iphone: strace, dtruss, dtrace or equivalent?

Question

Does anyone know if there is something like strace, dtruss, or dtrace for iPhone?

tester-iPhone:/tmp root$ apt-cache search dtruss
tester-iPhone:/tmp root$ apt-cache search dtrace
tester-iPhone:/tmp root$ apt-cache search trace
tester-iPhone:/tmp root$ apt-get install strace

Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package strace

tester-iPhone:/tmp root$ apt-get install dtrace

Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package dtrace

tester-iPhone:/tmp root$ apt-get install ltrace

Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package ltrace

tester-iPhone:/tmp root$ apt-get install dtruss

Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package dtruss

score 1 · Answer 1 · answered Mar 03 '14 at 00:15

DTrace (and therefore dtruss too) have apparently been ported to iOS a while ago, but Apple have not released it outside of their own labs. The best reference I can dig up is a quote from one of the authors of DTrace: https://twitter.com/ahl/status/311866307115098112

Pierz · Answer 2 · 2014-07-17T16:07:25.970

1

The Frida framework may be useful, which provides for dynamic code instrumentation using a Python API. It lets you inject snippets of JavaScript into native apps on iOS (and Windows, Mac, Linux).

There's a good tutorial on using Frida on iOS.

There's also Saurik's Cycript which allows for 'developers to explore and modify running applications on either iOS or Mac OS X using a hybrid of Objective-C++ and JavaScript syntax through an interactive console'.

And of course there's his Cydia Substrate allows one to alter/inject the behaviour of iOS apps.

edited Jul 17 '14 at 16:07

answered Jul 02 '14 at 15:49

Pierz

7,064
52
59

hmm... this is interesting. Does it related to DBI(Dynamic Binary Instrumentation)? – osmund sadler Jul 03 '14 at 02:48
it seems related to DBI Tools like Pin, DynamicRIO or TEMU but not exactly strace. Anyway, thanks for useful informations. – osmund sadler Jul 03 '14 at 02:54
Yeah true it's is a PIN-like tool and not quite s/d/trace, but since they're not available it seems to provide the closest related functionality - I think one could instrument the functions one is interested in to provide for similar analysis. – Pierz Jul 03 '14 at 08:58

score 1 · Answer 3 · answered Jun 01 '19 at 05:04

On a real iOS jailbroken device I used frida-trace.

frida-trace -m "+[NSUUID UUID]" -U "Debug CrackMe"    // trace UUID
frida-trace -m "*[ComVendorDebugger* *]" -U -f com.robot.demo.app   // wildcard trace on Classes
frida-trace -i "getaddrinfo" -i "SSLSetSessionOption" -U -f com.robot.demo.app      // trace SSL setup options on iOS
frida-trace -m "-[NSURLRequest initWithURL:]" -U -f funky-chicken.hello-swift-4-2      // trace URLs

This tool also works on jailed devices. Refer to frida-gadget.

On an iOS simulator I could dtrace calls:

sudo dtrace -qn 'syscall::ptrace:entry { printf("%s(%d, %d, %d, %d) from %s\n", probefunc, arg0, arg1, arg2, arg3, execname); }'
Password: // you need sudo


ptrace(31, 0, 0, 0) from debugger_challen

iphone: strace, dtruss, dtrace or equivalent?

3 Answers3

Linked