Advertisement
Guest User

iOS.GuiInject.yara

a guest
Oct 18th, 2016
716
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. private rule _fat
  2. {
  3.     //  0   belong      0xcafebabe
  4.     //  >4  belong      1       Mach-O universal binary with 1 architecture
  5.     //  >4  belong      >1
  6.     //  >>4 belong      <20     Mach-O universal binary with %ld architectures
  7.  
  8.     strings:
  9.         $fat = { CA FE BA BE }
  10.  
  11.     condition:
  12.         $fat at 0 and uint32(4) < 0x14000000
  13. }
  14.  
  15. private rule _macho
  16. {
  17.     strings:
  18.         $macho1 = { CE FA ED FE }   // Little Endian
  19.         $macho2 = { CF FA ED FE }   // Little Endian 64
  20.         $macho3 = { FE ED FA CE }   // Big Endian
  21.         $macho4 = { FE ED FA CF }   // Big Endian 64
  22.  
  23.     condition:
  24.         for any of ( $macho* ) : ( $ at 0 ) or _fat
  25. }
  26.  
  27. rule lib_jb
  28. {
  29.     strings:
  30.         $import = "libguiinject.dylib"
  31.  
  32.     condition:
  33.         _macho and $import
  34. }
  35.  
  36. rule app_jb
  37. {
  38.     strings:
  39.         $import1 = "@executable_path/jailbreak" nocase
  40.         $import2 = "@executable_path/patch" nocase
  41.  
  42.     condition:
  43.         _macho and any of ( $import* )
  44. }
  45.  
  46. rule ipa_jb
  47. {
  48.     strings:
  49.         $zip = "PK"
  50.         $import1 = ".app/jailbreak" nocase
  51.         $import2 = ".app/patch" nocase
  52.  
  53.     condition:
  54.         $zip at 0 and any of ( $import* )
  55. }
Advertisement
Advertisement
Advertisement
RAW Paste Data Copied
Advertisement