From b69b228f6972a3ac30cb36a327f6a28793d8a5ec Mon Sep 17 00:00:00 2001 From: Carlos Holguera Date: Tue, 10 Sep 2024 20:00:31 +0200 Subject: [PATCH] [MASWE-0014] Add Cryptographic Keys Not Properly Protected at Rest (#2781) * [MASWE-0014] Add Cryptographic Keys Not Properly Protected at Rest * improve content * add new test * Update MASWE-0005 to be API Keys Hardcoded in the App Package * add new demo * add new demos files * include RASP * add binary and output with simpler function * update demo 13 with detailed write-up and output files * update demos to use asm for better output * remove asm bytes * rename tests * Add white-box cryptography technique for encrypting API keys and sensitive data * fix url --- .gitignore | 1 + .../MASTG-DEMO-0013/MASTG-DEMO-0013.md | 30 + .../MASVS-CRYPTO/MASTG-DEMO-0013/MASTestApp | Bin 0 -> 121872 bytes .../MASTG-DEMO-0013/MastgTest.swift | 117 ++++ .../MASVS-CRYPTO/MASTG-DEMO-0013/function.asm | 663 ++++++++++++++++++ .../ios/MASVS-CRYPTO/MASTG-DEMO-0013/key.asm | 39 ++ .../MASVS-CRYPTO/MASTG-DEMO-0013/output.asm | 8 + demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/run.sh | 1 + .../MASTG-DEMO-0013/sec_hardcoded_rsa.r2 | 19 + .../MASTG-DEMO-0014/MASTG-DEMO-0014.md | 30 + .../MASVS-CRYPTO/MASTG-DEMO-0014/MASTestApp | Bin 0 -> 120624 bytes .../MASTG-DEMO-0014/MastgTest.swift | 49 ++ .../cryptokit_hardcoded_ecdsa.r2 | 20 + .../MASTG-DEMO-0014/evaluation.txt | 6 + .../MASVS-CRYPTO/MASTG-DEMO-0014/function.asm | 513 ++++++++++++++ .../ios/MASVS-CRYPTO/MASTG-DEMO-0014/key.asm | 3 + .../MASVS-CRYPTO/MASTG-DEMO-0014/output.asm | 30 + demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/run.sh | 1 + .../ios/MASVS-CRYPTO/MASTG-TEST-0213.md | 35 + .../ios/MASVS-CRYPTO/MASTG-TEST-0214.md | 31 + weaknesses/MASVS-AUTH/MASWE-0036.md | 5 +- weaknesses/MASVS-CRYPTO/MASWE-0014.md | 41 +- weaknesses/MASVS-STORAGE/MASWE-0005.md | 40 +- 23 files changed, 1646 insertions(+), 36 deletions(-) create mode 100644 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/MASTG-DEMO-0013.md create mode 100755 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/MASTestApp create mode 100644 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/MastgTest.swift create mode 100644 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/function.asm create mode 100644 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/key.asm create mode 100644 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/output.asm create mode 100755 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/run.sh create mode 100644 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/sec_hardcoded_rsa.r2 create mode 100644 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/MASTG-DEMO-0014.md create mode 100755 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/MASTestApp create mode 100644 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/MastgTest.swift create mode 100644 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/cryptokit_hardcoded_ecdsa.r2 create mode 100644 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/evaluation.txt create mode 100644 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/function.asm create mode 100644 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/key.asm create mode 100644 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/output.asm create mode 100755 demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/run.sh create mode 100644 tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md create mode 100644 tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md diff --git a/.gitignore b/.gitignore index c7b48bd0de..b55c20945b 100644 --- a/.gitignore +++ b/.gitignore @@ -28,4 +28,5 @@ docs/MASWE docs/assets/Images OWASP_MASVS.yaml cross_references.yaml +drafts/ Payload/ \ No newline at end of file diff --git a/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/MASTG-DEMO-0013.md b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/MASTG-DEMO-0013.md new file mode 100644 index 0000000000..c39459e29f --- /dev/null +++ b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/MASTG-DEMO-0013.md @@ -0,0 +1,30 @@ +--- +platform: ios +title: Use of Hardcoded RSA Private Key in SecKeyCreateWithData with r2 +code: [swift] +id: MASTG-DEMO-0013 +test: MASTG-TEST-0213 +--- + +### Sample + +{{ MastgTest.swift # function.asm }} + +### Steps + +1. Unzip the app package and locate the main binary file (@MASTG-TECH-0058), which in this case is `./Payload/MASTestApp.app/MASTestApp`. +2. Open the app binary with @MASTG-TOOL-0073 with the `-i` option to run this script. + +{{ sec_hardcoded_rsa.r2 }} + +{{ run.sh }} + +### Observation + +The output reveals a call to `SecKeyCreateWithData` as well as the hardcoded RSA private key within the DATA section of the binary. + +{{ output.asm # key.asm }} + +### Evaluation + +The test fails because a hardcoded RSA private key was found in the code. diff --git a/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/MASTestApp b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/MASTestApp new file mode 100755 index 0000000000000000000000000000000000000000..1550d1f223bb360dd1c3e7c39276546cdad57925 GIT binary patch literal 121872 zcmeFa34ByV);C;zJ4+{Qfh_D0Kro;{hb$zB(4B=4){qVXm$B1Hnxr8~hwcs}fYJ~L zQBY}!!l0wL%$RN!Q31s@C_1>ajOeK21W^Z6To55aAm9Jgz1_Ke3Clds^S$r)e($}% zoSZtfoH}*t)T!mxO+Gqv{CsD|Gz^abxEi2~V(gDB9wEkh111B^<~(Cg_Kn&3GbuLs z;e~^vE}%G{P~uaNJ+~k@nU`-0j$;yyB8&hc@yBd-S!-Pq0dxUBgV>n0DN-KL)ULo2 z!rXx{0%o(*Ra5K?L@D{Ltr7VpkPvu?mh;m|{Gdbrn9U{jDrdWZN`6gCM1GG;N+UW% zD%%l)e2Z=KTq$N(UA5I=ou}kix=iHf(21q}bVs}>4)Qr&4qH{3ltIa_`F4@tOOkv< z%jJ`|UE)XWEfd9bUC0{3Mf{+<3bb6w z@1(@9r^JuwOFaSk=Gm+jrIn>hew|l~@{O065Pe1RS)5LLiK|Y@Z?eQsFYzP#(){ej z^GnQ?R#$nIrP6wV{%R$DT_t`*%O550KzmCp)vg+cRVm+UiJyOb60PJR=O5r#?XbJ- z7xwQaiJwj?MD!K$vsSqrbrUZdGuQ?=MuRcf|X&4YLs=&w=YH(9c0 zq80q)%|&@@xp|(0xnsT9##8HY}cmCH!(k5{8^vpLIHU^HjWoM95Z zX_Lr@8Km5x`C||f@g$(JObs@h%k1r5>f-#0B)>=gST0u>cvJ!W&xL+3SiYjSMEQD2 z$|73M&(Ft?&1P=LB^4MK6*i|!+1}c}iTrd@0iqTB6#dHi*(xn%R_a5bk-)E3e>?q?hA5Z6EMbw~xYXux0 z_n*`c?OE1I{QP<&TCO+9)sfzKKM+Tye47;fh?et1%?f^{7MG=69womm62HCDq(iiV zUwdJM%;sWe`|Rzv96-O6i2B}}0cs5Q` zDC$9xCO&dr$&9&q!%=ST0LGFedhRV6rbk|~tzLkiK_3KOU9Dkx{Tah}XL$g6{5%O$ z{{0krkte=F!}`btkn)kAj|b5DWOR+wF}lK5Ji4^5q7*beeE}qg_SJ8~7t9;?z@x98 z-se1MJuwDx@c=#sgzhld?pz+;7oGcuj6j;aV-wIm;-i;470}lLD4rPrZh-WVJaYk* z#_Q1hEdseUqfK>Am$h>AG+VL5;;0)viCpJmyJLZK^dx&t6^zGbuNuW2D#gkoMaIN8 zP0p8n4NBAAcC?>7!6@S>Xu(!2mJ;Im#Locmw--S?GClF-Dp?s1WZE58xw@#FdooG{%9qw&uDq<@+q;bT8037o6*TA>dZ zT(tb`D%(7}qp|>-vfNTEJ#E+yIGnNuDdo|XUUeyX=H~euf?V_{{a8q8Zz%Ml^4R@# z_d`42i^Xwjt%a*`S&A#HW>`)6=yqqyh9M96@70)p%7Mx1h^G079yke3H{Xr5G8c;Q$YCzS1ssU94ss>aI zs2Wf;plU$XfT{si1F8m84X7GWHK1xh)qtu2RRgL9R1K&aP&J@xK-GY%0aXM4n>5g- z4c&j%$y$G3(9PRg66HO8Q+MylnLWJcmPUKey&2-cwcIzGQIU1KUL3B8TobPuc<5-Rp|#IHs}CYRMt8R8 zpiaXU4C}=T`rK;RfR7nsBI1qSKAMQ{|Jsuk`1y^CVcTD<@7-e7vR{mEKD@a(hqZ2h zOoLC~-1!0k-^w+d$}zO=z0I)U=tPG4S?eywk|&0>X?fwr`Wsr_Jzuop7-UNR&9FWJa((w$nD^cDlMn7apLg)+lc5ODMYssz5QNJS zu0~jkaP7f_bCVGkyb0%!H=4Dg%|Eke-?+Z{YWMXc&do(S%3Y&DdilYl;gIRzSnp@u z*!JFnDBIysR&W%uwF$cKujz*HSTX!=S5^?(g*9wJUbMwW;iCfk{@=*&fc!_V6Z84H zu!5cSz0!^*p&vE?j|P4W_!{8nfv*OB6L<*lLEwSFM}YeR{|bzDH)?yQ9qkDm4IB+T z1h^Y;5^yKrOyF=}Q}49KBbxouw#8}PAj4khkmP<18fkldPQ<&ub zR>umQ^UKqykBVRythtM)dkAaLM7Z<6LjQe^_I-tRHecOzJqvMP&+Y32W2>$oYvtkn z2*<0BjCJ;dlu3TK{);gi1~tYHPw zozO4Qz1Q?zD0okYG0%+8bMPA^ULH{cza*M2+tI!vZU4*7oxKhH~eYnlMK4F;-?