Failed to spawn: unable to launch iOS app: timeout

前言

今天准备接触下frida, 使用下 AloneMonkey/frida-ios-dump的py,
但是发现了一个问题

Failed to spawn: unable to launch iOS app: timeout  

I’ve tried multiple apps but they all have the same problem

问题具体分析

install frida on device and mac 之后,running the frida-ps command

devzkndeMacBook-Pro:~ devzkn$ frida-ps -Uai
PID  Name          Identifier                 
---  ------------  ---------------------------
824  Cydia         com.saurik.Cydia           
804  设置            com.apple.Preferences      
372  邮件            com.apple.mobilemail       
  • 但是Failed to spawn
devzkndeMacBook-Pro:~ devzkn$ frida -U -f com.apple.mobilemail 
     ____
    / _  |   Frida 10.6.27 - A world-class dynamic instrumentation framework
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at http://www.frida.re/docs/home/
Failed to spawn: unable to launch iOS app: timeout    

运行dump.py的时候也没用效果,只能打开iPhone V.8.1 对应的app;

devzkndeMacBook-Pro:~ devzkn$ /Users/devzkn/Downloads/frida-ios-dump-master/dump.py 邮件
open target app......
devzkndeMacBook-Pro:~ devzkn$

####Desktop 运行环境

  • 1、 frida version:10.6.27
devzkndeMacBook-Pro:~ devzkn$ frida --version
10.6.27
  • Mac version:10.13.1 (17B48)

Device 运行环境

  • jailbroken iPhone version:8.3
iPhone:/System/Library/CoreServices root# cat /System/Library/CoreServices/SystemVersion.plist|grep string*
	<string>12F70</string>
	<string>1983-2015 Apple Inc.</string>
	<string>iPhone OS</string>
	<string>8.3</string>

frida-server version:10.6.27

iPhone:~ root# frida-server --version
10.6.27

检查frida-server 是有运行的

iPhone:~ root# ps -e |grep frida-server
  999 ??         0:00.55 /usr/sbin/frida-server
 1103 ttys000    0:00.01 grep frida-server

google 的相关结果

Failed to spawn: unexpectedly timed out while waiting for app to launch

ps:安装Frida 是通过mac里面python自带easy_install 先安装pip,然后使用pip安装 Frida的

有人遇到这种问题?肯请解答下?

我这里没遇到这种情况,在frida-core也看到了相关的issue但是没有具体的解决方案。。。。

刚才仅仅成功过一次,无法重现了

devzkndeMacBook-Pro:frida-ios-dump-master devzkn$ ./dump.py 微信
open target app......
start dump target app......
start dump /private/var/mobile/Containers/Bundle/Application/5CC4B194-DDC5-442F-A117-2D135C3FCEA9/WeChat.app/WeChat

使用-P 倒是可以成功:

devzkndeMacBook-Pro:frida-ios-dump-master devzkn$  frida -U -p 1292
     ____
    / _  |   Frida 10.6.27 - A world-class dynamic instrumentation framework
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at http://www.frida.re/docs/home/
                                                                                
}
[iPhone::PID::1292]-> obj
                          ObjC                          
                          Object       

感觉比cy 先进多了,就是不太熟悉用法

现在可以了? 系统应用的拉取我没测试过

微信要用 attach 模式,我在写 passionfruit 就遇到了这个问题,耗时长的脚本会拖慢应用启动速度,超时就被系统 kill 掉了。这种情况可以在 Console 里看到 0xbadfood 错误消息。如果没有,那么可能是其他原因。

2 Likes

执行frida -U -f com.apple.mobilemail 之后

Console的信息

Dec 15 19:07:50 A01-27 SpringBoard[627] <Warning>: BSXPCMessage received error for message: Connection interrupted
Dec 15 19:07:50 A01-27 SpringBoard[627] <Warning>: [snapshot] <com.apple.mobilemail> unable to snapshot because snapshot data provider could not be created for scene: com.apple.mobilemail
Dec 15 19:07:50 A01-27 SpringBoard[627] <Warning>: Application 'UIKitApplication:com.apple.mobilemail[0x1676]' exited voluntarily.
Dec 15 19:09:40 A01-27 UserEventAgent[41] <Error>: watchdog: com.apple.backboardd not responding; forcing a crash
Dec 15 19:09:40 A01-27 UserEventAgent[41] <Notice>: watchdog: can be disabled with the shell command: defaults write com.apple.mobilewatchdog WatchdogEnabled -bool no
Dec 15 19:09:40 A01-27 ReportCrash[677] <Notice>: MS:Notice: Injecting: (null) [ReportCrash] (1141.16)
Dec 15 19:09:40 A01-27 ReportCrash[677] <Notice>: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/RocketBootstrap.dylib
Dec 15 19:09:40 A01-27 ReportCrash[677] <Error>: task_set_exception_ports(B07, 400, F03, 0, 0) failed with error (4: (os/kern) invalid argument)
Dec 15 19:09:40 A01-27 ReportCrash[677] <Notice>: Saved report to /Library/Logs/CrashReporter/stacks+backboardd-2017-12-15-190940.ips


没有成功,仅仅打开了app

mac Console 的信息

open target  app......

iphone Console 的信息

Dec 15 19:24:56 A01-27 kernel[0] <Debug>: 

你测试iPhone 的系统版本是什么?

