# Install Frida iPhone 5S ## Frida Installation Guide After jailbreaking your device using the unc0ver JB, you need to access Cydia and install the right Frida server for this iOS version. In this case, I installed the **Frida For A12 + devices**. ![](/files/-Mew6fT4yixxEwmuTGeC) After that, the version **14.2.13** was installed in your iPhone. ![](/files/-Mew6oNha3iT9q_mu9Zs) At this moment, we need to install the right version also on the Linux machine. ``` pip uninstall frida #for removing other versions pip install frida==14.2.13 frida --version ``` {% embed url="" %} If you execute your frida and got an error, you are on the right way ;D ``` frida-ps -U Failed to enumerate processes: this feature requires an iOS Developer Disk Image to be mounted; run Xcode briefly or use ideviceimagemounter to mount one manually ``` So, you need to find the right iOS Developer Disk Image on this repository. In my case, the version: 11.0 {% embed url="" %} Once downloaded, unzip it and go to its directory. Unlock the device and run the following command: ``` ideviceimagemounter DeveloperDiskImage.dmg DeveloperDiskimage.dmg.signature ``` After that, run it again: ``` frida-ps -U PID Name ---- -------------------------------------------------------- 889 AppleIDAuthAgent 715 BlueTool 926 CallHistorySyncHelper 624 CloudKeychainProxy 1000 CommCenter 1067 ContainerMetadataExtractor 1064 ContextService 1031 Cydia 732 IMDPersistenceAgent 1066 LocalStorageFileProvider 1075 MTLCompilerService 1602 MTLCompilerService 1074 MTLCompilerService 1603 MTLCompilerService 1389 MobileCal 771 MobileGestaltHelper 1024 MobileMail 1001 MobileStorageMounter 1260 OTATaskingAgent (...) ``` ![](/files/-Mew8skf2vAkScL5ELs5) You got it :sunglasses: ## Spawn app with Frida First, using Cydia you need to install ipainstaller ;) ![](/files/-Mf-OfgHrwmMWYz50m-e) This app will be used to get the applications' full path via SSH. ``` iphone:~ root# ipainstaller -l com.electrateam.chimera com.xxx.xxxx.xxxxxx science.xnu.undecimus iphone:~ root# ``` Now, you can spawn the target app using the following command: ``` frida -U -f 'com.xxxx.xxxx.xxxx' frida -U -f 'com.xxxx.xxxx.xxxxx' -l frida.js ``` ### Bonus After starting the hook with frida (frida.js) you can get some errors like these: ``` need Gadget to attach on jailed iOS; its default location is: /Users/imac/.cache/frida/gadget-ios.dylib ``` So, you need to download the ios universal gadget from frida releases page on GitHub. You need to download the same version according to your Frida version. Then, you need to follow the next steps: ``` wget https://github.com/frida/frida/releases/download/14.2.13/frida-gadget-14.2.13-ios-universal.dylib.gz gunzip frida-gadget-14.2.13-ios-universal.dylib.gz mkdir -p ~/.cache/frida cp frida-gadget-14.2.13-ios-universal.dylib ~/.cache/frida/gadget-ios.dylib --- execute again frida with the hook file like a baws ---- frida -U -f 'com.xxxx.xxxx.xxxxx' -l frida.js ``` ## Reference {% embed url="" %} {% embed url="" %} ## `Complete guide` ### [Installation](https://bytepen.gitlab.io/toys/iphone-se-2/tools/frida.html#installation) 1. Start `Cydia` and navigate to the `Sources` Page. 2. Click `Edit` in the top right corner, then `Add` in the top left. 3. Enter `https://build.frida.re` aand click `Add Source`. 4. Click on `build.frida.re` in your list of sources and click `All Packages`. 5. Install the corresponding package for your device. 6. Reboot I chose `Frida for A12+ devices on my` iPhone SE 2\`. If you don't know what your device is, you can check the following list: * Frida for 32-bit devices: * Devices released on/before September 2012 (iPhone 5 and older) * Frida for pre-A12 devices: * Devices released between September 2013 and September 2017 (iPhone 5S to iPhone 8/X) * Frida for A12+ devices: * Devices released after September 2018 (iPhone XS/XR and newer) ### [Smoke Test](https://bytepen.gitlab.io/toys/iphone-se-2/tools/frida.html#smoke-test) I won't go through how to install Frida on your workstation, but it needs to be done. You can find instructions [here](https://frida.re/docs/installation/). If you haven't done so already, you will need to make sure that the device is connected via USB and unlocked. Then run the following command: ``` idevicepair pair ``` You will be prompted with `ERROR: Please accept the trust dialog on the screen of device , then attempt to pair again.` Click the `Trust` button on the dialog on your iPhone and run the previous command again. You should now see `SUCCESS: Paired with device ` You can test that everything is working by running the following command: ``` frida-ps -U ``` If you recieve the message `Failed to enumerate processes: this feature requires an iOS Developer Disk Image to be mounted; run Xcode briefly or use ideviceimagemounter to mount one manually` , you will need to download the Developer Disk Image from [**this GitHub Repository**](https://github.com/xushuduo/Xcode-iOS-Developer-Disk-Image/releases)**.** It needs to match the iOS version on your device, so since I'm using iOS 13.5, I would download [this](https://github.com/xushuduo/Xcode-iOS-Developer-Disk-Image/releases/download/13.5/13.5.17F61.zip) Disk Image. Once downloaded, unzip it and go to its directory. Unlock the device and run the following command: ``` ideviceimagemounter DeveloperDiskImage.dmg DeveloperDiskimage.dmg.signature ``` If you're getting `mount_image returned -3`, you may be fine. Try `frida-ps -U` again. I spent way too long trying to figure out why it wasn't working, when it really was. You should see output similar to: ``` PID Name --- -------------------------------------------------------- 569 Cydia 957 Settings 546 Siri Search 451 ACCHWComponentAuthService 439 AppleCredentialManagerDaemon 561 AssetCacheLocatorService 472 BlueTool 518 CAReportingService 552 CMFSyncAgent 494 CloudKeychainProxy 448 CommCenter 463 CommCenterMobileHelper 555 ContainerMetadataExtractor ... ``` {% embed url="" %} --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://gitbook.seguranca-informatica.pt/mobile/reverse-ios-ipa/install-frida-iphone-5s-+-ios-11.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.