_%;b50Uog{q z)(O36Lp@De^PzYa|M&j{s9p5!4Zhvs--hmm;kIdo{io)HqMk5}#c+&8jptWw4C>eT zPC*CmI792vAGt{m1okYDWH7wNz8%Q{3JUCFJ z`F;fS9?6a#7^sPSvNVhpB(yGHPw~3lD>l>kI|_MgU_S#jvERq-zHf7(z_xR{U|l_H zw5(z8kIN2fRxl6QMge4|whaZ=x!L}REVh53hW(Q8?CQMK|=|=JF7hdJ66S4Q*-YV`yF7BYF)BHFyWI*ze<6;h84LMlu{h z-{8-OvU2((;1& zoc0&AtKcZw1Ydlh?FegWgP;5ECYG*4pB_Vd4?9%ivdVWy^95s013r`cvmToMdCyb-K;EG7wF$gW&U_7h z13S%R9F^hWrDkX}pIq?#?YWLVs@rY~ynE-Y={7p$_W(Bhru7Tb^4Ezd9A|)Uj)!fIb0D zHWy3%gD`By6KiCi-b~{;gt0mfHi`CmnqmJf$bY)T;BD6SM4$BXy>Y&6qb7un)t$wd z`sUX4xkH*Zk62LNlBg0}QR2Shl7aV~O~zhM&=evS)|E zSFgsHKlBFkIK$X4kDP5QAfEvRt!wC-(b~-Wv)v!In6tcR$}+iMl>6_q_LmT^LE8ni zU5ow?fvttY)-;~BH^cU0zV;N4W34T){WEAMpTA^lCF+mY(a$=!xutw%h*vkr(0WX( z^Wi(wby4SytxTAB=oonDt_K`nwmw0ld#`*HgRf*BuFox6oFF z!SCuKphKoxQ-OYO1s|GQDIewG{8$&yAcQT&f+t$4Uq@@79dESH-~BUM8T>{q+WH%G zyQQnpvLa5J&j)3+_Cy-#!U#Sjt9ux0-PlJ;?=F_Lp{zSB)XQ}ko6*`AW$vHAT2E>F z`5qV}|zDFZP8|QL=V{8=$F^`e@ z3-b)0ZyJoq+uL^y%F%pKoFSm!$p6IpiV=4faiq5;6du5~FDVYgSm@`Q4Z7$mw!Llu zYmF7$2V&Wo6Bd*uJDZBM+HWU$myR*CHVtFjX^buUPVg@7!CF^99?C;DN&K6&efYTQ z4IaJ0BNqLjJ=eDJH1ceLP2kTptZP`=h0F8=+Dhvy(e}ECcC>};D8_dbY1DVyVH={K zIeTC!#@JWdzI+}#g?fv^SgWP0sGIqyJE14@3R@-jq$n0C&qdgkHXpo z4`NHd^_T)-ErWzbTIk=>!4cL zXfxV2QYv!>GVD0pwvqZ!?7u#~^^koBbl8iXJs{UhG5iqC?az|@&=HlTu{sp|>mU!= zL(K@xgNW-P@h^o;MeuEYnU0|De1W{AkBs$F9r0L4zXH1PiN#*hCD&K(JqO~C zKXoGhgAY!`uRVUk7=HT!jp5u0FY>v#u48nPHOWy(7Rz@t&lB&^reaO=+H+x z^pV(Sy#jsKCa{HRn$?@*U_)`Rp^v*V&)zuZ>8ZJIGu3~u#QQjKQxE3h{8otkG~h>h zRw0dWQJA5%4(rFmkcDhjth*<#+n<+owZxwvx;zXUUgXcaA~-LDObjwrN%{Tr$b8U^ zpDgyy#~87tVod{G*~S@Kz4g6X$_sTEW3j$H$ir>DsEg+)_5pm(6$B5-IfBwKzr08| zEW?Y16dz05LDN3qIgVp}+khJ=5Bk-DKAp((_4fHF4(n>mFhlEh%so2T$m@@Z{l&1p zn2L0=;Vr;Av_Xe9=pvSjx?d3;&^`5W`4mHIc?J{rQ-&^{S7ox2oU|t(naNhEU2A}; z?JvP*lx@BPY5q1pDdR)sk4K0$f^iK#G#|(L{((GGA-@fJEQcPwXhS*l*a$r~YTWq| zkUavjWA5@rU|txmi3!MFK1}B|&|Criu2a;7La3v+591?H*K5d=1-haGeYGJ!=?j~U zhQ@J>&KiCmzM{P@xt@5P&=dYHP@qqnQQohoBfRcdpOJV$PcK7HyJU7T0r7shi)B1W zM~|Z{*~J*-@#~1%76-Z;kBjwP1ALvL4F&=0e5nmXkgkLLx)rg3F}I8KD)qBpe#{>M z`M1gBe_oQmJNR7A#ycU8zb&I>{HQGprM8f6$;NL%I@!?Pc8>UnX9fvp#kn{a z@{&yNUZ8gkKSSX57~jRS1~SopjMm4r4y8Q3llJv=47@(}ia&qJF@G&KFzbQSW`2 zFWp#I_2%VceKElIK@O6|4gO=L_%R&QK2>>+(R6(RWYOsut--Iq&{m{6uQGV4ovVj2 z@9#RS#lgQEK>Mh^0p9JhV{e{p#6DGrGB^w2`%7KootyE8?YdJPI>ZISMTYdf=i8EX z%&?30qB>1PCx6-s)-pB&d@LH4Lgf;eCV${r=B4(pY->xU^}4QzrBm8K;KSgP5W;5Z zLRc%saogO|2mS9pKs5T~=Rr;VFurissADmg+{4ui`)Pd8`i%On5oj@}?e!OR^W4wN$6c~~B=)=0u-_f7>HMBo z+r0&ACJ*h4ti|pIne*FK-m3iXqQ{q#Wa;r+6uo5zlFw0^%- zzxrhxkGda5*^cDui?roP%YmKHo`~~r>gJh4a$W1*rPJzgCK2sx<$JF_u&)@t=Eg#` zA#OSIa+}U%>B+Fs84?d#Qy#{??<=&Ag<(z|=H9g$eBv}L9e=`ZCR^bi&sMA$AM*%H z7xVV?g(DyB6%S*tfc?|Y8E9j3C~J7WEZzGO-qj?6H?>!^%Wj_0kdNd|K%Q@a1;(~z z#E~7o4i~&_B{=Il|I>k^IA>2sp4K5O zy-mwnU()8IY#)ApMrCRK9ReJJyrIBhpsxl#3H}Fh=1b>zjdwVu{aiHn_md$%n{H@* z4)sx3lWS;w3gL6w{yrLy*8^zpCIE|jus*)$>+@Ua91mx~KOYjhdA_1O7uwcXUx0I1 z_pWk5w+2qSHFgl`jMgr3zL$``^RY!e}?i=sRSvCr0B<=zz$@6Nw- zenPD{zs32me)_p#Fv%O^`y=F`vcI96fBy3zZZG5@pG0S5FKB0>ojt{J8DhD`)J|<7 zm*FVtk5<@8Z*C`a_8;TBmDkbJx1)YG_{93K=J?rJOnjn!1w5@U^7Rw-_^7ByGmob> z(H@!3N~3)@^0bo*v*6L9`yndpLD|Mk{5ekWBVXbzVfzy(dx|-?>@Mw&#}Smd4)TZSJ!VTr`~cKo>$ zKfp%Xpno0472d_xkq?6Z>p|;v_?rXdZ^8k+&`-$cp)(Zmj8^NLjeMt3p3XW&+wO() zt61OH@DCBlPv<~%2Kp=31t;;&i}t9WBi<>n9^!tl7sf-ZuNNP$eSF)Hb`1O&oA(gb zAo=2XSU>QK_I(4}{t;>9ujriRH2C2?H~5I-jmA|N=Yusl_^_z50nEGhfct~3C$_Bp z@I-v&4<`n7zWu;%?^7op+4}woP1Cs(`@xUS_r!CY-jKZ)>gwtH4DpSRi8e{+WxqrI z#y8o1E$oDRpAY<(XsK=*)4kD#UcP_B7gL*-BQ2h>eaz6;qX`w?eJn&A$=!%?6RF9= zxWW5i;7Gg=X*@#pylB3mcF&AMvzc<3-SyxXVjnlrMsb83O;-RB&hCHYH`QIm)rtBf&r+Fm%9AV)v+2^!T zRRgHp!;pj8=I7xr%j@@w`87{xpA(SZUuHd(!I?Md_Ys7-?tpcMq5;DJjR*_CLnxdn z;EXfY$Bab-1_6d4?FH?emM!(4j3;@SX5IM4Cu%EmBtEbFw9va6@8@@E{q2fI|DipY zlN#&u_#BXcwF1tlTD>SAui1ySf_uE~FPh3&%mb_O&P|+K#4;}qaq;;t7G<~|G5?Vs z$+z`Fox$^;I0sN&O{X>X)36(+#r%i4m*&_PF*gw(acso;#-Pu69~MP!LUx)_?m>3*Awsr|(6iH`beY z{d+Oj#46^#6pTY^w||}VD(4-Cawg1My+mGvMP3a&O{{}>KSI1Qw|gIB`_o}Jy=O6R zA0tcmzRC6{fsQ_>@e=RfuwE70*~9aX-_cHkd)Fg;-lO;MJ$?6bzSJIC`}OffaXQ-f z1lr}7Ya@@NIl8A$l%qXA{^&IySDTRk^?Eu-nS?nm8*^P2=DbYIeHl1MF?x>;`CA3; zdoJ8dlK&FlK{vw}Jk9Hk@!i3(xK<(mlhfL^k!<5pDP6vQtP5o^ZCdUApRN-sk0)s> zzrQA=^4O42%)Mc#KOA!CAWsD3ip1R83Gc@R+!N6GitfUB^t7!f++CYaXtta^;D(R8 zoUeWwd0Hetc?N#+Ciuyh5J&GvsL#H_xTG_2^3x9@p2iowV?Q16)BSu4c^jxN$-njW zJ%jg6na{^meIv^F{&WIZcm_ca(w$6H4-#j1X z$T!2^ZDaAHJ!z=7=0@f{in#;lx9Kjt8>wB%(#!uURLlU|phNw3%$T3Pj4 zSmpAsH0ee2bIRny<+}j71yCxA#T4@*(2;Ozhh_Ea%^U zz4Y%y@Amp0E#i3T;^~5V8;@xBZ+}d?e>(UzK2eQ#8Hrvq;>q_60zW!u+Jf{ElwL2+ zYqU=%Ur%!y*3dn;@A@as4dJ`Wai5CD72iL>SMjvB46XenzlM7*+-7=1?gXBf#vSdq z;D;$c?n}{Ho91vjJD@cI#fxJ#4tphWPlG*(y237>u7Td}pQi z3Jpjj830HVeT}$&>E}Cy`1Ua*U=2X)ml)rZC{w`siN1!~Oz-n(%}rwyYaXnVH2Z(Q zn!jsHZ^8S1+V2gA9*$wp*NA>-!=CS$wBI8;xYR!H1MG9b4|{e0Sd8(#&+F^!D@A?V zKUwJAS)ZTwLW$G6OIwik6838^YiFmug8d2hG-+Pw2O{OjdL?VL3427mmV z7V^im25!{OP4gb~$Is>KeKG!qG;cItCxg!oE&eq#omG2F#Pzcs?RFJ1?;?!N#b0T> zb&s<2C3r8r^edLWY%pu3zQVfV#d3^O>PuQ%vCjxvLAp@1O4c2*!G6cTIFIsum_@b3}j;Hg1@~?#S%k6{OGI4j) z-VOdC3VxzH{6!D=4cyyY8iRXXp`PE-_h&HPUl^O|eG>Qmo}xQ`j~UXvC5Cj2F$ZI1 z4@I7DJ7C0Gh;_CMs70I+af3P+4R{{m-!R5fHLOQJz)HktAPe%{JOK7n(1f_x z@orED9vX?q3Sjt(g~X#6VVt2Xl$WzBnAl_R`Hmw0B zKfJrGZ69Rx;NHf*5}cFc?^W-6TPNP#pt&Fm>(p%MX)ng!R+Kr8@q0MOu&ep`Ebz|u ze*M5C@9D9E_vjIg=PYdad)V(O*zXV6E6|$x8_aqC#yI!@<+)$Nx!u1p7Y5co5#$f( z%s^Z-@jR@X=S$?FHO*vN^VGjL{&4;K<5{TibaVX&<5_R__09EvL)>1(;jFs;U4-8m zuhD3pKDV?0ePco&<)g1=q0jQ*(`S0ohunv^)l*+aA-+4(dmvvl@}nP@#^Sz7DDF1t zd@tk9=L?y}^j%m3Y`wxhEm8F88L3YrFVUxF^x38Q)T{~aQ!nm?oxX$Z`ZhY;+uSM4 z`@`r^@8Owj*N-n~y+_8fU8l8?z6kUY&E}>M-p3VRSa?oaFsBI>&qZ4#TeBIqzP+AF1z$2%hg0eJ}QVAKy&y`xD0g zSD2euV*Ecq_ZHBXhtZGjFfID-!}0FH)Sr8KAG*Udh@<{~cl-(g{S6zWy~}3!I@-^j zTRI#4Re*joq5tyHkF(Ifd0zCZXM~o;EEQPHtpNXf7K9sM-#z^APR^9QjB*;37r+O1 z4VU7skyhiObtcYh_BmH}g+Gn|8X1hj>Xve1bV?;Dn8fH+$iojqkW&E&74nDS5F^lJT!t2&f0>`Dtls` zES8J*eStEs!zZ3wnuYddqMaFNuMv8Bi@ytWhZ(&qdl*_jIM>#*4L((V_jEGa&omhO z0^1>u)oz~7sF%*iI2|8FcW(9#GDOjPwS5^bL+c%=kFNo4z&IYlyz#`N)PVacbXPXo z_fNEo`06xK(mO2iy$R~(<1zSsn)r@{=DpW2j|KaPi@&o9=0WR1_kpb_e;9J}KIHdV z#Pd(;Tlu>ooM)uI3VWgVT^oUkenp~j$1Y$;ZoHel7j1Dvch3UTeDB}GlWk$s9pl&S z>9ZZ`b{iWR(Cs$bzwc-fbsGmA(mDe=-Ud@89d8>H--C3#E#q;_Ct^D3cAH$ct3=&y z(^GpTzA5(i3@5pJ5EceZ{m!f+;ZI3Z8eEBxovm7m99{3v%d|^X#{qFJf zy+sk;7nI{Ys^9m~+PLFAJKvjaW6eE0dmsyqy*T*#y|{}Zy@%S?(f%w2`!lS=JoGIC z-KAr6-nOl?I8O0y^eE;j>}w9JLV6B>?9l(Nht4PJ5w{obnZ>g~@%{VjSntZu0!Us0 zxeg;yj>ZTd|IPidMq$2t5C=b(FYkZTqwS(kG;ruRq%8&d0msfIsAQSURYqd8Ake^nrhIBHD>2I_UmFket?F9tM&f z{Zb{_2$v_#(2Bd;BCkQgypH4U1NX(a_wyBGyjCV7=VgfToQAHbJ$_waAH6L~z+G8k z;2|DHp9I2~!vkUX{6H9fKM;g405D)tagonw(qhw*+?+WC}kcIPQ;rX(#Ll(YG z7G5a}-z5v*BMaXz3vZT%eX{UYS@=0wc&9AeWZ|u{@N=^8PFeURS@>;P z_>e68nJoOBEc~M^d_opJB@3UCg$3Lt_xI^2S$K>roGJ^ClZ7Y9!WpvgBw2WhEIdON z&XlT6~jM@9xQ6r4j@&*z`f^WDT0{(Lj>z<&NrJozg7EWbsQzw7DT3q>H%!;^KXpkK5{iUsq=sgl{lJGuY`hQ^bJas2y33u@z z+ku9^AT_=hCSr=c9_0nrBy`SZ>?&MjoD9IZO1o$zos@5~OeWH0BFZiYKRKR^3zbCw z4D6TTMaV!;zSU{3agteN!hTba-otByKhD1PI|WT_MS@Svcjc$3LoSMADS zB8H?RDOQ8av@FL|2Kp_Cja7}2=Nl$q~Atkov@MzGV6q6S>Pos1&L_!NBD!3ONz-B)`CTjadM8(3AyWp zyYbspmXnhs{K|R%fs%8CVVrPt0-0SoRKy%$i-7Psc5_lK#%!UIvLa88af~^~IIB*0 z9E?HDp-8bf`pr4kB>q>&WHO*UwCH0l#cBSV-hbB#&r{f#0sSIi7M{XyV`iQBBizFi z{Uqvr6=isH#&d~Z!*8)US8@6tO3o4HaL&(iA|Q`Bz!m|aGi8xtvW15ztGqcMQ~TPR z1IdR_0kc4xT45}SC8Se~s7K;>BZ`=XAMo3lRVV%kACgo7(l|*tXQYa9bA)BQ@Ok_e zagPf{FZZAu$ zGTKSu5K0OA5s@Qopx>MouUF8Dtj1Gr;eIi35~NB(e4SwBze(?AVK~CV&6LlWO+SK; z62&n6&J@N{aU(ivC+C)iVqz~o#AzKR=Lq|;x2Y4Z;RG^MH{fP9#l6lONBvtT4B>U| zz;99M)Fj^j0n(TyybV^o!famtZ}=@%IFi#FDLF?d;uXHc39&-_M!!j^q&~dz{liEkn?I*BYf#>^bS$qW95-^2)d zq_W5H`ygEo+PT5Zh<0EM686 z-xeN&Kg@viSMg0vop1+!L#FomFbS)dJe0YI=h7UcGVRYK3;yG6X}rrGU*fP@T-Nw% zhiwtz1=hN8@r<>nmszW<4xXc?xWZOK8NjAJ-CFB%SV~;+)q!LxUr=sy#^c8l@3d4_ zS6Jg+$k$#yGug_jY*l6P^SB&TBKVtP7`scTPvCRdp%tU?r(lRe8$()`%HZfJ7o}?d>nVvE!Gc7waF)JlK zD=Rs3(ir2Itc=9;j#iEBY8ZdAtt|>GWOQ(w0pXAj$sR8KP=0*#(xylLweMd(zn@zk z^3MW6bk%LB8oX$cQlUz_;{m4}eD& zthos^J$@eRI^Yq8a)-eq4pl*%!