Dumping iOS Memory - CraigDonkin/ios-testing GitHub Wiki

There are multiple methods of dumping memory

Objection

  • Uses similar technique to fridump
  • run strings on the dump

Fridump

https://github.com/Nightbringer21/fridump

  • Use frida-ps -U to retrieve the name of the process

fridump.py -U [app name]

  • Using the -s flag will create a strings.txt output file along with the memory dump files

Cycript

  • Choose method scans the heap for the matching class name and returns array of objects that match the class structure
a=choose(myClass)

a[0] -> isa.messages

a[0].secretKey

HeapDump

https://github.com/NetSPI/heapdump-ios

./heapdump.sh [appname]

⚠️ **GitHub.com Fallback** ⚠️