memoeb_v2

Ver: v0.2

features

• Listener hook on heap
• Reading heap memory
• String searching in memory
• Pattern searching in memory
• Digestible json log file
• Human friendly report
• Static memory processing

usage

$ ruby app.rb "App Store" -d
$ ruby app.rb -h

requirements

• python 3

ruby gems

• gem install json

frida

• pip install frida-tools

GitHub repos

• git clone https://github.com/marbink/signsrch_mac
• git clone https://github.com/Nightbringer21/fridump

to-do

• Docker support
• Report generator
• Static analysis
• Android support
• Direct writing in the heap
• Log filtration (incl. regexp)
• Tracing / stalking function calls in runtime
• Looking for function calling address

tested on:

• iPhone 7 iOS 13.5.0 (Jailbreak checkra1n or Jailbreak unc0ver)
• Nexus 6P, Android 8.1 (root by Mag1sk)
• macOS Catalina 10.15.x
• ruby 2.7.1p83 ((2020-03-31 revision a0c7c23c9c) [x86_64-darwin19]
• frida 12.10.4
• python 3.8.3, python 3.6

Hackathon HackSmith v3.0 'Honorable Tool' award 2019

say hi & licence

"THE BEER-WARE LICENSE" (Revision 0x00): As long as you retain this notice you can do whatever you want with this stuff. If we meet some day, and you think this stuff is worth it, you can buy us a beer in return.

Tweet us: @ansjdnakjdnajkd @hd_421