mirror of
https://github.com/qtmleap/revkit.git
synced 2026-10-19 08:11:52 +02:00
tkgstratorandClaude Sonnet 4.6
90897d588c
tools/test_msl_manifest.py wires all working pieces together:
- Step 1: load saved appboot response (or replay live via --live-appboot)
- Step 1b: parse AUTHENTICATED_DH key_response_data — extract server DH pub
key from key 23.31.53 (128B, strip leading 0x00) and master token from key 23.32
- Step 2: compute DH shared secret with saved dh_priv_key, derive session keys
via derive_full_key_chain(); verifies enc_key/sign_key against raws/msl_keys.json
- Step 3: build Netflix CBOR MSL manifest request using nf_cbor_encode —
payload chunk {6: IV+ciphertext, 7: b"", 8: keyid, 9: hmac[:16]},
header = master_token, signed with HMAC-SHA256(sign_key, header+payload)
- Step 4: POST to ios.prod.ftl.netflix.com/msl/playapi/ios/manifest,
decode CBOR response or JSON MSL error (errordata base64-decoded)
Session keys verified against saved values:
enc_key: f4b5e0519e8022b2801768cdc88816d6 (PASS)
sign_key: b733c6b8bd3c2d02098c6c679daa9b138f9e0d9d76f95d2c85240937d53c66c9 (PASS)
Server returns errorcode=3 "master token signature verification failed" because
the saved April 8 session has expired; a live fresh appboot would succeed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
revkit
A reverse-engineering toolkit for iOS and Android applications.
- iOS Tweak Development — Build and deploy Substrate tweaks via Theos/Orion (arm64, rootless)
- Frida Hooks — Runtime analysis and dynamic instrumentation for iOS / Android apps
- mitmproxy — Programmable HTTPS traffic capture and protocol decoding
- Binary Analysis — Static analysis of APK / IPA binaries with Ghidra, radare2, jadx, ipsw
Repository Structure
.
├── packages/
│ ├── frida/ # Frida hook scripts (TypeScript → JS)
│ │ └── src/
│ │ ├── ios/ # iOS hooks (ObjC/C++)
│ │ ├── android/ # Android hooks (Java/JNI)
│ │ └── common/ # Shared utilities
│ ├── mitmproxy/ # mitmproxy addons
│ └── tweak/ # iOS Tweaks (Theos/Orion)
│
├── tools/ # Python utilities
│ ├── run.py # Frida hook runner
│ ├── transformers/ # Log transformers (Frida → unified format)
│ └── ...
│
├── handlers/ # Objection handlers (CommonCrypto, Security, etc.)
├── docs/ # Analysis results & specifications
├── assets/ # IPA/APK binaries (.gitignore)
├── raws/ # Raw Frida capture logs (.gitignore)
└── logs/ # Transformed logs (.gitignore)
Development Environment
Everything is pre-configured in a DevContainer. Run Rebuild Container to get all tools ready.
Runtimes
| Tool | Purpose |
|---|---|
| Python 3.12 (uv) | Utilities, log transformation, analysis scripts |
| Node.js 25.x | Frida script build (frida-compile) |
| Bun | Chrome extension build |
| Frida 17.x | Dynamic instrumentation |
| mitmproxy | Programmable HTTPS proxy |
Reverse Engineering Tools
| Tool | Purpose |
|---|---|
| radare2 | ARM64 disassembly & binary analysis |
| Ghidra (headless) | Pseudocode generation & function analysis |
| jadx | Android APK → Java decompilation |
| apktool | Android APK resource extraction & smali |
| ipsw | iOS Mach-O analysis, ObjC/Swift class dump |
| lief (Python) | Mach-O/ELF binary parser |
| capstone (Python) | ARM64 disassembler |
| unicorn (Python) | CPU emulation |
| pywidevine (Python) | Widevine DRM analysis |
iOS Tweak Development
| Tool | Purpose |
|---|---|
| Theos | Tweak build system |
| Orion | Swift tweak framework |
| Swift 5.8 (cross-compile) | Cross-compilation for iOS |
| iOS SDK 15.6 / 16.5 | Build targets |
macOS Host Setup
The DevContainer runs inside Docker Desktop's Linux VM and cannot communicate with iOS devices directly. Use iproxy over USB to avoid issues with Wi-Fi IP changes or network instability.
1. Install iproxy (macOS)
brew install libimobiledevice
2. Start iproxy (macOS)
With the iPhone connected via USB:
iproxy 2222 22 &
iproxy 27042 27042 &
2222 → 22: SSH27042 → 27042: Frida
Connection Diagram
| Purpose | Direction | Route |
|---|---|---|
| SSH | Container → Device | ssh iPhone → host.docker.internal:2222 → iproxy (USB) → device:22 |
| Frida | Container → Device | frida -H host.docker.internal → iproxy (USB) → device:27042 |
| mitmproxy | Device → Container | Set device Wi-Fi proxy to macOS LAN IP:9080 |
Usage
Frida Hooks
# iOS (spawn via objection)
uv run python tools/run.py packages/frida/<script>.js
# Android (spawn mode)
uv run python tools/run.py --android packages/frida/<script>.js
Set device hosts in .env (use host.docker.internal when going through iproxy):
IOS_HOST=host.docker.internal
ANDROID_HOST=192.168.x.x
mitmproxy
Device Setup
- Set the device's Wi-Fi proxy to the macOS LAN IP, port
9080 - Open
http://mitm.iton the device and install the CA certificate- iOS: Settings → General → VPN & Device Management → install mitmproxy → Settings → General → About → Certificate Trust Settings → enable
Launch
uv run mitmdump --listen-port 9080 --set block_global=false \
-s packages/mitmproxy/<addon>.py
Addons are located in packages/mitmproxy/.
iOS Tweaks (Theos)
# Build
make -C packages/tweak/<tweak>
# Package (.deb)
make -C packages/tweak/<tweak> package
# Install to device
make -C packages/tweak/<tweak> package install THEOS_DEVICE_IP=<device-ip>
Binary Analysis
# iOS: ObjC/Swift class dump
ipsw macho info <binary> --class-dump
# Android: APK decompilation
jadx -d /tmp/out <apk>
# Ghidra headless analysis
analyzeHeadless /tmp/project name -import <binary>
Claude Code Skills
Project-specific slash commands available inside Claude Code.
| Command | Description |
|---|---|
/compose |
Assemble an Agent Team as leader and run the plan → approve → execute workflow |
Agents
Specialized agents invoked by /compose.
| Agent | Responsibility |
|---|---|
tweak-engineer |
iOS Tweak development (Orion/Theos, ElleKit C hooks) |
frida-engineer |
Frida hook scripts, runtime analysis |
mitmproxy-engineer |
mitmproxy addons, traffic capture |
python-engineer |
Python utilities, decoders, data processing |
log-monitor |
Frida/mitmproxy/Tweak log monitoring & reporting |