iOS取证技巧：在无损的情况下完整导出SQLite数据库
在上一篇文章中，我向大家介绍了有关利用iOS DeveloperImage中一些特性的方法，其中包括在已越狱设备上启动带有自定义环境变量的App。说实话，我的最初动机是为了寻找沙箱逻辑问题，但失败了。值得庆幸的是我发现了另一个非常实用的技巧，即通过利用其中的一些特性来提取SQLite数据库。该方案需要屏幕解锁和可信USB连接。
为了运行完整的实验，你需要安装以下工具：
https://github.com/libimobiledevice/libimobiledevice
https://github.com/libimobiledevice/ideviceinstaller
https://github.com/emonti/afcclient（可选。如果你不想自己编写libimobiledevice的代码，就用这个）
SQLite日志记录
iOS上当前内置的SQLite支持调试选项：如果设置了SQLITE_SQLLOG_DIR环境，则每个数据库在给定目录中都会有一个副本，且sql查询为纯文本形式。
sqlite文档：https://www.sqlite.org/src/doc/trunk/src/test_sqllog.c
我们的实验从一个越狱设备开始。只需启动带有SQLITE_SQLLOG_DIR的Gmail应用程序，指向它有权写入的位置：
修改上一篇文章中的脚本，向环境添加一个新密钥：
const env = ObjC.classes.NSMutableDictionary.alloc().init();
env.setObject_forKey_(
ObjC.classes.NSString.stringWithString_('/private/var/mobile/Containers/Data/Application/{THE_ACTUAL_UUID_ON_YOUR_DEVICE}/tmp'),
ObjC.classes.NSString.stringWithString_('SQLITE_SQLLOG_DIR'));以下是为目录生成的内容：
hello:/private/var/mobile/Containers/Data/Application/.../tmp root# ls
WebKit sqllog_05860_00000.sql sqllog_05860_00003.sql sqllog_05860_01.db
sqllog_05860.idx sqllog_05860_00001.sql sqllog_05860_00004.sql sqllog_05860_02.db
sqllog_05860_00.db sqllog_05860_00002.sql sqllog_05860_00005.sql sqllog_05860_03.db文件名中的05860是pid，格式化为固定的5位数。idx文件是原始数据库的映射索引。
root# cat sqllog_05860.idx
0 /private/var/mobile/Containers/Shared/AppGroup/21805C48-3DD1-4973-BDB8-F26441BE74B3/GIPPhenotype/phenotype.db
1 /var/mobile/Containers/Data/Application/E89CEF28-30BA-41F8-BDB3-BD05E0598D32/Library/Application Support/data/[email protected]/sqlitedb
2 /var/mobile/Containers/Data/Application/E89CEF28-30BA-41F8-BDB3-BD05E0598D32/Library/Application Support/data/[email protected]/imapsqlitedb
3 /private/var/mobile/Containers/Data/Application/E89CEF28-30BA-41F8-BDB3-BD05E0598D32/Library/Caches/com.google.Gmail/Cache.d例如，所有 /var/mobile/Containers/Data/Application/E89CEF28–30BA-41F8-BDB3-BD05E0598D32/Library/Application Support/data/[email protected]/sqlitedb 的查询被记录在了sqllog_05860_00000.sql文件中。
sqllog_05860_00.db是其副本。
未越狱设备
现在问题是，iOS上的应用程序被“监禁”在容器中，如果没有完整备份将仍然无法访问这些容器。每个规则都有一个例外，沙箱配置文件也不例外。
某些内置应用程序有写入权限到 /var/mobile/Media/iTunes_Control/iTunes 目录。
以及一些应用程序还拥有 com.apple.security.exception.files.absolute-path.read-write 或 com.apple.security.exception.files.home-relative-path.read-write 权限。
你可以通过以下命令读取这些权限。
ideviceinstaller -l -o list_system -o xmlVioceMemo：
<key>com.apple.security.exception.files.absolute-path.read-write</key>
<array>
<string>/private/var/mobile/Media/Recordings/</string>
</array>
<key>platform-application</key>
<true/>MobileSafari：
<key>com.apple.security.exception.files.home-relative-path.read-write</key>
<array>
<string>/Library/com.apple.itunesstored/</string>
<string>/Library/com.apple.iTunesCloud/</string>
<string>/Library/Caches/com.apple.Music/</string>
<string>/Library/Cookies/</string>
