tonygo

How does mercenary spyware actually control an iPhone? In this video, I reverse engineer the Predator spyware to uncover the secret internal protocol it uses to activate surveillance modules.

This is a summary of my technical research published on the Reverse Society blog. While analyzing the surveillance framework, I discovered a hidden custom text-based protocol that orchestrates the malware's operations (Camera, VoIP, etc.).

I tried, but I was not able to determine so far...

Thanks a lot :)

I think that I should dig more on ptrace! Maybe a next post?

Hi :)

I am not really experienced with ARM haha :) So the way that I approached it was: - how could I remove the call of fork (because I don't want to fork) - how could I patch the register that should contains the result of the fork operation

I guess that it sounds like a naive approach haha

Feel free to propose an alternative I patch, I could update the post and credit you :)

> You may still think that mode could be still able to catch a new child process but apparently people have tried and the answer is no

Not sure I got this. IIUC there is a link between the fact that we used dlsym and the fact the child process is not catched by lldb in the follow fork mode?

Also it could come from a messy thing in the code.

> A far more effective actual anti-debugging technique is to have the parent become the debugger of the child,

Do you have example of that? I am really curious, thanks for sharing tho :)