(z`3Hf@jN*DK(4JLiP|*$zz0b&`!9TJI7N z?T^EE7i}j2*P=YW@ow7=Fqh)LNLN_u3dmG5?4@<$FZLn$qbQ!vygbRe5^?)b#&xzm zjdE;~Xbt~Q!;Gy*zMIi@s+YDOUX)pjxbetW0Px4(kN8y3r54A69EYVY(_VqySi8Ik zvPme{e4?$b`q#F$b>E9+seC^`7$6xy4`Gs#5Yj_{L!gt8fq-sA8^r%Hk2{xaZ4G|m zp|JcR9d>3(>{Gn3#S^w#%fdHlnHKLV1>Et}_6udYv!P6A3S*iV!4WMi;|`X)%ly#V}1H@cY0~u{iXOWt#E82H<6}Oxuj`NrcnzVx>8bg>3J~ zBK8hp+W4z*!*wVNDIdvL^++b*8|Ki}a03mam}b*x#$FuFgs*{r9?dkRV_*|wz%Pku zuZ05i$%sp4LL9 zvXeW|Ie4H0@yY7iB;4G&f7C;oKMNbQ4I%f3ZVcNL{wLk$hzBAc#FtX)qiR6afT{si z1F8m84X7GWHK1xh)qtu2RRgL9R1K&aP&J@xK-GY%0aXL422>5G8c;Q$YCzS1ssU94 zss>aIs2Wf;plU$XfT{si1F8m84X7GWHK1xh)qtu2RRgL9R1K&aP&J@xK-GY%0aXM4 zFKZymP2bls7UdSdr;BonpMXWV>7zP|=U>MG)Ax5o$K1g&eP70D@lTFKxg#W+zC)yZ z;-3?Va*JP!MY+33@%Y<)JRRTZaU3P#?h@`HVSHkT2lYu9pU`m{pU`pKQ^NH98s+OP z;XV@XD`EO}kkb20cz}fQtstH#cf5oLNqDe?he-G;2@jR!h;VBZvpNYW}<(?+t z=@OnH;h7S~H?DZ1-1OZn;d}|3BwQfj*%B_4@Ei%xmGBJ`zEQ$AN%&?7|3SjHNZ2gl zA_-e0TrA-d371OPD&ct&E|YM%gl!U@FX06eu8?r0gsUWMmvFU&7fRS6VW)&$60VW( zA_?P93E_!y*Gjlf!b>E)RKm+7e5-_Slkjp0yCu9r!Yd_QFX7uI{6`6|lJFf8UM=A} zC485J*GPD+gzuK{JrcfG!s{gLk??v6Z;)_`|C+j9=BEy5G8c;Q$YCzS1ssU94ss>aIs2Wf;plU$X zfT{si1F8m84X7GWHK1xh)qtu2RRgL9R1K&aP&J@xK-GY%0aXL422>5G8c;Q$YCzS1 zssU94ss>aI{9msD`am^70=Y8s`1hXTSGn@|i-p}tpl>ey-(C9iiF}Iu~8h}ZvhS{FO* z^EOKSLjT?6^Y5Op?L_4Bu3-nh_~`Mce!Xc}%Kni* zdW?VFaNKj|lg#=*n!XXV_~+2V3b*F?>vbRe*f7S~&wR`3Zp96gH(giYzPIn@FE)GP zd@&C;&i}SzTkG=mYq~VuJ~aB^Uu!;#8+WkV*?SkBy)EwdZx)uleb?0AdqkIKAL{w) zfqGldy;-+!8~SzbL$mG+t^0P>lv8_dsm|~9^Q4lDF@3}H>wnz$N~fwG$FF`_oA~ly zuKL@k>kb_oDj3;&wWF8M8lC%d%jcut?6uceY_v^ls@+ua;peLcg#4*{#r2!kKJw8E zlOJ7UN=Q5xYc6csv-{hjYi#vLZ#Zzxgnz&D^6y~rljiA}pFh6qh806@*&p>|UHGWI^qKN^sz2S3wyIA<(`zqm`}5s9Za6h=-0@Ee7SD;={B-Wa zf}!Hq`%I2?w|}*wTguY@@5DaxMb+my3p&`7VO>cc| zoh#+N?sWr(VIT@>KXqyy62be|Hh=w%aolykJX^c0 z>+IIkAC+!+dhxl${5#nAI{Y7Pe3+a8d>YtqlN67CQ_bVgNErXRx^0S-ZyGSg`}6xT zm7{!FQoc#R`1jct9^dHi@Q;(tQ?i@?<0*MLpHrMI=UwMv-&ANW0>>Hn+m z1>OeSV|iPf54afk6JS3-KXxJhm@Ix7XsXAbej8}g$0}f|cP;QE!2Wb4J|X2(#=pWN zqTGJ`DyQ4O-xmMVczmGP%{3H^Vz2R-DEGb)`Yt<)y)Mzp@>B4AI=5G8c;Q$YCzS1ssU94 zss>aIs2Wf;plU$XfT{si1F8m84X7GWHK1xh)qtu2RRgL9R1K&aP&J@xK-GY%0aXL4 z22>5G8c;Q$YCzS1ssU94ss>aIs2Wf;plU$XfT{si1F8ltuYq`EDF;+*8QTp^U%2`o z`9CJ6?_2d!0{?%_hA_sO{5i#Pfp{4g4Ze)k;DcGsBEUXC0zQzh0K5jcR$wu23oO*7 zWuZR+28XcFHvoe}S?G;`rvP6AriHQ4)qp*K&fzR{8{kJko{ojy1Nab75Wzz42Yd?n zB9et>bYh{m1HJ`J?#x2h0=@31*(4!mp0QLe#MX}IYz+Ql^I}6PR ztOXne#P?vKa{*fb{i4AK5EFwufF*!W0m-o}bQxeL;7h=^ILHd{^<<%rUM%zs;Ktr8 z^l?BlAhHkS27C!f?aM-M1H29R8BoxVg}MPx0X_wU^ha9&KETg_v;i!1KH#|lOmlVs z3wI1;nhyc<;+f_WyM&OtsEL;zmFoeZS8^SdA zBRuXZ7VZLk3m7nzg%<&O4P)WSfEj?>06PIc03xqu;iIl*A>#pVfDiB~AS8il#{dcd zwFxZzA;7)_77{g_g(L&!0U7{10bc^LMlkInz&gN|5lnav@FCy_K-4u%NCwOWECXx- z>;ZfW7RD(XfB|qDU>jh5A`8`zL7xK7i~)}%7FrEx0DK0BOoojDmL;>W$CJ^{WG3`WVc{8o ze8BxF;y^K9@p=&&Ag~-k*RD^+2t~iHQVRSb6Q;{+vW34wG-JBC*kLOzvliHA7SFeqxNM88nI?Pc3={Fmteey^|D;rNO;w4#s?CYvklW#*((r(K_+H=FBBcD*IhoH5qy zs;jn|T^2KxYu6{uG?^({pXp2-V{)NWN=zQg1qC__lg$v#n3*^x)9$e5I4srWwh|Q0nN(r7xC+hax=a$Oy{xIkVXvqt zv{@GyPOrLXk~uNOS#DqK%tiZ4EU*seSm?rKt#TPN>uPh1#$;oy%{ep4WJM*W;@Y~o z*%wrmILB61YG0h=u-8-<1{J657m5~?Um;si8W$kNRAQ~N8jaJrX$IPtXwIy#RcFte zhmKY@a11Y!QDdtpwK@tD^~Ds*sIZqTsH?3t8ugj_{3R7)7Y6txnJ1%LN)}AB)Y)q; z;Fx4CymYF?VY5Jkr0$u?1rDoKDO2(^Tb0$~K+l!hpxwf>GAWd(ce*SNSDxKg<fIuYFBbpXfoNHXDKa(g-I5rws|(I z!)Tn77i1R70t$X9Qo+(p(LR(7ydb@7K)I8E;Jiim8qm`f6mSOheFp`UG89@Ja9Wm%_O_>D zV7g#PnTyJ}I}B8xHqDNVwk6h5(Z@}-))giuIk~@^W#qSsf-< zU4?aKqMjU*t*XXe67ga+Y+$367k0*n={}D%HYnb&;ZEb zH(7F|<_)zx`MV|H?-#a2~U7wo-~rrFD8 z>JyV3HPBS0HP`8cjb!Rg_H;};b|=kH%1)B`^|VF)uFY2TWHL=aqVrGGm$&Qi68Vy7 znz}^#B`V{#oZ_;%Dy$dSlxXOwSym^;C~TtAUS)SyTS}~@u!(G?O$6r-HU>pnkpGa< z=5W7Im|SeHD7~;PT+Gyx8mG%%X-;;+%(*dN#AUdGdrGRoS?6?FE6u5;ygjLld4(|U z^a5+GOSF5lG1K2%QyIdNP^PjDIm!w`?9#f6Yekl`BgF&{`(%;_Gbni*QGhy3PGTeU z*?M@MpcRXhJ!Kx&DB}3Zv{%?2ROX_&xhHGq+95~(ETWjQ#OgYd*qrXN6jxYhU>-;< z#xSn1VqH?neS3*9u_OOvHknLiCVScpQwGnUX)1H-Q^l29E;Ur?>BY*iF03sv)nPqR z6TAT9!s6tE;iDtg2o`5EQ zWJ%5C`3seuPLryfI~D^@*9A3{WM96DlI+XXk(g{I(W!<^_(Ye~29phTNkW!bC;3^J z6>_HV{)h9=&&l9H6OGxK$xhH6ndn9G2OFxCDP?gv=8_9Mg_Ig>6;h-*$zd%`DZ}!t zD!CZ*=vX_%vAJkkQHp3bC6_9@T;js_0%K?A@&;up7TzgjGS>?T;wt$fv3!0LmxGGcd|F^xoLWK-!wHXSsWTcSh38zLIoS&AVyh5Y zma!F9th%eh=&b-UXv-P zqAT3Z!r76l6PIUjb>bwY;FXNC14|nA+}JTxm63mhALe`Va(GL)wzO<1EwBt$a7e{O zP-$_QA#S-jXrn8Q8b$tghRHRqd1-Mm6Dxz?xQKk-TOG-{P5Uey`tgLD8K!$0V8Cb!BuoEOma) z{tRQy;uay(UI{a|&at`5O_lbF%yMhV0<$^YT3bzrIZ6Gb(JkN$BBP;<;Ht~EZ zz-D?inUNEYq|#D_Bezn?!_-xyT9dT|+l5SfbzOEXwnJc%Z>@G%ofz=^xK5rUuco-d zM%e?A4l8=WgmtjRRpYP*N0ZWMi27r(YqQNm#|AQ+%_ZdvoUR4tQj24;t%{k=&^op| z6m6adFBTkAR%3CLBFafeQrVT&m@8#n7nC3~8FW&G6_XD$FF;d`E|-IvTVZix+ET{k zIc$s2o}dI1G@4tLVRHrNFTjafP(F&tHyOn^RAHZ#l4Bbo%dl1&jl4__PxYE7|5%%KwCFV+J znF&rqqU_Z!*hmG6@shdZRE?4Kq1Nl`I3|osEBtooi*A^#M93}6!kmyUoM9o`jE0wTrQ?cGCMM7e}Z@r zD>BFz1?f16B=M)v@eHcvc7jt+908R;;bKivTChlER@Wr76UI%3Fx~31(2V6Tf>fA9 zp2bxzi~KbWc0wg%WEm(aqi#Asek!H?Lv9thEo_6XELU!oUk<(ylox`M zs$h!+v@`M7XoK>Qv1CDT%cN)=xCF;bo$4>`K$F|`hjZdAQH5|KRs3*1W9FPf`9Tj~ zeTlBge_A7MRFX5WX*6b2KeoFmSa@;f|3jObj;i<% z_ck4|;QMW^u31YKl?CTW?BHNcd30Ajop({4E4ZuZz$dt;_z_T`qm1Igcn7`3^96U7 zSd>;x zjmv5-$2#BYU_JeRHd%ZZCj0GnYgUIxmG-+`Xx8k})Vek0XEkf14Ov&k$7C6@VkSq$ zWQ8Pzj4zGJnrw)Q`g^B_u5%yPwuHa0ZPtc_^l}TGZ`WjvkBYh$*sZxaD{Fj0LdfkJ zL*6z`NOD$GRMxZ*@h{U)=+D@A)SHoQ;jgyo&&PMuh-viRo8Dgo2VQ~aE9m74`bh=- zfr37zpht?#1N@hWbPTfbXTL}XUb`Pt&;q?jXDpCDK|$Z3puGzE9}4<61w8fl><|rz_}61-)KDKck@ksi0dGbZlgB{pkvNv4Va_LI0|tdvprsH%vj#R?zhd`UwTS zM?rt8ppBh_>nl>wP6fSBK__(yF26`Y->0BoP|&emgUi<`=vNi=aRrTQGC}sMSJ2rC zdX0j9MnS)+pnp=((QwW3@iJCHPgBshDd+|T?NiWA3i^Y!)3i?h3 z{eXggR6#$jpkEZ}K>a@|($6YrEoMe!4#*QJ(t-JMv`7c|tx)8DNI`$1pnp}+F|on* zRV(P*6!aPe{g{G&T|s}QppPl&-xahF7c5VtNMlwJpLj)jhJr2^Y0Q%1bC-gCSV8Yp z(C;hgBO;AiU3^X|=&+t#-avY9k;W=Re6AJgK!0W{Xe*};n03VG9tFKaq%kXq&p$*O zUR`|7h%~&e_zcE^PQwiFqT-V+((sDnQz6m;`|*f0yq@?xE7I^v;QbeR+EV_4iQFxIRh#B9NY= zpy!Ho!2T8}=;aD}lY)L;L4Tm2k16Q$3c6Q6E?=PjR0Ta*LE9Acy$X7dg8p1VpHR?| z*#F4=X>SF6wSp!^l5vm$VX4f>ut|6tpfm_+V9{Wq0YXNN;m5#&4Fn7ZTm={gxEe4V zFanSWNCG4SQUIxdv4AwdIKX(o^?(Tg10VyC3CIHE044)w0`dT}046{Ipb#(za0B2* zz)gTZ07?L*04tyjP!3oCr~p&~ssMICHDDpY0dN9bfMtMN0k;8Y@3#`L3UCMDUcfql z2e2Nn0dODSS-^9E=K;k+5cp2~t;8g(q{~`LHLrs9)fHwed0`>sj z0=x~_3wQ_cF5o@D`+yGs9|ArC>;vov8~_M_i}f3l-2T2JN9garD1^HMdH|vUF#t?Q z3@)DcD_k9edtn%o3}($>TD-3Z08@X*0|o&G1E}AJ0{nfSfUv*+uR-`)z(_zMAPJBR zP})K|;>aGZ1ITS+B4`7^2*?2VZ6h1uNq~-QBp>l6KmlMjpd(wk8S!Ks?9~`Lnt6l$7_p7D1I{r6kSMnk#=uTHh z1%fYTC5~0EWGgSA{V%_geZ_C+{DyF4Z{jX`(VK38ckr4{y#OBkQGj&KTDmSCe0@}r z#@}}Pdq+xBFMtOWqFw;UC5->_1@K_^pkA5Cy~u5ofVuH|?U%YyAu>?!)zdZU|GVzh z(`TT;0i3DJ!xis zX100SOk);qjPhHY^tUV8|0s$7>j87e8Tt2+_#+pW$(CD*%l((gljZ-;LA*zLVO{jO zL>BIr^3Sj?#mI&aj$I|VO@7h#O|n&3^Bnd?_)7zhOJxiEU6xB^qHE;zF~-Hjo@v5I z-#WSWJ~J6ubsTP~4lcJ5T0>r&}eHo8eqH|KLp@f8LC^AeZpwz+xug8!lo zv!kf;BasVZ)XzrvfNlTSMEz_8pBG)xXCtNfAVqPNTrx)WgOW>rP=dc$;}|!3bV_Ps za!T?TdY9^d&V1Rq32*E-f)179=vBLb8y$500CA!83OO7<33M?8_&t=N^gEakLJ@d0 z^tyX40QqnQKy!C+?mt;uxr-BY38`Pb$!42v~c+!lS;S#;(q$)RX<#^FcP2J5I=8C z&5NH5d-Jo0#_t>O){e51Tlb%s@X6ei#cM+&3kTlo{N!X(tvPh!kEW?VNBoW5G~&9b zf1lj>%++6>8r|>hFMc(C{$1>ZuZBJ{Z^W)We-EGXWXv6j+3yFc|UZ|#(^{O?`28a90M*WV89ZTPe0@OO7FI&sY_tA`ryoW91j ze(cNVGsh-R{^)_OIOCPl%YIM|{hJ9tnH~reJY}NR2Yk!=(q1(e>KR5ohn){C&Zt(3&-U%AsrCNqq8^;V)TM|J3%UPWgRKK7DG0&KI%BUG&B2 zga+TFf9{&m5*qXVx_kEQ*_QXv+QN`8Z(a3FxZ|PIFHc-D_=bn0bEmxg+Q!bS7Eb-5 zV8xjGd;BT0ZrXG6yPNKv&yE)t-81pWgL}QLmy`d$n;tRd(POy_%kOw<$L+!=NfYsT z@0tnI8t$*?