Very interesting. How did you go about reverse engineering it? Would you mind sharing?
Sure! It's a combination of static and dynamic analysis. I have a jailbroken phone, which allows me to access any file on the filesystem and decrypt any App Store binaries[1]. The first step is to find in which binaries the functionality lives. I know from searching that AirDrop lives in Sharing.framework[2], which has a supporting daemon, sharingd. Then, I open the binaries in a disassembler like IDA Pro[3] or Hopper[4] to determine how they work. Running class-dump is also helpful[5]. If I need to inspect a process like sharingd at runtime, I use Cycript[6], which gives me an Objective-C REPL into the process, or LLDB[7].
[1] https://github.com/stefanesser/dumpdecrypted
[2] https://github.com/JaviSoto/iOS8-Runtime-Headers/tree/master...
[3] https://www.hex-rays.com/products/ida/
Oh crap, I didn't know IDA was free for non-commercial use. I thought it was like Photoshop: prohibitively expensive for most users, so everyone pirates it. I'm going to have to give that a shot.
Maybe you'd like Radare, which is free software. http://www.radare.org/y/
Thank you for the link.
An old version is free, and lacking the decompiler. It's a good tool, but it's really not IDA Pro.
Re:WiFried: iOS 8 WiFi Issue
by reubenmorais on Tuesday November 25, 2014 @09:42AM
(#8657874)
IDA is not the expensive part, the Hex-Rays decompiler is. A single license can cost up to $2000 :(
1. Alice opens the AirDrop sheet.
2. Alice begins advertising her short "proximity"[2] hashes over BTLE.
3. Bob, continually scanning in the background, sees Alice and her hashes.
4. If Bob either a) has the "Everyone" setting enabled, or b) has a match to one of Alice's proximity hashes in his contacts, Bob connects to Alice over AWDL.
6. Bob starts a HTTP server.
7. Bob advertises a Bonjour service for his HTTP server.
8. Alice sends a discovery request.
9. If the request is valid, Bob sends a discovery response (including device model, name and icon).
Also to note, the author, Mario Ciabarra is the (co?)-founder of Rock Your Phone, the alternative to Cydia until the two merged in 2010[3].
[1] https://www.apple.com/privacy/docs/iOS_Security_Guide_Oct_20... (Page 23)
[2] Each device hashes every phone number and email in its address book with SHA256 after normalizing them. These hashes are referred to as full hashes. The "proximity" hashes are the first two bytes of the long hash. The full hashes are not broadcasted, but they are verified later over AWDL.
[3] http://www.tuaw.com/2010/09/11/alliance-of-the-jailbreakers-...