你多试几次看看,我也遇到有时会卡

Frida 从 9.0 开始,改 hook launchd 来 spawn process,Frida 8.2.5 以前是利用 dylib 注入的方式来 spawn。

目前解决方法:
1.降回旧版Frida
2.不要使用spawn

我之前也一直在研究这个问题,目前只知道 Frida spawn process 在修改 kernel process flags 时,会导致32-bit 装置重启,不过我还没研究出为什么,大概只能判断 32-bit, 64-bit kernel 处理稍有不同。

有人懂这一块地也希望能一起研究研究

1 Like

刚才进行了pdb ,发现执行到这里

(Pdb) l
108  		script = loadJsFile(session, APP_JS);
109  		name = target.decode('utf8');
110  		script.post(name);
111  		opened.wait();
112  		session.detach();
113  ->		createDir(os.getcwd()+"/"+OUTPUT)
114  		print "start dump target app......"
115  		session = device.attach(name);
116  		script = loadJsFile(session, DUMP_JS);
117  		script.post("dump");
118  		finished.wait();
(Pdb) s
--Return--
> /Users/devzkn/Downloads/kevin-software/ios-Reverse_Engineering/frida-ios-dump-master/dump.py(113)main()->None
-> createDir(os.getcwd()+"/"+OUTPUT)
(Pdb) l
108  		script = loadJsFile(session, APP_JS);
109  		name = target.decode('utf8');
110  		script.post(name);
111  		opened.wait();
112  		session.detach();
113  ->		createDir(os.getcwd()+"/"+OUTPUT)
114  		print "start dump target app......"
115  		session = device.attach(name);
116  		script = loadJsFile(session, DUMP_JS);
117  		script.post("dump");
118  		finished.wait();
(Pdb) s
UnicodeDecodeError: UnicodeD...ge(128)')
> /Users/devzkn/Downloads/kevin-software/ios-Reverse_Engineering/frida-ios-dump-master/dump.py(127)<module>()
-> main(sys.argv[1])
(Pdb) l
122  		if len(sys.argv) < 2:
123  			print "usage: ./dump.py 微信"
124  			sys.exit(0)
125  		else:
126  			try:
127  ->				main(sys.argv[1])
128  			except KeyboardInterrupt:
129  				if session:
130  					session.detach()
131  				sys.exit()
132  			except:
(Pdb) s
> /Users/devzkn/Downloads/kevin-software/ios-Reverse_Engineering/frida-ios-dump-master/dump.py(128)<module>()
-> except KeyboardInterrupt:
(Pdb) pp UnicodeDecodeError
<type 'exceptions.UnicodeDecodeError'>

因此,我换了一个路径,就可以了。

因此问题在于createDi的时候,编码失败了。 以后创建目录命名要小心了。

谢谢大家的解答。

多谢指出,帮忙提个pr吧,谢谢!

哪位兄弟救救我,越狱设备上执行这个命令frida -U -f com.xxx -l hook.js –no-pause,一直报错: Failed to spawn: unable to launch iOS app: The operation couldn’t be completed. (FBSOpenApplicationErrorDomain error 1.) ,折腾快一周了,不知道问题出在哪

执行objection --gadget “com.xxx” explore,也报错Unable to connect to the frida server: unable to launch iOS app: The operation couldn’t be completed. (FBSOpenApplicationErrorDomain error 1.)

哪位兄弟遇到过指点一二,不胜感激!

庆哥,遇到了个问题,向您请教下

越狱设备上执行这个命令frida -U -f com.xxx -l hook.js –no-pause,一直报错: Failed to spawn: unable to launch iOS app: The operation couldn’t be completed. (FBSOpenApplicationErrorDomain error 1.) ,折腾快一周了,不知道问题出在哪

执行objection --gadget “com.xxx” explore,也报错Unable to connect to the frida server: unable to launch iOS app: The operation couldn’t be completed. (FBSOpenApplicationErrorDomain error 1.)

如指点一二,不胜感激!