^w-YcXdj%C|KH_*x$^IJZ`w9J{g=YXZ9_(#%YE z_1C%^I$f^(e>c6T>mOcx=e4yT?7Tm|XIhUZAM2j@>!}mvF<&}9-*E2G^*_D-?Z@Gb z70K7t|Lgvut=hZ44ZG%+?;c5L==@^zCy&3pxcHXn??ybdwdbp$efDLJa_ij*f(r1KN+jtO-DI zVF0))HsnfNilKI(x?8_`&5aS2bpX#fuk@f`_fJ zl8}_qIT}k~G{aR#e=%ev3XCdsl@3NVBKIJ15Q{&X=9&;0F@AxyZUQl)ze9(Q*hgX! zEv+TTkES$a5x)VTM%z@?(%t&UMHtEKXaDpWGVieaS7;#@G2 zK3!cL5Y*+Uv5rRDMvILbKbkjvLL@rIf&O`{dc`I|quI7%y?%1%xQ-j$dDMT_OnqYK zAy?3}&XMhG_0gTX1~)*XX*=^}Cs(KDVl5RN^rGRTSANy1y8iNq?_uo@6KS_}H2L zG?l9^F-{*t`Lxkp#C-X7yDL7^s2|X?%NV_WOk#RsT4GZ2*c*FxNdk!|{@kdqNzBq` z@RFUc6HCsqJ1R;S!vg(-)9Q%Fcg)-{o$(i|UusFG&O%O7pe3Eo}!IrPNZy}O-XZJo5g_|NMb*AEUGo*%s9q1tojwc*o=!iI;)aCu(#N@DuGweHX;>6-{^WwYM;ZQlI%oQF-7Wg8Fx@p_ zn$Xa2jV2^bpQ=yx(|XOS1j&8bOR!M11pF6~`lOLO!U6LsvFJxpH3LJg)(_PW*)nL$ zz*YUFq9u+BSxL%03Q_w0l)r08Tu4mB`KH))tc2p%D@2@QMN8h!Ls^NPh;LQckO=D(!Je^=~1_tv_1oY5aY^uRt} zx4Z9t@3`ipiUh+=f17=kvE}SXyLSvZ_Qems*xz;cU;M@%OYYFJXS%(cKJ@8>N0z*w zl+dN?s7K})oM*nhd286L;m42svGYvJ7h~eqEZ&#(?jIc5#7PfseZbJ?%*p116V8lY zJMZC*dkSv&>A>WZ;eX04x}o>q{@Jj#X-~&zaG`=IW|fTMyj)>+&}$Iz^;@Rr>WCW3@58KmKlhgU|c<`BR&9 zWov%A=0#u6-1=uedheBEAANVM>S)+eQs7fI2N(Wgt~{}NAjIhXOZ#~U%w^Z9_ByzfJg-%@w` z$nR4hoilCr4{Lhg`DN?Wir>PY9IO|P_L|U=7jba8v2j!D{&(j+c-4aL`yPAw>%Jr2 z9C+VDOFBQEv*xD1$Bj*TZ%?=BAI8}Bzth|C+aJ1qyxjc2iJ{t;X5Tyg4_$sKO&Jn9 zHTH)7&o`Vt_25Gv<-N3fZeH2Fy6y3&-+SuXczgBEi5mUd7cxKU_UG$=y(TxI&))MN z?%37!AGh>7^xpM5#yx$qTUWNe)3bx(M!7y7-{te-xF;W5xIV`;d-pS=jnB9Iex&+? zZy%eMecQlk3-aza-nqwB+$pNwct_G*E1uQQ{o%%tF>A}8zqkLFR%ct;E!J0ZKV9^2 zQjGPH#SQO_6kWzj%@R1#MHdXUZZ!0`6A9I8F#=^nwL|}LSqHOHL$g)?_>h$v9cl~# zFll-#DGk-=SDes~@cSG=6ZikLbEZK}Wmz022@(=Q2Q1jq{^f{H^RE-10V zy}?nyB%q-~fQMp~HH@twE}-aWG|i%-LeB^;=s17~vbKr{RzTXOX>Gd1l^r+cJ|rxy zH8s^=y1MFqNb22}d)`g`QulxU=cekIIaT1YZLr zOwf4(!5eFU<}YFdbe@rcfKV|a(zZXw@Sv@j#BSU|VR8_QF9v3gtPd<25*C3s7Xx1p zJQMUY1bz*3_|4WFlCQtbIVQBfBZzg?g7->`L4<_1J9#K}bW^Oe^EQ z%)A3wLO{jT^%QnmLH|O}R{<_+lb!|4U?iC@`^Y0 zIiK9v{PsCutIpGH&VYh}oQTVzNy4c?n<Q874jd$rtFV+{M@&RU|)elX{1&sGKTXu2MWx+a2_@5uBtf zoxdzD5v`>~9G95+b^9ifH&hh-`tm64aeG{4T4K?Hm~4)9pz$vg_{kfK3+5I4G%S%s z7gR}fLTMwCNJPgws?VC2Fs(oVMa+gtZU&BaU6v%|8tRb7vjNxv;ye0zLyB*&wZMtvv&lzM|h zR&?x5n)arazaasy;D!XAsXmz#|9$$5_H=uF#f7tvwgu<}SK4Zl7uQ@_eVXy|L(6xI zgzbG{_DX|OHs<;%=O3tR^20Bme>OF1XIsB)(cv!XLuUDs-VH0LXYHrmbnJUS_~MZF z&X84ZGD=p?t8-{tC+ktL2>At^_%lqxkWD-+2Zt~U7vifhIP9CKn26Vca9|5 zb^i~upLM5BG5puvy{A*>1?#$Fr2$pE=O5_)w*GVf{eNk4c?zMK7Q3OXx+6Vk;5&(xLB>h1GPBi*lVi{AdXDA5`K)|*2H-*G8 z7#WZW=(LdmWdeu(F&S_*9y9M?cl&%+N&|Z0zm!nXhrb*%EBK+rBtOhnbbk z^h@kI`ec%IHRb0))O9#OB&HBKY#2uQL3CBM?Ojm!gujYdi(qC8F@n3P+aI-CZV^%NOAD*uxWD*~77) zoGOjATwq56P&(mOr`(R|Eh@b3(V{MDtMJ=1ce2~!N21l!cDCwt_*m>uAU7sSEFai= zR{1{N+Mxb&*CoAxAd*VGtmBo&y1FUlK<`o?y0=B`p!KYBv(?lmN&SivS?5D~`pO^c zVsflp2Rvr?)_9Q|MP_afBn-V=PKHt8cK$z3eAjH{dn-n8E~m7kcEj49inu3t<;{Ap z-w??0Y0~N)9eO+5Qg3VvZki{($v`^e%AJ1ktdH&WUh%Mdp~LhZETgS%dj1FEb=s** zf)c^^MOJaPF;7muYdik>w!`7R;F5q{mHwGC2a;58_Wi6<49w4*v98AC@-n7DJSr{I z Void) { + + // Step 1: Use a hardcoded RSA private key (in DER format) + let privateKeyBytes: [UInt8] = [ + 0x30, 0x82, 0x02, 0x5b, 0x02, 0x01, 0x00, 0x02, 0x81, 0x81, 0x00, 0xbd, 0xf6, 0x89, 0x8f, 0xbd, + 0x0c, 0xe6, 0x4f, 0x9a, 0x97, 0xec, 0x30, 0x1a, 0x48, 0x93, 0x4d, 0x2a, 0xbf, 0xdf, 0xf7, 0x08, + 0x15, 0x4c, 0xdb, 0x87, 0xe5, 0xdf, 0xb1, 0xcf, 0x8d, 0xa2, 0x5e, 0x2a, 0x7d, 0x92, 0xa8, 0xbd, + 0x30, 0xb9, 0x10, 0xcf, 0x96, 0xda, 0x10, 0x25, 0xd4, 0x67, 0xaf, 0x92, 0x26, 0xfa, 0x43, 0xb7, + 0x86, 0x83, 0xa2, 0x68, 0xd4, 0x7a, 0x56, 0xce, 0x41, 0x41, 0xed, 0xc0, 0x10, 0x0c, 0x89, 0xa5, + 0x4e, 0x5f, 0xc4, 0x59, 0xcc, 0x55, 0x09, 0x1f, 0xa1, 0x1f, 0x1f, 0xb7, 0x97, 0x1d, 0x53, 0x1b, + 0x73, 0x38, 0x4c, 0x3e, 0xe8, 0x28, 0x1d, 0xc1, 0x68, 0x6a, 0x8d, 0x3e, 0xb0, 0xf2, 0x0a, 0xb3, + 0x74, 0x26, 0xd2, 0xdc, 0xcf, 0xa4, 0xac, 0xf3, 0x5b, 0x26, 0x35, 0xd1, 0x2d, 0xee, 0x91, 0x41, + 0xa6, 0x93, 0xed, 0x91, 0xfa, 0xd7, 0x43, 0x83, 0x85, 0x53, 0xe5, 0x02, 0x03, 0x01, 0x00, 0x01, + 0x02, 0x81, 0x80, 0x01, 0xed, 0xbf, 0x79, 0xcd, 0xee, 0x94, 0x32, 0x73, 0x1c, 0x5f, 0x5e, 0x88, + 0x0f, 0x62, 0x94, 0x48, 0x98, 0x3b, 0x54, 0x80, 0x8f, 0x1b, 0x9a, 0xdc, 0x9a, 0x91, 0x16, 0xaa, + 0x14, 0x9c, 0xa8, 0x6a, 0xe6, 0x6c, 0xb0, 0xf9, 0x7f, 0x92, 0x8b, 0x0d, 0xc0, 0x84, 0x25, 0x13, + 0xd3, 0xa6, 0x75, 0xda, 0x16, 0x3a, 0xd3, 0x0f, 0xfc, 0x8f, 0x71, 0xfc, 0x7e, 0x16, 0xfb, 0xe5, + 0x71, 0x67, 0xc6, 0x8a, 0x4b, 0xfb, 0x12, 0x13, 0x68, 0x45, 0xd6, 0x17, 0xbd, 0xd2, 0x83, 0x69, + 0x17, 0xc8, 0x44, 0x84, 0xb0, 0x25, 0xe4, 0x49, 0x9e, 0x51, 0x95, 0x05, 0x79, 0xe6, 0x86, 0x4a, + 0xf6, 0xc4, 0x5e, 0x70, 0x52, 0x18, 0xf0, 0x46, 0x63, 0x42, 0x32, 0x1b, 0x07, 0x52, 0x83, 0xee, + 0xd0, 0xbc, 0x0b, 0x6e, 0x12, 0xed, 0x27, 0xbb, 0x03, 0x31, 0xbb, 0xa5, 0x24, 0xc7, 0x2e, 0x3b, + 0xd6, 0xe9, 0x25, 0x02, 0x41, 0x00, 0xcb, 0x78, 0x2f, 0x7f, 0x51, 0x2f, 0x49, 0xf0, 0xf8, 0xdb, + 0x2f, 0xc3, 0x18, 0xc8, 0x41, 0x62, 0x41, 0x69, 0x4c, 0xc0, 0x78, 0x98, 0x6c, 0xce, 0xdb, 0x86, + 0x1e, 0x04, 0x99, 0x11, 0x6c, 0x3d, 0x98, 0x8c, 0xa1, 0xcf, 0xb7, 0x48, 0xa2, 0x8b, 0x53, 0x28, + 0x31, 0xfd, 0x15, 0x5f, 0x56, 0xc0, 0xc4, 0xc1, 0xe6, 0x25, 0x8b, 0x69, 0x83, 0xe8, 0x59, 0xd2, + 0x2b, 0x3e, 0xe7, 0xc9, 0xbb, 0xfb, 0x02, 0x41, 0x00, 0xef, 0x01, 0xad, 0x4f, 0xdb, 0xa4, 0xb9, + 0x59, 0x81, 0x23, 0x5e, 0xd1, 0x10, 0xee, 0x0a, 0xa3, 0x51, 0x24, 0x6f, 0x60, 0x45, 0x5c, 0xd5, + 0x70, 0x5c, 0xa4, 0x4a, 0x32, 0x70, 0x56, 0xa2, 0x6f, 0x64, 0xaf, 0x68, 0xc9, 0x70, 0xd8, 0x93, + 0x38, 0x86, 0x1a, 0x94, 0xc0, 0xbe, 0xb7, 0xb0, 0x9d, 0x8d, 0xb5, 0x59, 0xf6, 0x3a, 0x3a, 0xed, + 0xd7, 0x54, 0x77, 0x57, 0x10, 0x9a, 0xad, 0x49, 0x9f, 0x02, 0x40, 0x6c, 0xf3, 0x95, 0x53, 0x72, + 0x90, 0x84, 0xe2, 0x81, 0x0f, 0x35, 0x7b, 0x1d, 0xc9, 0x15, 0xa1, 0xdc, 0x6e, 0xdb, 0x47, 0x71, + 0x0c, 0x05, 0xaf, 0x9a, 0xc3, 0x2d, 0x4d, 0xbe, 0xfd, 0x22, 0x5d, 0xb5, 0x53, 0x10, 0xce, 0x5e, + 0x51, 0x89, 0xa0, 0x5b, 0x4d, 0xf9, 0xbe, 0x90, 0x74, 0x35, 0xcb, 0x11, 0x50, 0xd6, 0xc1, 0x21, + 0xee, 0xc5, 0x50, 0x64, 0xd0, 0x72, 0x91, 0xc3, 0xa2, 0x35, 0x83, 0x02, 0x40, 0x62, 0xee, 0xd6, + 0xc6, 0xcf, 0xac, 0x87, 0xec, 0xbc, 0xbf, 0xdf, 0x67, 0xbb, 0x12, 0x4d, 0xe4, 0xfc, 0x99, 0x90, + 0x60, 0xd1, 0x55, 0x74, 0x24, 0x66, 0xb4, 0xba, 0xe1, 0xd6, 0x0e, 0x86, 0x7e, 0x85, 0xb6, 0xf6, + 0x31, 0x2c, 0x3c, 0xf9, 0xf3, 0xd3, 0xce, 0xfc, 0xf4, 0x2b, 0xfd, 0xed, 0x65, 0xca, 0x5a, 0xdf, + 0x3a, 0x45, 0x30, 0x4f, 0x73, 0x6a, 0xcb, 0x5b, 0x86, 0xcc, 0x00, 0x1f, 0x11, 0x02, 0x40, 0x5e, + 0x6b, 0xae, 0x7c, 0x7d, 0xfc, 0x8a, 0xf5, 0x97, 0xa9, 0x39, 0x37, 0x27, 0x4e, 0xd9, 0xe8, 0xd0, + 0x8d, 0xa9, 0x32, 0xe4, 0x6b, 0xde, 0x76, 0x0f, 0xee, 0xf1, 0x22, 0x11, 0xc4, 0x1e, 0x4a, 0x01, + 0x73, 0xc4, 0x34, 0x8c, 0x4d, 0x16, 0xf1, 0x2f, 0x5f, 0xe4, 0xe5, 0x41, 0x3a, 0x3b, 0xf1, 0xb1, + 0x78, 0x7c, 0x0e, 0x55, 0xf9, 0xf7, 0xcf, 0x64, 0x93, 0xad, 0x77, 0xfd, 0x31, 0x52, 0x87 + ] + let privateKeyData = Data(privateKeyBytes) + + let keyAttributes: [String: Any] = [ + kSecAttrKeyType as String: kSecAttrKeyTypeRSA, + kSecAttrKeyClass as String: kSecAttrKeyClassPrivate, + kSecAttrKeySizeInBits as String: 1024, + kSecReturnPersistentRef as String: true + ] + + var error: Unmanaged? + guard let privateKey = SecKeyCreateWithData(privateKeyData as CFData, keyAttributes as CFDictionary, &error) else { + completion("Failed to create private key: \(String(describing: error))") + return + } + + guard let publicKey = SecKeyCopyPublicKey(privateKey) else { + completion("Failed to generate public key") + return + } + + // Convert the public key to data (DER format) + guard let publicKeyData = SecKeyCopyExternalRepresentation(publicKey, &error) as