mirror of
https://github.com/qtmleap/revkit.git
synced 2026-09-27 05:21:51 +02:00
tkgstratorandClaude Sonnet 4.6
e6bbc4c4bc
- crypto.py: add DH key operations (generate_dh_keypair, compute_dh_shared_secret) and derive_full_key_chain orchestrator that runs Phase 3 KDF → 48B key → Phase 2 DH in sequence; add SessionKeys dataclass for typed output - constants.py: add IOS_DH_P, IOS_DH_G (Netflix 1024-bit group), IOS_APPBOOT_ENDPOINT - cbor_encoder.py: add build_appboot_request high-level builder that wires entity_auth_data + key 33.6 scheme_data + header - cbor_decoder.py: add parse_appboot_response to extract server_scheme_data (key 33.6), server_nonce (key 33.9), scheme_id, and cookies from appboot response - ios_client.py: new iOSMslClient class with perform_appboot() end-to-end orchestrator and build_encrypted_msl_request(); TODO comments mark Frida-capture-required values - verify_full_key_chain.py: extend with DH round-trip tests using raws/msl_keys.json vectors (4 new assertions, 12 total PASS) - __init__.py: export iOSMslClient, iOSAppbootParams, iOSSessionState, SessionKeys Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
revkit
A reverse-engineering toolkit for iOS and Android applications.
- iOS Tweak Development — Build and deploy Substrate tweaks via Theos/Orion (arm64, rootless)
- Frida Hooks — Runtime analysis and dynamic instrumentation for iOS / Android apps
- mitmproxy — Programmable HTTPS traffic capture and protocol decoding
- Binary Analysis — Static analysis of APK / IPA binaries with Ghidra, radare2, jadx, ipsw
Repository Structure
.
├── packages/
│ ├── frida/ # Frida hook scripts (TypeScript → JS)
│ │ └── src/
│ │ ├── ios/ # iOS hooks (ObjC/C++)
│ │ ├── android/ # Android hooks (Java/JNI)
│ │ └── common/ # Shared utilities
│ ├── mitmproxy/ # mitmproxy addons
│ └── tweak/ # iOS Tweaks (Theos/Orion)
│
├── tools/ # Python utilities
│ ├── run.py # Frida hook runner
│ ├── transformers/ # Log transformers (Frida → unified format)
│ └── ...
│
├── handlers/ # Objection handlers (CommonCrypto, Security, etc.)
├── docs/ # Analysis results & specifications
├── assets/ # IPA/APK binaries (.gitignore)
├── raws/ # Raw Frida capture logs (.gitignore)
└── logs/ # Transformed logs (.gitignore)
Development Environment
Everything is pre-configured in a DevContainer. Run Rebuild Container to get all tools ready.
Runtimes
| Tool | Purpose |
|---|---|
| Python 3.12 (uv) | Utilities, log transformation, analysis scripts |
| Node.js 25.x | Frida script build (frida-compile) |
| Bun | Chrome extension build |
| Frida 17.x | Dynamic instrumentation |
| mitmproxy | Programmable HTTPS proxy |
Reverse Engineering Tools
| Tool | Purpose |
|---|---|
| radare2 | ARM64 disassembly & binary analysis |
| Ghidra (headless) | Pseudocode generation & function analysis |
| jadx | Android APK → Java decompilation |
| apktool | Android APK resource extraction & smali |
| ipsw | iOS Mach-O analysis, ObjC/Swift class dump |
| lief (Python) | Mach-O/ELF binary parser |
| capstone (Python) | ARM64 disassembler |
| unicorn (Python) | CPU emulation |
| pywidevine (Python) | Widevine DRM analysis |
iOS Tweak Development
| Tool | Purpose |
|---|---|
| Theos | Tweak build system |
| Orion | Swift tweak framework |
| Swift 5.8 (cross-compile) | Cross-compilation for iOS |
| iOS SDK 15.6 / 16.5 | Build targets |
macOS Host Setup
The DevContainer runs inside Docker Desktop's Linux VM and cannot communicate with iOS devices directly. Use iproxy over USB to avoid issues with Wi-Fi IP changes or network instability.
1. Install iproxy (macOS)
brew install libimobiledevice
2. Start iproxy (macOS)
With the iPhone connected via USB:
iproxy 2222 22 &
iproxy 27042 27042 &
2222 → 22: SSH27042 → 27042: Frida
Connection Diagram
| Purpose | Direction | Route |
|---|---|---|
| SSH | Container → Device | ssh iPhone → host.docker.internal:2222 → iproxy (USB) → device:22 |
| Frida | Container → Device | frida -H host.docker.internal → iproxy (USB) → device:27042 |
| mitmproxy | Device → Container | Set device Wi-Fi proxy to macOS LAN IP:9080 |
Usage
Frida Hooks
# iOS (spawn via objection)
uv run python tools/run.py packages/frida/<script>.js
# Android (spawn mode)
uv run python tools/run.py --android packages/frida/<script>.js
Set device hosts in .env (use host.docker.internal when going through iproxy):
IOS_HOST=host.docker.internal
ANDROID_HOST=192.168.x.x
mitmproxy
Device Setup
- Set the device's Wi-Fi proxy to the macOS LAN IP, port
9080 - Open
http://mitm.iton the device and install the CA certificate- iOS: Settings → General → VPN & Device Management → install mitmproxy → Settings → General → About → Certificate Trust Settings → enable
Launch
uv run mitmdump --listen-port 9080 --set block_global=false \
-s packages/mitmproxy/<addon>.py
Addons are located in packages/mitmproxy/.
iOS Tweaks (Theos)
# Build
make -C packages/tweak/<tweak>
# Package (.deb)
make -C packages/tweak/<tweak> package
# Install to device
make -C packages/tweak/<tweak> package install THEOS_DEVICE_IP=<device-ip>
Binary Analysis
# iOS: ObjC/Swift class dump
ipsw macho info <binary> --class-dump
# Android: APK decompilation
jadx -d /tmp/out <apk>
# Ghidra headless analysis
analyzeHeadless /tmp/project name -import <binary>
Claude Code Skills
Project-specific slash commands available inside Claude Code.
| Command | Description |
|---|---|
/compose |
Assemble an Agent Team as leader and run the plan → approve → execute workflow |
Agents
Specialized agents invoked by /compose.
| Agent | Responsibility |
|---|---|
tweak-engineer |
iOS Tweak development (Orion/Theos, ElleKit C hooks) |
frida-engineer |
Frida hook scripts, runtime analysis |
mitmproxy-engineer |
mitmproxy addons, traffic capture |
python-engineer |
Python utilities, decoders, data processing |
log-monitor |
Frida/mitmproxy/Tweak log monitoring & reporting |