The API endpoints use the Onavo host hxxps://, as Will mentioned, this 'research' app looks like it's just an Onavo wrapper. [NSURL = _objc_retainAutoreleasedReturnValue Then I opened the ist file and found these two values (remember FacebookClientToken, it will be important later): FacebookAppID: 166732727149960įacebookClientToken: 2d49f15626c6430ec7cbdf77f9a977ccĪfter this, I loaded the binary in Hopper and started browsing through some classes/methods, wanted to find where was the app connecting to that's when I found a class called PLServerApis and its initialization method in pseudo-C looks like this: -(void *)init now you're done, you can now use that Apple ID to sideload and sign apps. The actuall app is called PowerLogs and uses this embedded.mobileprovision:Īs you can see it belongs to Facebook Inc (In-House). The ‘Network Extensions’ feature is only available to users enrolled in Apple Developer Program. the app) is located at hxxps://r./ios/stable/package.ipa ( SHA256: 96b282e39e465d57eba440c53b73f442bc4ce6fc10a4445bdd90a412f87c42bd) although, like Will said, it probably won't be there for long. If for whatever reason you need to manually specify offsets for 9.3.5/9.3.6, you can get the default ones here: iPad 2/3, iPad mini, iPhone 4s, iPod 5g: A5 iPad 4, iPhone 5/5c: A6. Exploit might fail a few times, if it does just try again. internalDevelopment 😁and the software-package (a.k.a. Whenever the app expires, install it again with Cydia Impactor. Download Cydia impactor for Windows, Mac OS X and Linux. Impactor allows you to download and install third-party apps on iOS & Android devices.

Last night I saw this tweet from Will Strafach:Īfter reading that article I just needed to reverse this iOS app and see how it worked, this is what I've found so far: Downloading the app:Īs the article mentions, you can download it from 3rd parties like Applause and BetaBound, but after signing up and downloading they both open iTunes with the manifest located at hxxps://r./ios/stable/ist and this is its content: Ĭom.Īs you can see they are using as their Bundle Identifier. Cydia Impactor is a Graphical User Interface (GUI) tool created by Saurik.

Cydia impactor network extensions