Data? else { + completion("Failed to extract public key: \(String(describing: error))") + return + } + + // Encode the public key for display + let publicKeyHex = publicKeyData.map { String(format: "%02hhx", $0) }.joined() + + // Data to sign + let dataToSign = "This is a sample text".data(using: .utf8)! + + // Step 2: Sign the data with the hardcoded private key + guard let signature = SecKeyCreateSignature( + privateKey, + SecKeyAlgorithm.rsaSignatureMessagePKCS1v15SHA256, + dataToSign as CFData, + &error + ) else { + completion("Signing failed: \(String(describing: error))") + return + } + + // Convert signature to hex string for display + let signatureHex = (signature as Data).map { String(format: "%02hhx", $0) }.joined() + + // Step 3: Verify the signature with the public key + let verificationStatus = SecKeyVerifySignature( + publicKey, + SecKeyAlgorithm.rsaSignatureMessagePKCS1v15SHA256, + dataToSign as CFData, + signature as CFData, + &error + ) + + let verificationResult = verificationStatus ? "Signature is valid." : "Signature is invalid." + + let value = """ + Original: \(String(data: dataToSign, encoding: .utf8)!) + + Public Key (Hex): \(publicKeyHex) + + Signature (Hex): \(signatureHex) + + Verification: \(verificationResult) + """ + + completion(value) + } +} diff --git a/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/function.asm b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/function.asm new file mode 100644 index 0000000000..0fb82e978e --- /dev/null +++ b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/function.asm @@ -0,0 +1,663 @@ + ; CALL XREF from sym.func.1000063c8 @ 0x100006400(x) +┌ 2444: sym.func.10000491c (int64_t arg1, int64_t arg2, void *arg3); +│ ; arg int64_t arg1 @ x0 +│ ; arg int64_t arg2 @ x1 +│ ; arg void *arg3 @ x2 +│ ; var int64_t var_0h @ sp+0x0 +│ ; var int64_t var_0h_12 @ sp+0x8 +│ ; var int64_t var_10h @ sp+0x10 +│ ; var void *var_0h_13 @ sp+0x18 +│ ; var int64_t var_20h @ sp+0x20 +│ ; var int64_t var_28h @ sp+0x28 +│ ; var int64_t var_30h @ sp+0x30 +│ ; var void *var_0h_11 @ sp+0x38 +│ ; var int64_t var_40h @ sp+0x40 +│ ; var int64_t var_48h @ sp+0x48 +│ ; var int64_t var_50h_2 @ sp+0x50 +│ ; var int64_t var_0h_4 @ sp+0x58 +│ ; var int64_t var_60h_3 @ sp+0x60 +│ ; var void *var_60h_4 @ sp+0x68 +│ ; var void *var_0h_2 @ sp+0x70 +│ ; var int64_t var_0h_9 @ sp+0x80 +│ ; var int64_t var_80h_2 @ sp+0x88 +│ ; var int64_t var_0h_8 @ sp+0x90 +│ ; var void *var_98h @ sp+0x98 +│ ; var void *var_0h_7 @ sp+0x178 +│ ; var void *arg0 @ sp+0x180 +│ ; var int64_t var_0h_10 @ sp+0x188 +│ ; var int64_t var_0h_5 @ sp+0x190 +│ ; var int64_t var_0h_6 @ sp+0x198 +│ ; var int64_t var_0h_3 @ sp+0x1a0 +│ ; var int64_t var_60h @ sp+0x1b0 +│ ; var int64_t var_60h_2 @ sp+0x1b8 +│ ; var int64_t var_10h_2 @ sp+0x1c0 +│ ; var int64_t var_10h_3 @ sp+0x1c8 +│ ; var int64_t var_20h_2 @ sp+0x1d0 +│ ; var int64_t var_20h_3 @ sp+0x1d8 +│ ; var int64_t var_30h_2 @ sp+0x1e0 +│ ; var int64_t var_30h_3 @ sp+0x1e8 +│ ; var int64_t var_40h_2 @ sp+0x1f0 +│ ; var int64_t var_40h_3 @ sp+0x1f8 +│ ; var int64_t var_50h @ sp+0x200 +│ ; var int64_t var_50h_3 @ sp+0x208 +│ 0x10000491c stp x28, x27, [sp, -0x60]! +│ 0x100004920 stp x26, x25, [var_10h] +│ 0x100004924 stp x24, x23, [var_20h] +│ 0x100004928 stp x22, x21, [var_30h] +│ 0x10000492c stp x20, x19, [var_40h] +│ 0x100004930 stp x29, x30, [var_50h_2] +│ 0x100004934 add x29, sp, 0x50 +│ 0x100004938 sub sp, sp, 0x1b0 +│ 0x10000493c mov x19, sp +│ 0x100004940 str x2, [x19, 0x70] ; arg3 +│ 0x100004944 mov x24, x1 ; arg2 +│ 0x100004948 mov x26, x0 ; arg1 +│ 0x10000494c adrp x8, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004950 ldr x8, reloc.__stack_chk_guard ; 0x10000c408 +│ 0x100004954 ldr x8, [x8] +│ 0x100004958 stur x8, [x29, -0x60] +│ 0x10000495c mov x0, 0 +│ 0x100004960 bl sym Foundation...8EncodingVMa ; sym.imp.Foundation...8EncodingVMa +│ 0x100004964 ldur x8, [x0, -8] +│ 0x100004968 stp x8, x0, [x19, 0x48] +│ 0x10000496c ldr x8, [x8, 0x40] +│ 0x100004970 mov x9, x8 +│ 0x100004974 adrp x16, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004978 ldr x16, reloc.__chkstk_darwin ; 0x10000c3f8 +│ 0x10000497c blr x16 +│ 0x100004980 mov x9, sp +│ 0x100004984 add x8, x8, 0xf +│ 0x100004988 and x8, x8, 0xfffffffffffffff0 +│ 0x10000498c sub x8, x9, x8 +│ 0x100004990 str x8, [x19, 0x58] +│ 0x100004994 mov sp, x8 +│ 0x100004998 adrp x0, segment.__DATA ; 0x100010000 +│ 0x10000499c add x0, x0, 0x328 ; int64_t arg1 +│ 0x1000049a0 bl sym.func.1000052a8 +│ 0x1000049a4 adrp x1, segment.__DATA ; 0x100010000 +│ 0x1000049a8 add x1, x1, 0xa8 +│ 0x1000049ac bl sym.imp.swift_initStaticObject +│ 0x1000049b0 mov x20, x0 +│ 0x1000049b4 adrp x21, segment.__DATA ; 0x100010000 +│ 0x1000049b8 add x21, x21, 0x330 +│ 0x1000049bc mov x0, x21 ; int64_t arg1 +│ 0x1000049c0 bl sym.func.1000052a8 +│ 0x1000049c4 mov x22, x0 +│ 0x1000049c8 stur x0, [x29, -0x70] +│ 0x1000049cc adrp x0, segment.__DATA ; 0x100010000 +│ 0x1000049d0 add x0, x0, 0x338 ; int64_t arg1 +│ 0x1000049d4 adrp x2, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x1000049d8 ldr x2, reloc.Foundation.ContiguousBytes.UInt8...szlMc ; 0x10000c338 ; int64_t arg3 +│ 0x1000049dc mov x1, x21 ; int64_t arg2 +│ 0x1000049e0 bl sym.func.1000053c8 +│ 0x1000049e4 stur x0, [x29, -0x68] +│ 0x1000049e8 stur x20, [x29, -0x88] +│ 0x1000049ec sub x0, x29, 0x88 ; int64_t arg1 +│ 0x1000049f0 mov x1, x22 ; int64_t arg2 +│ 0x1000049f4 bl sym.func.10000532c +│ 0x1000049f8 ldr x8, [x0] +│ 0x1000049fc add x0, x8, 0x20 ; int64_t arg1 +│ 0x100004a00 ldr x8, [x8, 0x10] +│ 0x100004a04 add x1, x0, x8 ; int64_t arg2 +│ 0x100004a08 bl sym.func.1000047b8 +│ 0x100004a0c mov x25, x0 +│ 0x100004a10 mov x28, x1 +│ 0x100004a14 sub x0, x29, 0x88 ; int64_t arg1 +│ 0x100004a18 bl sym.func.100005350 +│ 0x100004a1c adrp x0, segment.__DATA ; 0x100010000 +│ 0x100004a20 add x0, x0, 0x340 ; int64_t arg1 +│ 0x100004a24 bl sym.func.1000052a8 +│ 0x100004a28 add x1, x19, 0x98 ; void *arg1 +│ 0x100004a2c bl sym.imp.swift_initStackObject ; void *swift_initStackObject(void *arg0, void *arg1) +│ 0x100004a30 mov x20, x0 +│ 0x100004a34 adrp x8, 0x100007000 +│ 0x100004a38 ldr q0, [x8, 0xad0] +│ 0x100004a3c str q0, [x0, 0x10] +│ 0x100004a40 adrp x8, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004a44 ldr x8, reloc.kSecAttrKeyType ; 0x10000c438 +│ 0x100004a48 ldr x0, [x8] +│ 0x100004a4c bl sym Foundation...nconditionallyBridgeFromObjectiveCySSSo8NSStringCSgFZ ; sym.imp.Foundation...nconditionallyBridgeFromObjectiveCySSSo8NSStringCSgFZ +│ 0x100004a50 mov x21, x20 +│ 0x100004a54 str x0, [x21, 0x20]! +│ 0x100004a58 str x1, [x20, 0x28] +│ 0x100004a5c adrp x8, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004a60 ldr x8, reloc.kSecAttrKeyTypeRSA ; 0x10000c440 +│ 0x100004a64 ldr x23, [x8] +│ 0x100004a68 mov x0, 0 +│ 0x100004a6c bl sym.func.100005370 +│ 0x100004a70 mov x22, x0 +│ 0x100004a74 str x0, [x20, 0x48] +│ 0x100004a78 str x23, [x20, 0x30] +│ 0x100004a7c adrp x8, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004a80 ldr x8, reloc.kSecAttrKeyClass ; 0x10000c420 +│ 0x100004a84 ldr x0, [x8] +│ 0x100004a88 bl sym Foundation...nconditionallyBridgeFromObjectiveCySSSo8NSStringCSgFZ ; sym.imp.Foundation...nconditionallyBridgeFromObjectiveCySSSo8NSStringCSgFZ +│ 0x100004a8c stp x0, x1, [x20, 0x50] +│ 0x100004a90 adrp x8, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004a94 ldr x8, reloc.kSecAttrKeyClassPrivate ; 0x10000c428 +│ 