# How to use Frida on iOS 17 without Jailbreak

## Identifying the problem

Basically, starting with iOS 17 or above, I can’t use ios-deploy because this tool depends on DeveloperDiskImage (DDI), which is used for debugging the app and other tasks.

You can view the image below:

<figure><img src="https://418865174-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFu6uaU65JuQBpnFAUDk8%2Fuploads%2FxKn2zrNB3z0Neepj74AF%2Fimage.png?alt=media&#x26;token=eeaed0f7-f661-4d07-9581-b257e6ce9924" alt=""><figcaption><p>Error</p></figcaption></figure>

<figure><img src="https://418865174-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFu6uaU65JuQBpnFAUDk8%2Fuploads%2F10o4mzus32qWOCexaFLO%2Fimage.png?alt=media&#x26;token=a1c2bf4a-027d-4f2b-b8cf-05bd63e3ad54" alt=""><figcaption><p>No DDI available for iOS 17</p></figcaption></figure>

## How to solve it

To use Frida on iOS 17 without jailbreak, you need:

* A decrypted .ipa file
* Xcode installed
* Code signing and provisioning profile (Xcode will handle this for you; you only need to log in with your Apple ID and create a new project)

In this example, I will use SecureStorev2. You can find the .ipa download for this app in the ‘Setup Lab’ section.

First, you need to obtain your signing ID. For this, you can use:

```
security find-identity -p codesigning -v (native command - simpler option)
OR
applesign -L (Use npm to install this command.)
```

The code signature looks like this:

<figure><img src="https://418865174-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFu6uaU65JuQBpnFAUDk8%2Fuploads%2F4mFFDtnr5SXXnjxhoitt%2Fimage.png?alt=media&#x26;token=aecc8efb-9487-4dc2-8a81-72b213f5a0a6" alt=""><figcaption><p>Code Signature</p></figcaption></figure>

Next, we’ll insert the dylib. To install insert\_dylib, use the following commands

```
git clone https://github.com/Tyilo/insert_dylib
cd insert_dylib
xcodebuild
cp build/Release/insert_dylib /usr/local/bin/insert_dylib
```

After installing insert\_dylib, we need to install objection:

```
pip3 install objection
```

We use this command to sign the app with the Frida Gadget dylib:

```
objection patchipa --source SecureStorev2.ipa --codesign-signature <CODESIGN-HERE>
```

<figure><img src="https://418865174-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFu6uaU65JuQBpnFAUDk8%2Fuploads%2FXdTa8n4z8fv8NxIZZCGD%2Fimage.png?alt=media&#x26;token=8db294d1-194f-4f51-b544-c1d189bead69" alt=""><figcaption><p>Objection patchipa</p></figcaption></figure>

Reminder: The code signing signature can be obtained using the commands mentioned above, but first, you need to have Xcode installed and create a project in Xcode.

You can also find the provisioning profile in the project I created called ‘Hacking.’ Additionally, you can see the patched .ipa file named ‘SecureStorev2-frida-codesigned.ipa.’

Now we need to install the .app contained inside the .ipa. To do this, extract the .ipa using the following command:

```
unzip SecureStorev2-frida-codesigned.ipa
cd Payload/
```

<figure><img src="https://418865174-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFu6uaU65JuQBpnFAUDk8%2Fuploads%2FwviqBOja3ImjN1QsS122%2Fimage.png?alt=media&#x26;token=6d2e3ca2-0df7-4b80-820a-5949200f0e4f" alt=""><figcaption><p>Unzip .ipa</p></figcaption></figure>

Now we’ll install the .app:

1. Install the Xcode CLI tools using the following command:

```
xcode-select --install
```

2. Connect your device to your computer and list the devices to get the device ID

```
xcrun xctrace list devices
```

<figure><img src="https://418865174-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFu6uaU65JuQBpnFAUDk8%2Fuploads%2FDX1Lsoa8eEqW7cINVbwi%2Fimage.png?alt=media&#x26;token=04e76bea-095c-46bc-bec9-8a61bd83bf15" alt=""><figcaption><p>List Devices</p></figcaption></figure>

In my case, my device ID starts with 0008030.

3. Install the .app:

```
xcrun devicectl device install app --device <YOUR_DEVICE_ID> SecureStorev2.app/
```

<figure><img src="https://418865174-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFu6uaU65JuQBpnFAUDk8%2Fuploads%2F13bgTFVIvsKuSFvZhzNL%2Fimage.png?alt=media&#x26;token=059551de-fd2d-4da3-9005-d804bc84ceb3" alt=""><figcaption><p>Install .app</p></figcaption></figure>

4. Start the process:

```
xcrun devicectl device process launch --start-stopped --device <YOUR_DEVICE_ID> <INSTALLATIONURL_RETURNED_ON_THE_LAST_COMMAND>
```

<figure><img src="https://418865174-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFu6uaU65JuQBpnFAUDk8%2Fuploads%2FqZqCklD4iaXb9oc4pwZA%2Fimage.png?alt=media&#x26;token=dcd0392b-0273-418d-b1d6-851323f30398" alt=""><figcaption><p>Start Process</p></figcaption></figure>

5. Now the process is stuck on the screen:

<figure><img src="https://418865174-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFu6uaU65JuQBpnFAUDk8%2Fuploads%2FwzdTmphXbJeUiQurtAO4%2Fimage.png?alt=media&#x26;token=f7e0c53c-e5bb-4bce-b1da-852918b23986" alt=""><figcaption><p>Proccess Stuck</p></figcaption></figure>

6. Open Xcode, then go to Debug > Attach to Process and select the SecureStore process:

<figure><img src="https://418865174-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFu6uaU65JuQBpnFAUDk8%2Fuploads%2FjsckCNYaVswwNk32a6vW%2Fimage.png?alt=media&#x26;token=4ee66c23-e625-46a5-b927-b85aac338ae4" alt=""><figcaption><p>Initiate a debug</p></figcaption></figure>

7. At the bottom of the screen, you can find the Frida server port:

<figure><img src="https://418865174-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFu6uaU65JuQBpnFAUDk8%2Fuploads%2FPVCZZElimRwlBgVH8tzk%2Fimage.png?alt=media&#x26;token=194a3713-d43e-4327-8d00-afd4e3a6a862" alt=""><figcaption><p>Frida listening</p></figcaption></figure>

8. Now we need to forward this port using [pymobiledevice3](https://github.com/doronz88/pymobiledevice3):

```
pymobiledevice3 usbmux forward 27042 27042
```

> <pre><code>In my case, I installed pymobiledevice3 as follows:
>
> <strong>1. brew install pipx
> </strong>2. pipx install pymobiledevice3
> 3. pipx ensurepath
> 4. export PATH="$HOME/.local/bin:$PATH"
> 5. source ~/.zshrc # or source ~/.bashrc
> </code></pre>

9. Now start objection:

```
objection -N -h 127.0.0.1 -p 27042 explore
OR
frida-ps -H 127.0.0.1:27042
```

10. Finish

<figure><img src="https://418865174-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFu6uaU65JuQBpnFAUDk8%2Fuploads%2FNbozuHssbiPACzdLaxUK%2Fimage.png?alt=media&#x26;token=4a30ef1b-923c-49ce-a2de-47836b784a25" alt=""><figcaption><p>Finish</p></figcaption></figure>

Credits: [https://github.com/frida/frida/issues/2663#issuecomment-1956330432](https://github.com/frida/frida/issues/2663#issuecomment-1956330432)
