From a69edeba2db40156ae56ed1291fcecced8117673 Mon Sep 17 00:00:00 2001 From: tkgstrator Date: Tue, 7 Apr 2026 09:37:44 +0000 Subject: [PATCH] =?UTF-8?q?feat(devcontainer):=20Theos=E7=B5=B1=E5=90=88?= =?UTF-8?q?=E3=81=A8AppDelegate=E3=83=95=E3=83=83=E3=82=AF=E4=BF=AE?= =?UTF-8?q?=E6=AD=A3=E3=80=81=E9=96=A2=E9=80=A3=E3=83=89=E3=82=AD=E3=83=A5?= =?UTF-8?q?=E3=83=A1=E3=83=B3=E3=83=88=E6=9B=B4=E6=96=B0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Theosビルド環境をappコンテナに統合し、サイドカーtheosコンテナやdocker関連設定を削除。 AppDelegateのフックを正しいクラス名/継承関係で実装し直し、ログ出力で動作確認。 起動時のシェル初期化・バックグラウンドログ収集を追加。 各種ドキュメント、タスク、パッケージ名も新構成に合わせて更新。 --- .devcontainer/Dockerfile | 48 +++++++++++++++++-- .devcontainer/compose.yaml | 12 +---- .devcontainer/devcontainer.json | 7 --- .devcontainer/postAttachCommand.sh | 32 ++++++++++++- .envrc | 1 - .vscode/tasks.json | 6 +-- CLAUDE.md | 12 ++--- docs/plans/appdelegate_hook.md | 38 +++++++++++++++ .../Sources/NetflixSSLBypass/Tweak.x.swift | 21 ++++++++ pyproject.toml | 8 ++-- 10 files changed, 146 insertions(+), 39 deletions(-) create mode 100644 docs/plans/appdelegate_hook.md diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index 62aeb5a..77c3029 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -1,17 +1,26 @@ FROM mcr.microsoft.com/devcontainers/base:ubuntu-24.04 +ARG _REMOTE_USER_HOME=/home/vscode -# ── Reverse Engineering Tools (apt) ── -# radare2 : ARM64 逆アセンブル・バイナリ解析 (Mach-O / ELF) -# apktool : Android APK リソース展開・smali 逆アセンブル +# ── Reverse Engineering Tools + Theos 依存パッケージ (apt) ── RUN \ --mount=type=cache,target=/var/lib/apt,sharing=locked \ --mount=type=cache,target=/var/cache/apt,sharing=locked \ - apt-get update && apt-get install -y \ + apt-get update && apt-get install -y --no-install-recommends \ wget \ unzip \ jq \ radare2 \ - apktool + apktool \ + make \ + perl \ + fakeroot \ + zip \ + xz-utils \ + lzma \ + libtinfo6 \ + libxml2 \ + libncurses6 \ + libz3-dev # ── jadx (GitHub Release) ── # Android APK → Java 逆コンパイル (プラットフォーム非依存 JAR、JRE は devcontainer feature の Java で提供) @@ -40,3 +49,32 @@ RUN IPSW_URL=$(wget -qO- https://api.github.com/repos/blacktop/ipsw/releases/lat wget -q "$IPSW_URL" -O /tmp/ipsw.tar.gz && \ tar xzf /tmp/ipsw.tar.gz -C /usr/local/bin ipsw && \ rm /tmp/ipsw.tar.gz + +# ── Theos 本体 ── +USER vscode +ENV THEOS=/home/vscode/theos +RUN git clone --recursive https://github.com/theos/theos.git ${THEOS} + +# ── Toolchain (L1ghtmann, aarch64 対応) ── +RUN ARCH=$(uname -m) && \ + curl -fsSL "https://github.com/L1ghtmann/llvm-project/releases/latest/download/iOSToolchain-${ARCH}.tar.xz" \ + | tar xJ -C ${THEOS}/toolchain + +# ── Swift Toolchain (kabiroberai, iOS クロスコンパイル用) ── +RUN ARCH=$(uname -m) && \ + curl -fsSL "https://github.com/kabiroberai/swift-toolchain-linux/releases/download/v2.3.0/swift-5.8-ubuntu22.04-${ARCH}.tar.xz" \ + | tar xJ -C ${THEOS}/toolchain + +# ── ホスト Swift (SPM ビルド用) ── +USER root +RUN ARCH=$(uname -m) && \ + curl -fsSL "https://download.swift.org/swift-5.8.1-release/ubuntu2204-${ARCH}/swift-5.8.1-RELEASE/swift-5.8.1-RELEASE-ubuntu22.04-${ARCH}.tar.gz" \ + | tar xz --strip-components=2 -C /usr +USER vscode + +# ── iOS SDKs (15.6 + 16.5) ── +RUN curl -fsSL "https://github.com/theos/sdks/archive/master.tar.gz" \ + | tar xz -C /tmp && \ + mv /tmp/sdks-master/iPhoneOS15.6.sdk ${THEOS}/sdks/ && \ + mv /tmp/sdks-master/iPhoneOS16.5.sdk ${THEOS}/sdks/ && \ + rm -rf /tmp/sdks-master diff --git a/.devcontainer/compose.yaml b/.devcontainer/compose.yaml index 1de7a7e..661a9a7 100644 --- a/.devcontainer/compose.yaml +++ b/.devcontainer/compose.yaml @@ -6,17 +6,7 @@ services: volumes: - ../:/home/vscode/app:cached - venv:/home/vscode/app/.venv - ports: - - 9080:9080 - tty: true - stdin_open: true - - theos: - build: - context: ./theos - dockerfile: Dockerfile - volumes: - - ../:/home/vscode/app:cached + network_mode: host tty: true stdin_open: true diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 37b601d..62f0a6c 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -34,7 +34,6 @@ "ghcr.io/devcontainers/features/github-cli:1": {}, "ghcr.io/jsburckhardt/devcontainer-features/uv:1": {}, "ghcr.io/stu-bell/devcontainer-features/claude-code:0": {}, - "ghcr.io/christophermacgown/devcontainer-features/direnv:1": {}, "ghcr.io/devcontainers/features/node:1": { "version": "25.9.0" }, @@ -43,12 +42,6 @@ "version": "21", "installMaven": false, "installGradle": false - }, - "ghcr.io/devcontainers/features/docker-in-docker:2": { - "moby": false - }, - "ghcr.io/devcontainers/features/docker-outside-of-docker:1": { - "moby": false } }, "forwardPorts": [], diff --git a/.devcontainer/postAttachCommand.sh b/.devcontainer/postAttachCommand.sh index 32c4312..a36a175 100644 --- a/.devcontainer/postAttachCommand.sh +++ b/.devcontainer/postAttachCommand.sh @@ -8,4 +8,34 @@ git config --global commit.gpgSign false git config --global user.signingkey $(gpg --list-secret-keys --with-colons | grep -B 3 "uid.*$(git config user.name)" | cut -d: -f5 | sed ':a;N;$!ba;s/\n//g') git branch --merged|egrep -v '\*|develop|main|master'|xargs git branch -d -direnv allow /home/vscode/app/.envrc +# .zshrc にシェル初期化を追加 (venv activate, .env 読み込み, alias) +if ! grep -q '# >>> app shell init >>>' ~/.zshrc 2>/dev/null; then + cat >> ~/.zshrc << 'SHELL_INIT' + +# >>> app shell init >>> +source /home/vscode/app/.venv/bin/activate +set -a; source /home/vscode/app/.env 2>/dev/null; set +a +export GIT_AUTHOR_NAME="${GIT_AUTHOR_NAME:-$(git config user.name)}" +export GIT_AUTHOR_EMAIL="${GIT_AUTHOR_EMAIL:-$(git config user.email)}" +export GIT_COMMITTER_NAME="${GIT_COMMITTER_NAME:-$(git config user.name)}" +export GIT_COMMITTER_EMAIL="${GIT_COMMITTER_EMAIL:-$(git config user.email)}" +alias frida-trace="frida-trace -H \$ANDROID_HOST --ui-port \$UI_PORT" +alias frida-ps="frida-ps -H \$ANDROID_HOST" +# <<< app shell init <<< +SHELL_INIT +fi + +# ── Background log collectors ── +cd /home/vscode/app + +# mitmproxy: Netflix iOS capture (port 9080) +nohup uv run mitmdump \ + --listen-port 9080 \ + --set block_global=false \ + --ssl-insecure \ + -s packages/mitmproxy/netflix_ios_capture.py \ + > /tmp/mitmproxy.log 2>&1 & + +# oslog: Tweak ログ収集 (SSH 接続できない場合は自動終了) +nohup bash .vscode/scripts/oslog_stream.sh \ + > /tmp/oslog_stream.log 2>&1 & diff --git a/.envrc b/.envrc index f218490..6cd47d6 100644 --- a/.envrc +++ b/.envrc @@ -1,4 +1,3 @@ -source .venv/bin/activate source_env_if_exists .envrc.local dotenv diff --git a/.vscode/tasks.json b/.vscode/tasks.json index ec6e006..b424b87 100644 --- a/.vscode/tasks.json +++ b/.vscode/tasks.json @@ -85,7 +85,7 @@ { "label": "tweak: build", "type": "shell", - "command": "docker compose -f .devcontainer/compose.yaml exec theos make -C /home/vscode/app/${relativeFileDirname}", + "command": "make -C ${relativeFileDirname}", "options": { "cwd": "${workspaceFolder}/packages/tweak" }, "group": "build", "problemMatcher": [] @@ -93,14 +93,14 @@ { "label": "tweak: clean", "type": "shell", - "command": "docker compose -f .devcontainer/compose.yaml exec theos make -C /home/vscode/app/${relativeFileDirname} clean", + "command": "make -C ${relativeFileDirname} clean", "options": { "cwd": "${workspaceFolder}/packages/tweak" }, "problemMatcher": [] }, { "label": "tweak: package", "type": "shell", - "command": "docker compose -f .devcontainer/compose.yaml exec theos make -C /home/vscode/app/${relativeFileDirname} package", + "command": "make -C ${relativeFileDirname} package", "options": { "cwd": "${workspaceFolder}/packages/tweak" }, "group": "build", "problemMatcher": [] diff --git a/CLAUDE.md b/CLAUDE.md index c04c09f..714f06b 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -33,34 +33,34 @@ docs/ ## Tweak 開発 (Theos/Orion) -Theos ビルド環境は `theos` サイドカーコンテナで動作する。app コンテナから直接 `make` は実行できない。 +Theos ビルド環境は app コンテナに統合されている。 ### ビルド ```bash -docker compose -f .devcontainer/compose.yaml exec theos make -C /home/vscode/app/packages/tweak/ +make -C packages/tweak/ ``` ### クリーン ```bash -docker compose -f .devcontainer/compose.yaml exec theos make -C /home/vscode/app/packages/tweak/ clean +make -C packages/tweak/ clean ``` ### パッケージ (.deb 生成) ```bash -docker compose -f .devcontainer/compose.yaml exec theos make -C /home/vscode/app/packages/tweak/ package +make -C packages/tweak/ package ``` ### デバイスへのインストール ```bash # 初回のみ: SSH 公開鍵をデバイスに登録 (パスワード: alpine) -docker compose -f .devcontainer/compose.yaml exec theos ssh-copy-id -o PubkeyAuthentication=no root@<デバイスIP> +ssh-copy-id -o PubkeyAuthentication=no root@<デバイスIP> # 以降はパスワード不要 -docker compose -f .devcontainer/compose.yaml exec theos make -C /home/vscode/app/packages/tweak/ package install THEOS_DEVICE_IP=<デバイスIP> +make -C packages/tweak/ package install THEOS_DEVICE_IP=<デバイスIP> ``` - Tweak 開発担当はコード変更後に必ずビルドが通ることを確認する diff --git a/docs/plans/appdelegate_hook.md b/docs/plans/appdelegate_hook.md new file mode 100644 index 0000000..f404c8a --- /dev/null +++ b/docs/plans/appdelegate_hook.md @@ -0,0 +1,38 @@ +# 作業計画書: AppDelegate フック完成 + +日時: 2026-04-07T00:00:00+09:00 + +## 目標 + +Netflix iOS アプリの AppDelegate クラス名を特定し、Tweak のフックを正しく動作させる。 + +## タスク一覧 + +### tweak-engineer 担当 + +- [x] `targetName` を `"NetflixApp.AppDelegate"` → `"AppDelegate"` に修正 (ObjC クラス) +- [x] `ClassHook` → `ClassHook` に修正 (UIResponder だとフック失敗) +- [x] ビルド確認 +- [x] デバイスへインストール (scp + dpkg) + +### frida-engineer 担当 + +- [x] クラス名調査スクリプト作成 (`packages/frida/check_appdelegate.js`) +- [x] Tweak の constructor 内で ObjC runtime API を使って確認 (Frida 接続が不安定だったため代替手法) +- [x] 結果: クラス名は `AppDelegate` (ObjC クラス、Swift mangled なし) + +### log-monitor 担当 + +- [x] `raws/oslog/charon_2026-04-07.log` で確認 +- [x] `[NFXBypass] AppDelegate didBecomeActive` の出力確認済み + +## 判明した事実 + +- AppDelegate のクラス名: `AppDelegate` (純粋な ObjC クラス) +- `ClassHook` だと Tweak ロード自体が失敗する → `ClassHook` が正しい +- その他の AppDelegate 関連クラス: `SwiftUI.AppDelegate`, `SwiftUI.TestingAppDelegate` + +## 成果物 + +- `packages/tweak/NetflixSSLBypass/Sources/NetflixSSLBypass/Tweak.x.swift`: AppDelegate フック修正済み +- `raws/oslog/charon_2026-04-07.log`: 動作確認ログ diff --git a/packages/tweak/NetflixSSLBypass/Sources/NetflixSSLBypass/Tweak.x.swift b/packages/tweak/NetflixSSLBypass/Sources/NetflixSSLBypass/Tweak.x.swift index a83b2c4..231f0a7 100644 --- a/packages/tweak/NetflixSSLBypass/Sources/NetflixSSLBypass/Tweak.x.swift +++ b/packages/tweak/NetflixSSLBypass/Sources/NetflixSSLBypass/Tweak.x.swift @@ -5,6 +5,27 @@ import OSLog private let logger = Logger(subsystem: "dev.tkgstrator.charon", category: "tweak") +class AppDelegateHook: ClassHook { + typealias TargetType = NSObject + + static var targetName: String { "AppDelegate" } + + func applicationDidBecomeActive(_ application: UIApplication) { + logger.info("[NFXBypass] AppDelegate didBecomeActive") + orig.applicationDidBecomeActive(application) + } + + func applicationWillResignActive(_ application: UIApplication) { + logger.info("[NFXBypass] AppDelegate willResignActive") + orig.applicationWillResignActive(application) + } + + func applicationDidEnterBackground(_ application: UIApplication) { + logger.info("[NFXBypass] AppDelegate didEnterBackground") + orig.applicationDidEnterBackground(application) + } +} + class ViewControllerHook: ClassHook { func viewDidAppear(_ animated: Bool) { let className = String(describing: type(of: target)) diff --git a/pyproject.toml b/pyproject.toml index e6e53a1..42a1891 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,7 +1,7 @@ [project] -name = "frida-objection-wrapper" +name = "revkit" version = "0.1.0" -description = "Frida and Objection wrapper for mobile application security testing." +description = "Reverse engineering toolkit for mobile application security research." readme = "README.md" requires-python = ">=3.12" dependencies = [ @@ -38,6 +38,4 @@ dependencies = [ ] [dependency-groups] -dev = [ - "ruff>=0.15.9", -] +dev = ["ruff>=0.15.9"]