0x100004a98 ldr x27, [x8] +│ 0x100004a9c str x22, [x20, 0x78] +│ 0x100004aa0 mov x22, x28 +│ 0x100004aa4 str x27, [x20, 0x60] +│ 0x100004aa8 adrp x8, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004aac ldr x8, reloc.kSecAttrKeySizeInBits ; 0x10000c430 +│ 0x100004ab0 ldr x0, [x8] +│ 0x100004ab4 bl sym Foundation...nconditionallyBridgeFromObjectiveCySSSo8NSStringCSgFZ ; sym.imp.Foundation...nconditionallyBridgeFromObjectiveCySSSo8NSStringCSgFZ +│ 0x100004ab8 stp x0, x1, [x20, 0x80] +│ 0x100004abc adrp x8, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004ac0 ldr x8, reloc....SiN ; 0x10000c350 +│ 0x100004ac4 str x8, [x20, 0xa8] +│ 0x100004ac8 mov w8, 0x400 +│ 0x100004acc str x8, [x20, 0x90] +│ 0x100004ad0 adrp x8, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004ad4 ldr x8, reloc.kSecReturnPersistentRef ; 0x10000c450 +│ 0x100004ad8 ldr x0, [x8] +│ 0x100004adc bl sym Foundation...nconditionallyBridgeFromObjectiveCySSSo8NSStringCSgFZ ; sym.imp.Foundation...nconditionallyBridgeFromObjectiveCySSSo8NSStringCSgFZ +│ 0x100004ae0 stp x0, x1, [x20, 0xb0] +│ 0x100004ae4 adrp x8, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004ae8 ldr x8, reloc....SbN ; 0x10000c348 +│ 0x100004aec str x8, [x20, 0xd8] +│ 0x100004af0 mov w8, 1 +│ 0x100004af4 strb w8, [x20, 0xc0] +│ 0x100004af8 bl sym.imp.objc_retain_x23 +│ 0x100004afc mov x23, x25 +│ 0x100004b00 bl sym.imp.objc_retain_x27 +│ 0x100004b04 mov x0, x20 ; int64_t arg1 +│ 0x100004b08 bl sym.func.100004820 +│ 0x100004b0c mov x25, x0 +│ 0x100004b10 mov x0, x20 +│ 0x100004b14 bl sym.imp.swift_setDeallocating +│ 0x100004b18 adrp x0, segment.__DATA ; 0x100010000 +│ 0x100004b1c add x0, x0, 0x348 ; int64_t arg1 +│ 0x100004b20 bl sym.func.1000052a8 +│ 0x100004b24 mov x2, x0 +│ 0x100004b28 mov x0, x21 +│ 0x100004b2c mov w1, 4 +│ 0x100004b30 bl sym.imp.swift_arrayDestroy +│ 0x100004b34 str xzr, [x19, 0x90] +│ 0x100004b38 mov x0, x23 +│ 0x100004b3c mov x1, x28 +│ 0x100004b40 bl sym Foundation.Data._bridgeToObjectiveC.NSData...F ; sym.imp.Foundation.Data._bridgeToObjectiveC.NSData...F +│ 0x100004b44 mov x20, x0 +│ 0x100004b48 adrp x8, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004b4c ldr x8, reloc....ypN ; 0x10000c3c8 +│ 0x100004b50 add x2, x8, 8 +│ 0x100004b54 adrp x1, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004b58 ldr x1, reloc....SSN ; 0x10000c320 +│ 0x100004b5c adrp x3, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004b60 ldr x3, [x3, 0x328] +│ 0x100004b64 mov x0, x25 +│ 0x100004b68 bl sym Foundationbool...ridgeToObjectiveCSo12NSDictionaryCyF ; sym.imp.Foundationbool...ridgeToObjectiveCSo12NSDictionaryCyF +│ 0x100004b6c mov x21, x0 +│ 0x100004b70 add x2, x19, 0x90 +│ 0x100004b74 mov x0, x20 +│ 0x100004b78 mov x1, x21 +│ 0x100004b7c bl sym.imp.SecKeyCreateWithData +│ 0x100004b80 mov x28, x0 +│ 0x100004b84 bl sym.imp.objc_release_x20 +│ 0x100004b88 bl sym.imp.objc_release_x21 +│ ┌─< 0x100004b8c cbz x28, 0x100004f68 +│ │ 0x100004b90 stp x26, x24, [x19, 0x60] +│ │ 0x100004b94 mov x0, x28 +│ │ 0x100004b98 bl sym.imp.SecKeyCopyPublicKey +│ ┌──< 0x100004b9c cbz x0, 0x100005028 +│ ││ 0x100004ba0 str x25, [x19, 0x38] +│ ││ 0x100004ba4 mov x21, 0x10 +│ ││ 0x100004ba8 movk x21, 0xd000, lsl 48 +│ ││ 0x100004bac add x1, x19, 0x90 +│ ││ 0x100004bb0 mov x26, x0 +│ ││ 0x100004bb4 bl sym.imp.SecKeyCopyExternalRepresentation +│ ││ 0x100004bb8 ldp x24, x25, [x19, 0x68] +│ ││ 0x100004bbc ldr x27, [x19, 0x60] +│ ┌───< 0x100004bc0 cbz x0, 0x100005098 +│ │││ 0x100004bc4 mov x20, x0 +│ │││ 0x100004bc8 stp x22, x26, [x19, 0x28] +│ │││ 0x100004bcc str x23, [x19, 0x20] +│ │││ 0x100004bd0 bl sym Foundation.Data._unconditionallyBridgeFromObjectiveC.NSData...gFZ ; sym.imp.Foundation.Data._unconditionallyBridgeFromObjectiveC.NSData...gFZ +│ │││ 0x100004bd4 mov x26, x0 +│ │││ 0x100004bd8 mov x24, x1 +│ │││ 0x100004bdc bl sym.imp.objc_release_x20 +│ │││ 0x100004be0 mov x0, x26 ; int64_t arg1 +│ │││ 0x100004be4 mov x1, x24 ; int64_t arg2 +│ │││ 0x100004be8 mov x25, 0x10 +│ │││ 0x100004bec movk x25, 0xd000, lsl 48 +│ │││ 0x100004bf0 mov x21, 0 +│ │││ 0x100004bf4 bl sym.func.100004000 +│ │││ 0x100004bf8 mov x23, x0 +│ │││ 0x100004bfc stur x0, [x29, -0x88] +│ │││ 0x100004c00 adrp x20, segment.__DATA ; 0x100010000 +│ │││ 0x100004c04 add x20, x20, 0x360 +│ │││ 0x100004c08 mov x0, x20 ; int64_t arg1 +│ │││ 0x100004c0c bl sym.func.1000052a8 +│ │││ 0x100004c10 mov x27, x0 +│ │││ 0x100004c14 adrp x0, segment.__DATA ; 0x100010000 +│ │││ 0x100004c18 add x0, x0, 0x368 ; int64_t arg1 +│ │││ 0x100004c1c adrp x2, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ │││ 0x100004c20 ldr x2, reloc....SayxGSKsMc ; 0x10000c340 ; int64_t arg3 +│ │││ 0x100004c24 mov x1, x20 ; int64_t arg2 +│ │││ 0x100004c28 bl sym.func.1000053c8 +│ │││ 0x100004c2c mov x22, x0 +│ │││ 0x100004c30 sub x20, x29, 0x88 +│ │││ 0x100004c34 mov x0, 0 +│ │││ 0x100004c38 mov x1, -0x2000000000000000 +│ │││ 0x100004c3c str x27, [x19, 0x10] +│ │││ 0x100004c40 mov x2, x27 +│ │││ 0x100004c44 mov x3, x22 +│ │││ 0x100004c48 bl sym Element...F ; sym.imp.Element...F +│ │││ 0x100004c4c str x0, [x19, 8] +│ │││ 0x100004c50 str x1, [x19, 0x18] +│ │││ 0x100004c54 mov x0, x23 ; void *arg0 +│ │││ 0x100004c58 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ │││ 0x100004c5c add x8, x25, 5 +│ │││ 0x100004c60 adrp x9, 0x100008000 +│ │││ 0x100004c64 add x9, x9, 0x540 ; 0x100008540 ; "This is a sample text" +│ │││ 0x100004c68 sub x9, x9, 0x20 +│ │││ 0x100004c6c orr x9, x9, 0x8000000000000000 +│ │││ 0x100004c70 stp x8, x9, [x29, -0x88] +│ │││ 0x100004c74 ldr x23, [x19, 0x58] +│ │││ 0x100004c78 mov x8, x23 +│ │││ 0x100004c7c bl sym Foundation...8EncodingV4utf8ACvgZ ; sym.imp.Foundation...8EncodingV4utf8ACvgZ +│ │││ 0x100004c80 bl sym.func.100005408 +│ │││ 0x100004c84 mov x3, x0 +│ │││ 0x100004c88 adrp x2, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ │││ 0x100004c8c ldr x2, reloc....SSN ; 0x10000c320 +│ │││ 0x100004c90 sub x20, x29, 0x88 +│ │││ 0x100004c94 mov x0, x23 +│ │││ 0x100004c98 mov w1, 0 +│ │││ 0x100004c9c bl sym Foundation...btF ; sym.imp.Foundation...btF +│ │││ 0x100004ca0 str x0, [x19, 0x40] +│ │││ 0x100004ca4 mov x20, x1 +│ │││ 0x100004ca8 ldp x8, x1, [x19, 0x48] +│ │││ 0x100004cac ldr x8, [x8, 8] +│ │││ 0x100004cb0 mov x0, x23 +│ │││ 0x100004cb4 blr x8 +│ │││ 0x100004cb8 ldur x0, [x29, -0x80] ; void *arg0 +│ │││ 0x100004cbc bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ │││ 0x100004cc0 lsr x8, x20, 0x3c +│ │││ 0x100004cc4 cmp x8, 0xe +│ │││ 0x100004cc8 mov x25, 0x10 +│ │││ 0x100004ccc movk x25, 0xd000, lsl 48 +│ ┌────< 0x100004cd0 b.hi 0x100005280 +│ ││││ 0x100004cd4 adrp x8, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ ││││ 0x100004cd8 ldr x8, reloc.kSecKeyAlgorithmRSASignatureMessagePKCS1v15SHA256 ; 0x10000c448 +│ ││││ 0x100004cdc ldr x23, [x8] +│ ││││ 0x100004ce0 ldr x0, [x19, 0x40] +│ ││││ 0x100004ce4 str x20, [x19, 0x50] +│ ││││ 0x100004ce8 mov x1, x20 +│ ││││ 0x100004cec bl sym Foundation.Data._bridgeToObjectiveC.NSData...F ; sym.imp.Foundation.Data._bridgeToObjectiveC.NSData...F +│ ││││ 0x100004cf0 mov x20, x0 +│ ││││ 0x100004cf4 add x3, x19, 0x90 +│ ││││ 0x100004cf8 mov x0, x28 +│ ││││ 0x100004cfc mov x1, x23 +│ ││││ 0x100004d00 mov x2, x20 +│ ││││ 0x100004d04 bl sym.imp.SecKeyCreateSignature +│ ││││ 0x100004d08 mov x27, x0 +│ ││││ 0x100004d0c bl sym.imp.objc_release_x20 +│ ┌─────< 0x100004d10 cbz x27, 0x10000515c +│ │││││ 0x100004d14 str x26, [x19] +│ │││││ 0x100004d18 str