<string>/Media/</string>
<string>/Library/Caches/com.apple.Radio/</string>
<string>/Library/Caches/com.apple.iTunesStore/</string>
<string>/Library/Caches/sharedCaches/com.apple.Radio.RadioImageCache/</string>
<string>/Library/Caches/sharedCaches/com.apple.Radio.RadioRequestURLCache/</string>
<string>/Library/com.apple.MediaSocial/</string>
<string>/Library/DeviceRegistry/</string>
<string>/Library/Logs/MediaServices/</string>
</array>iOS允许在 /var/mobile/Media 中进行沙箱文件访问。许多第三方iPhone管理工具允许你直接操作此位置，甚至还会提供一个GUI界面。
➜ afcclient git:(master) ✗ ./afcclient mkdir Downloads/SQLite另一个可读的位置是CrashReporter。你可以使用idevicecrashreport获取文件。
但需要提醒大家的是，并非所有内置的应用程序都有这些例外，更别说是那些第三方应用了。
Demo
在测试期间启动Instruments，并使用上一篇文章中的frida脚本将bundle ID更改为目标。
/*
run Instruments.app, then
frida Instruments -l msg.js
*/
function getDevice() {
const devices = ObjC.classes.XRDeviceDiscovery.availableDevices();
const count = devices.count().valueOf();
for (var i = 0; i < count; i++) {
var device = devices.objectAtIndex_(i);
if (device.platformName().toString() === 'iPhoneOS' && device.connection()) {
return device;
}
}
throw new Error('unable to find device');
}
const newMsgFunc = ObjC.classes.DTXMessage['+ messageWithSelector:objectArguments:'].implementation;
const newMsg = new NativeFunction(newMsgFunc, 'pointer',
['pointer', 'pointer', 'pointer', '...', 'pointer', 'pointer', 'pointer', 'pointer', 'pointer', 'pointer']);
const opt = ObjC.classes.NSMutableDictionary.alloc().init();
opt.setObject_forKey_(0, ObjC.classes.NSString.stringWithString_('StartSuspendedKey')); // required
const args = ObjC.classes.NSMutableArray.alloc().init();
args.addObject_(ObjC.classes.NSString.stringWithString_('--if-you-need-some-thing')); // argv
const env = ObjC.classes.NSMutableDictionary.alloc().init();
env.setObject_forKey_(
ObjC.classes.NSString.stringWithString_('3'),
ObjC.classes.NSString.stringWithString_('CFNETWORK_DIAGNOSTICS')); // environment variables
const msg = new ObjC.Object(newMsg(
ObjC.classes.DTXMessage,
ObjC.selector('+ messageWithSelector:objectArguments:'),
ObjC.selector('launchSuspendedProcessWithDevicePath:bundleIdentifier:environment:arguments:options:'),
ObjC.classes.NSString.stringWithString_('this makes no sense'), // path, SpringBoard simply ignores it
ObjC.classes.NSString.stringWithString_('com.apple.calculator'), // bundle id, must be already installed
ObjC.classes.NSDictionary.dictionaryWithDictionary_(env),
args.copy(),
ObjC.classes.NSDictionary.dictionaryWithDictionary_(opt),
NULL
))
const channel = getDevice().connection().makeChannelWithIdentifier_(
'com.apple.instruments.server.services.processcontrol.feature.deviceio') // channel id
channel.sendControlSync_replyHandler_(msg, new ObjC.Block({
retType: 'void',
argTypes: ['object', 'pointer'],
implementation: function(reply, len) {
console.log('reply', reply.payloadObject())
