try every single pin possible.

You can find libTransLock on my [GitHub][translock-source].

[translock-source]: https://github.com/majd/libTransLock


Blog

ipatool: cross-platform support

ipatool: CLI tool for downloading ipa packages

Cracking Apple's iOS Passcode