x24, [x19, 0x48] +│ │││││ 0x100004d1c mov x0, x27 +│ │││││ 0x100004d20 bl sym Foundation.Data._unconditionallyBridgeFromObjectiveC.NSData...gFZ ; sym.imp.Foundation.Data._unconditionallyBridgeFromObjectiveC.NSData...gFZ +│ │││││ 0x100004d24 mov x20, x0 +│ │││││ 0x100004d28 mov x26, x1 +│ │││││ 0x100004d2c bl sym.func.100004000 +│ │││││ 0x100004d30 mov x21, x0 +│ │││││ 0x100004d34 mov x0, x20 ; void *arg0 +│ │││││ 0x100004d38 mov x1, x26 ; int64_t arg2 +│ │││││ 0x100004d3c bl sym.func.100005384 +│ │││││ 0x100004d40 stur x21, [x29, -0x88] +│ │││││ 0x100004d44 mov x24, -0x2000000000000000 +│ │││││ 0x100004d48 sub x20, x29, 0x88 +│ │││││ 0x100004d4c mov x0, 0 +│ │││││ 0x100004d50 mov x1, -0x2000000000000000 +│ │││││ 0x100004d54 ldr x2, [x19, 0x10] +│ │││││ 0x100004d58 mov x3, x22 +│ │││││ 0x100004d5c bl sym Element...F ; sym.imp.Element...F +│ │││││ 0x100004d60 str x0, [x19, 0x10] +│ │││││ 0x100004d64 mov x26, x1 +│ │││││ 0x100004d68 mov x0, x21 ; void *arg0 +│ │││││ 0x100004d6c bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ │││││ 0x100004d70 ldr x25, [x19, 0x40] +│ │││││ 0x100004d74 mov x0, x25 +│ │││││ 0x100004d78 ldr x21, [x19, 0x50] +│ │││││ 0x100004d7c mov x1, x21 +│ │││││ 0x100004d80 bl sym Foundation.Data._bridgeToObjectiveC.NSData...F ; sym.imp.Foundation.Data._bridgeToObjectiveC.NSData...F +│ │││││ 0x100004d84 mov x20, x0 +│ │││││ 0x100004d88 add x4, x19, 0x90 +│ │││││ 0x100004d8c ldr x0, [x19, 0x30] +│ │││││ 0x100004d90 mov x1, x23 +│ │││││ 0x100004d94 mov x2, x20 +│ │││││ 0x100004d98 mov x3, x27 +│ │││││ 0x100004d9c bl sym.imp.SecKeyVerifySignature +│ │││││ 0x100004da0 mov x23, x0 +│ │││││ 0x100004da4 bl sym.imp.objc_release_x20 +│ │││││ 0x100004da8 stp xzr, x24, [x29, -0x88] +│ │││││ 0x100004dac sub x20, x29, 0x88 +│ │││││ 0x100004db0 mov w0, 0x49 ; 'I' +│ │││││ 0x100004db4 bl sym _StringGuts.grow...SiF ; sym.imp._StringGuts.grow...SiF +│ │││││ 0x100004db8 ldp x8, x9, [x29, -0x88] +│ │││││ 0x100004dbc stp x8, x9, [x29, -0x88] +│ │││││ 0x100004dc0 sub x20, x29, 0x88 +│ │││││ 0x100004dc4 mov x0, 0x724f ; 'Or' +│ │││││ 0x100004dc8 movk x0, 0x6769, lsl 16 ; 'ig' +│ │││││ 0x100004dcc movk x0, 0x6e69, lsl 32 ; 'in' +│ │││││ 0x100004dd0 movk x0, 0x6c61, lsl 48 ; 'al' +│ │││││ 0x100004dd4 mov x1, 0x203a ; ': ' +│ │││││ 0x100004dd8 movk x1, 0xea00, lsl 48 +│ │││││ 0x100004ddc bl sym append...ySSF ; sym.imp.append...ySSF +│ │││││ 0x100004de0 ldr x20, [x19, 0x58] +│ │││││ 0x100004de4 mov x8, x20 +│ │││││ 0x100004de8 bl sym Foundation...8EncodingV4utf8ACvgZ ; sym.imp.Foundation...8EncodingV4utf8ACvgZ +│ │││││ 0x100004dec mov x0, x25 +│ │││││ 0x100004df0 mov x1, x21 +│ │││││ 0x100004df4 mov x2, x20 +│ │││││ 0x100004df8 bl sym Foundation__String...AAE8EncodingVtcfC ; sym.imp.Foundation__String...AAE8EncodingVtcfC +│ ┌──────< 0x100004dfc cbz x1, 0x100005294 +│ ││││││ 0x100004e00 mov x25, x1 +│ ││││││ 0x100004e04 adrp x8, 0x100008000 +│ ││││││ 0x100004e08 add x8, x8, 0x580 ; 0x100008580 ; "Signature is valid." +│ ││││││ 0x100004e0c sub x8, x8, 0x20 +│ ││││││ 0x100004e10 orr x8, x8, 0x8000000000000000 +│ ││││││ 0x100004e14 adrp x9, 0x100008000 +│ ││││││ 0x100004e18 add x9, x9, 0x600 ; 0x100008600 ; "Signature is invalid." +│ ││││││ 0x100004e1c sub x9, x9, 0x20 +│ ││││││ 0x100004e20 orr x9, x9, 0x8000000000000000 +│ ││││││ 0x100004e24 cmp w23, 0 +│ ││││││ 0x100004e28 csel x24, x9, x8, eq +│ ││││││ 0x100004e2c mov x22, 0x10 +│ ││││││ 0x100004e30 movk x22, 0xd000, lsl 48 +│ ││││││ 0x100004e34 add x21, x22, 3 +│ ││││││ 0x100004e38 add x8, x22, 5 +│ ││││││ 0x100004e3c csel x23, x8, x21, eq +│ ││││││ 0x100004e40 sub x20, x29, 0x88 +│ ││││││ 0x100004e44 bl sym append...ySSF ; sym.imp.append...ySSF +│ ││││││ 0x100004e48 mov x0, x25 ; void *arg0 +│ ││││││ 0x100004e4c bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││││││ 0x100004e50 add x0, x22, 4 +│ ││││││ 0x100004e54 adrp x8, 0x100008000 +│ ││││││ 0x100004e58 add x8, x8, 0x5a0 ; 0x1000085a0 ; "\n\nPublic Key (Hex): " +│ ││││││ 0x100004e5c sub x8, x8, 0x20 +│ ││││││ 0x100004e60 orr x1, x8, 0x8000000000000000 +│ ││││││ 0x100004e64 sub x20, x29, 0x88 +│ ││││││ 0x100004e68 bl sym append...ySSF ; sym.imp.append...ySSF +│ ││││││ 0x100004e6c sub x20, x29, 0x88 +│ ││││││ 0x100004e70 ldr x0, [x19, 8] +│ ││││││ 0x100004e74 ldr x25, [x19, 0x18] +│ ││││││ 0x100004e78 mov x1, x25 +│ ││││││ 0x100004e7c bl sym append...ySSF ; sym.imp.append...ySSF +│ ││││││ 0x100004e80 adrp x8, 0x100008000 +│ ││││││ 0x100004e84 add x8, x8, 0x5c0 ; 0x1000085c0 ; "\n\nSignature (Hex): " +│ ││││││ 0x100004e88 sub x8, x8, 0x20 +│ ││││││ 0x100004e8c orr x1, x8, 0x8000000000000000 +│ ││││││ 0x100004e90 sub x20, x29, 0x88 +│ ││││││ 0x100004e94 mov x0, x21 +│ ││││││ 0x100004e98 bl sym append...ySSF ; sym.imp.append...ySSF +│ ││││││ 0x100004e9c sub x20, x29, 0x88 +│ ││││││ 0x100004ea0 ldr x0, [x19, 0x10] +│ ││││││ 0x100004ea4 mov x1, x26 +│ ││││││ 0x100004ea8 bl sym append...ySSF ; sym.imp.append...ySSF +│ ││││││ 0x100004eac adrp x8, 0x100008000 +│ ││││││ 0x100004eb0 add x8, x8, 0x5e0 ; 0x1000085e0 ; "\n\nVerification: " +│ ││││││ 0x100004eb4 sub x8, x8, 0x20 +│ ││││││ 0x100004eb8 orr x1, x8, 0x8000000000000000 +│ ││││││ 0x100004ebc sub x20, x29, 0x88 +│ ││││││ 0x100004ec0 mov x0, 0x10 +│ ││││││ 0x100004ec4 movk x0, 0xd000, lsl 48 +│ ││││││ 0x100004ec8 bl sym append...ySSF ; sym.imp.append...ySSF +│ ││││││ 0x100004ecc sub x20, x29, 0x88 +│ ││││││ 0x100004ed0 mov x0, x23 +│ ││││││ 0x100004ed4 mov x1, x24 +│ ││││││ 0x100004ed8 bl sym append...ySSF ; sym.imp.append...ySSF +│ ││││││ 0x100004edc ldp x8, x21, [x29, -0x88] +│ ││││││ 0x100004ee0 ldr x10, [x19, 0x60] +│ ││││││ 0x100004ee4 ldr x9, [x19, 0x68] +│ ││││││ 0x100004ee8 stp x10, x9, [x29, -0x88] +│ ││││││ 0x100004eec ldr x9, [x19, 0x70] +│ ││││││ 0x100004ef0 stur x9, [x29, -0x78] +│ ││││││ 0x100004ef4 stp x8, x21, [x19, 0x80] +│ ││││││ 0x100004ef8 mov x0, x21 ; void *arg0 +│ ││││││ 0x100004efc bl sym.imp.swift_bridgeObjectRetain ; void *swift_bridgeObjectRetain(void *arg0) +│ ││││││ 0x100004f00 adrp x0, segment.__DATA ; 0x100010000 +│ ││││││ 0x100004f04 add x0, x0, 0x358 ; int64_t arg1 +│ ││││││ 0x100004f08 bl sym.func.1000052a8 +│ ││││││ 0x100004f0c mov x1, x0 +│ ││││││ 0x100004f10 add x0, x19, 0x80 +│ ││││││ 0x100004f14 sub x20, x29, 0x88 +│ ││││││ 0x100004f18 bl sym SwiftUI.State.wrappedValue...s ; sym.imp.SwiftUI.State.wrappedValue...s +│ ││││││ 0x100004f1c ldr x0, [x19, 0x38] ; void *arg0 +│ ││││││ 0x100004f20 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││││││ 0x100004f24 ldp x0, x1, [x19, 0x20] ; int64_t arg2 +│ ││││││ 0x100004f28 bl sym.func.100005384 +│ ││││││ 0x100004f2c mov x0, x26 ; void *arg0 +│ ││││││ 0x100004f30 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││││││ 0x100004f34 mov x0, x24 ; void *arg0 +│ ││││││ 0x100004f38 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││││││ 0x100004f3c mov x0, x21 ; void *arg0 +│ ││││││ 0x100004f40 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││││││ 0x100004f44 bl sym.imp.objc_release_x27 +│ ││││││ 0x100004f48 ldr x0, [x19, 0x40] ; int64_t arg2 +│ ││││││ 0x100004f4c ldr x1, [x19, 0x50] +│ ││││││ 0x100004f50 bl sym.func.10000544c +│ ││││││ 0x100004f54 mov x0, x25 ; void *arg0 +│ ││││││ 0x100004f58 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││││││ 0x100004f5c ldr x0, [x19] +│ ││││││ 0x100004f60 ldr x1, [x19, 0x48] +│ ┌───────< 0x100004f64 b 0x100005234 +│ │││││││ ; CODE XREF from sym.func.10000491c @ 0x100004b8c(x) +│ ││││││└─> 0x100004f68 mov x8, -0x2000000000000000 +│ ││││││ 0x100004f6c stp xzr, x8, [x29, -0x88] +│ ││││││ 0x100004f70 sub x20, x29, 0x88 +│ ││││││ 0x100004f74 mov w0, 0x20 +│ ││││││ 0x100004f78 bl sym _StringGuts.grow...SiF ; sym.imp._StringGuts.grow...SiF +│ ││││││ 0x100004f7c ldur x0, [x29, -0x80] ; void *arg0 +│ ││││││ 0x100004f80 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││││││ 0x100004f84 mov x8, 0x10 +│ ││││││ 0x100004f88 movk x8, 0xd000, lsl 48 +│ ││││││ 0x100004f8c orr x8, x8, 0xe +│ ││││││ 0x100004f90 adrp x9, 0x100008000 +│ ││││││ 0x100004f94 add x9, x9, 0x4e0 ; 0x1000084e0 ; "Failed to create private key: " +│ ││││││ 0x100004f98 sub x9, x9, 0x20 +│ ││││││ 0x100004f9c orr x9, x9, 0x8000000000000000 +│ ││││││ 0x100004fa0 stp x8, x9, [x29, -0x88] +│ ││││││ 0x100004fa4 ldr x8, [x19, 0x90] +│ ││││││ 0x100004fa8 str x8, [x19, 0x80] +│ ││││││ 0x100004fac adrp x0, segment.