}
}))com.apple.mobilesafari
这里有Safari浏览器状态，书签，历史记录，每个站点首选项，HTML5本地存储甚至缓存。请注意，通常Cache.db不会包含在备份中，并且它是以纯文本格式存储http请求的。
➜ afcclient git:(master) ✗ ./afcclient mkdir iTunes_Control/iTunes/safari
Created directory: iTunes_Control/iTunes/safari
➜ afcclient git:(master) ✗ ./afcclient cat iTunes_Control/iTunes/safari/sqllog_02343.idx
0 /private/var/mobile/Containers/Data/Application/9210B36C-89E2-4728-9831-40CAA961C15E/Library/Image Cache/Favicons/Favicons.db
1 /var/mobile/Containers/Data/Application/9210B36C-89E2-4728-9831-40CAA961C15E/Library/Safari/BrowserState.db
2 /private/var/mobile/Containers/Data/Application/9210B36C-89E2-4728-9831-40CAA961C15E/Library/Image Cache/Touch Icons/TouchIconCacheSettings.db
3 /private/var/mobile/Containers/Data/Application/9210B36C-89E2-4728-9831-40CAA961C15E/Library/Image Cache/Password Icons/TouchIconCacheSettings.db
4 /var/mobile/Library/Safari/Bookmarks.db
5 /private/var/mobile/Containers/Data/Application/9210B36C-89E2-4728-9831-40CAA961C15E/Library/Safari/History.db
6 /var/mobile/Containers/Data/Application/9210B36C-89E2-4728-9831-40CAA961C15E/Library/WebKit/WebsiteData/LocalStorage/https_mobile.twitter.com_0.localstorage
7 /private/var/mobile/Containers/Data/Application/9210B36C-89E2-4728-9831-40CAA961C15E/Library/Safari/PerSitePreferences.db
8 /private/var/mobile/Containers/Data/Application/9210B36C-89E2-4728-9831-40CAA961C15E/Library/Caches/com.apple.mobilesafari/Cache.dbcom.apple.mobilemail
➜ afcclient git:(master) ✗ ./afcclient cat Mail/sqllog_04465.idx
0 /var/mobile/Library/Mail/Envelope Index
1 /var/mobile/Library/Mail/Protected Index
2 /var/mobile/Library/DeviceRegistry/5CFB9E7E-C465-4A92-B3ED-C744367AB766/NanoMail/registry.sqlite
3 /var/mobile/Library/AddressBook/AddressBook.sqlitedbcom.apple.mobilephone
地址簿和通话记录：
hello:~ root# procexp all fds | grep -i sms.db
IMDPersistenceA 812 FD 4u /private/var/mobile/Library/SMS/sms.db @0x0
IMDPersistenceA 812 FD 5u /private/var/mobile/Library/SMS/sms.db-wal @0x0
IMDPersistenceA 812 FD 6u /private/var/mobile/Library/SMS/sms.db-shm @0x0
hello:~ root# ps aux | grep 812
mobile 812 0.0 0.0 1664672 1296 ?? Ss 22Oct18 0:01.77 /System/Library/PrivateFrameworks/IMDPersistence.framework/XPCServices/IMDPersistenceAgent.xpc/IMDPersistenceAgent
root 6008 0.0 0.1 1593504 1536 s000 S+ 2:50PM 0:00.01 grep 812
hello:~ root#
➜ afcclient git:(master) ✗ ./afcclient mkdir iTunes_Control/iTunes/Phone
Created directory: iTunes_Control/iTunes/Phone
➜ afcclient git:(master) ✗./afcclient cat iTunes_Control/iTunes/Phone/sqllog_04322.idx
0 /var/mobile///Library/CallHistoryDB/CallHistory.storedata
1 /var/mobile///Library/CallHistoryDB/CallHistoryTemp.storedata
2 /var/mobile/Library/AddressBook/AddressBook.sqlitedb但你无法提取sms.db，因为它属于xpc服务IMDPersistenceAgent。消息应用com.apple.MobileSMS通过XPC与其通信，而不是打开数据库。
*参考来源：medium， secist编译，转载请注明来自FreeBuf.COM