__DATA ; 0x100010000 +│ ││││││ 0x100004fb0 add x0, x0, 0x350 ; int64_t arg1 +│ ││││││ 0x100004fb4 bl sym.func.1000052a8 +│ ││││││ 0x100004fb8 mov x1, x0 +│ ││││││ 0x100004fbc add x0, x19, 0x80 +│ ││││││ 0x100004fc0 bl sym describing__String...clufC ; sym.imp.describing__String...clufC +│ ││││││ 0x100004fc4 mov x21, x1 +│ ││││││ 0x100004fc8 sub x20, x29, 0x88 +│ ││││││ 0x100004fcc bl sym append...ySSF ; sym.imp.append...ySSF +│ ││││││ 0x100004fd0 mov x0, x21 ; void *arg0 +│ ││││││ 0x100004fd4 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││││││ 0x100004fd8 ldp x8, x21, [x29, -0x88] +│ ││││││ 0x100004fdc stp x26, x24, [x29, -0x88] +│ ││││││ 0x100004fe0 ldr x9, [x19, 0x70] +│ ││││││ 0x100004fe4 stur x9, [x29, -0x78] +│ ││││││ 0x100004fe8 stp x8, x21, [x19, 0x80] +│ ││││││ 0x100004fec mov x0, x21 ; void *arg0 +│ ││││││ 0x100004ff0 bl sym.imp.swift_bridgeObjectRetain ; void *swift_bridgeObjectRetain(void *arg0) +│ ││││││ 0x100004ff4 adrp x0, segment.__DATA ; 0x100010000 +│ ││││││ 0x100004ff8 add x0, x0, 0x358 ; int64_t arg1 +│ ││││││ 0x100004ffc bl sym.func.1000052a8 +│ ││││││ 0x100005000 mov x1, x0 +│ ││││││ 0x100005004 add x0, x19, 0x80 +│ ││││││ 0x100005008 sub x20, x29, 0x88 +│ ││││││ 0x10000500c bl sym SwiftUI.State.wrappedValue...s ; sym.imp.SwiftUI.State.wrappedValue...s +│ ││││││ 0x100005010 mov x0, x25 ; void *arg0 +│ ││││││ 0x100005014 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││││││ 0x100005018 mov x0, x23 ; void *arg0 +│ ││││││ 0x10000501c mov x1, x22 ; int64_t arg2 +│ ││││││ 0x100005020 bl sym.func.100005384 +│ ││││││┌─< 0x100005024 b 0x100005150 +│ │││││││ ; CODE XREF from sym.func.10000491c @ 0x100004b9c(x) +│ │││││└──> 0x100005028 ldr x9, [x19, 0x60] +│ │││││ │ 0x10000502c ldr x8, [x19, 0x68] +│ │││││ │ 0x100005030 stp x9, x8, [x29, -0x88] +│ │││││ │ 0x100005034 ldr x8, [x19, 0x70] +│ │││││ │ 0x100005038 stur x8, [x29, -0x78] +│ │││││ │ 0x10000503c mov w8, 0xd +│ │││││ │ 0x100005040 mov x9, 0x10 +│ │││││ │ 0x100005044 movk x9, 0xd000, lsl 48 +│ │││││ │ 0x100005048 orr x8, x9, x8 +│ │││││ │ 0x10000504c adrp x9, 0x100008000 +│ │││││ │ 0x100005050 add x9, x9, 0x500 ; 0x100008500 ; "Failed to generate public key" +│ │││││ │ 0x100005054 sub x9, x9, 0x20 +│ │││││ │ 0x100005058 orr x9, x9, 0x8000000000000000 +│ │││││ │ 0x10000505c stp x8, x9, [x19, 0x80] +│ │││││ │ 0x100005060 adrp x0, segment.__DATA ; 0x100010000 +│ │││││ │ 0x100005064 add x0, x0, 0x358 ; int64_t arg1 +│ │││││ │ 0x100005068 bl sym.func.1000052a8 +│ │││││ │ 0x10000506c mov x1, x0 +│ │││││ │ 0x100005070 add x0, x19, 0x80 +│ │││││ │ 0x100005074 sub x20, x29, 0x88 +│ │││││ │ 0x100005078 bl sym SwiftUI.State.wrappedValue...s ; sym.imp.SwiftUI.State.wrappedValue...s +│ │││││ │ 0x10000507c mov x0, x25 ; void *arg0 +│ │││││ │ 0x100005080 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ │││││ │ 0x100005084 mov x0, x23 ; void *arg0 +│ │││││ │ 0x100005088 mov x1, x22 ; int64_t arg2 +│ │││││ │ 0x10000508c bl sym.func.100005384 +│ │││││ │ 0x100005090 bl sym.imp.objc_release_x28 +│ │││││┌──< 0x100005094 b 0x100005244 +│ │││││││ ; CODE XREF from sym.func.10000491c @ 0x100004bc0(x) +│ ││││└───> 0x100005098 mov x8, -0x2000000000000000 +│ ││││ ││ 0x10000509c stp xzr, x8, [x29, -0x88] +│ ││││ ││ 0x1000050a0 sub x20, x29, 0x88 +│ ││││ ││ 0x1000050a4 mov w0, 0x20 +│ ││││ ││ 0x1000050a8 bl sym _StringGuts.grow...SiF ; sym.imp._StringGuts.grow...SiF +│ ││││ ││ 0x1000050ac ldur x0, [x29, -0x80] ; void *arg0 +│ ││││ ││ 0x1000050b0 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││││ ││ 0x1000050b4 add x8, x21, 0xe +│ ││││ ││ 0x1000050b8 adrp x9, 0x100008000 +│ ││││ ││ 0x1000050bc add x9, x9, 0x520 ; 0x100008520 ; "Failed to extract public key: " +│ ││││ ││ 0x1000050c0 sub x9, x9, 0x20 +│ ││││ ││ 0x1000050c4 orr x9, x9, 0x8000000000000000 +│ ││││ ││ 0x1000050c8 stp x8, x9, [x29, -0x88] +│ ││││ ││ 0x1000050cc ldr x8, [x19, 0x90] +│ ││││ ││ 0x1000050d0 str x8, [x19, 0x80] +│ ││││ ││ 0x1000050d4 adrp x0, segment.__DATA ; 0x100010000 +│ ││││ ││ 0x1000050d8 add x0, x0, 0x350 ; int64_t arg1 +│ ││││ ││ 0x1000050dc bl sym.func.1000052a8 +│ ││││ ││ 0x1000050e0 mov x1, x0 +│ ││││ ││ 0x1000050e4 add x0, x19, 0x80 +│ ││││ ││ 0x1000050e8 bl sym describing__String...clufC ; sym.imp.describing__String...clufC +│ ││││ ││ 0x1000050ec mov x21, x1 +│ ││││ ││ 0x1000050f0 sub x20, x29, 0x88 +│ ││││ ││ 0x1000050f4 bl sym append...ySSF ; sym.imp.append...ySSF +│ ││││ ││ 0x1000050f8 mov x0, x21 ; void *arg0 +│ ││││ ││ 0x1000050fc bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││││ ││ 0x100005100 ldp x8, x21, [x29, -0x88] +│ ││││ ││ 0x100005104 stp x27, x24, [x29, -0x88] +│ ││││ ││ 0x100005108 stur x25, [x29, -0x78] +│ ││││ ││ 0x10000510c stp x8, x21, [x19, 0x80] +│ ││││ ││ 0x100005110 mov x0, x21 ; void *arg0 +│ ││││ ││ 0x100005114 bl sym.imp.swift_bridgeObjectRetain ; void *swift_bridgeObjectRetain(void *arg0) +│ ││││ ││ 0x100005118 adrp x0, segment.__DATA ; 0x100010000 +│ ││││ ││ 0x10000511c add x0, x0, 0x358 ; int64_t arg1 +│ ││││ ││ 0x100005120 bl sym.func.1000052a8 +│ ││││ ││ 0x100005124 mov x1, x0 +│ ││││ ││ 0x100005128 add x0, x19, 0x80 +│ ││││ ││ 0x10000512c sub x20, x29, 0x88 +│ ││││ ││ 0x100005130 bl sym SwiftUI.State.wrappedValue...s ; sym.imp.SwiftUI.State.wrappedValue...s +│ ││││ ││ 0x100005134 ldr x0, [x19, 0x38] ; void *arg0 +│ ││││ ││ 0x100005138 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││││ ││ 0x10000513c mov x0, x23 ; void *arg0 +│ ││││ ││ 0x100005140 mov x1, x22 ; int64_t arg2 +│ ││││ ││ 0x100005144 bl sym.func.100005384 +│ ││││ ││ 0x100005148 bl sym.imp.objc_release_x28 +│ ││││ ││ 0x10000514c bl sym.imp.objc_release_x26 +│ ││││ ││ ; CODE XREF from sym.func.10000491c @ 0x100005024(x) +│ ││││ │└─> 0x100005150 mov x0, x21 ; void *arg0 +│ ││││ │ 0x100005154 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││││ │┌─< 0x100005158 b 0x100005244 +│ ││││ ││ ; CODE XREF from sym.func.10000491c @ 0x100004d10(x) +│ ││└─────> 0x10000515c mov x8, -0x2000000000000000 +│ ││ │ ││ 0x100005160 stp xzr, x8, [x29, -0x88] +│ ││ │ ││ 0x100005164 sub x20, x29, 0x88 +│ ││ │ ││ 0x100005168 mov w0, 0x12 +│ ││ │ ││ 0x10000516c bl sym _StringGuts.grow...SiF ; sym.imp._StringGuts.grow...SiF +│ ││ │ ││ 0x100005170 ldur x0, [x29, -0x80] ; void *arg0 +│ ││ │ ││ 0x100005174 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││ │ ││ 0x100005178 adrp x8, 0x100008000 +│ ││ │ ││ 0x10000517c add x8, x8, 0x560 ; 0x100008560 ; "Signing failed: " +│ ││ │ ││ 0x100005180 sub x8, x8, 0x20 +│ ││ │ ││ 0x100005184 orr x8, x8, 0x8000000000000000 +│ ││ │ ││ 0x100005188 stp x25, x8, [x29, -0x88] +│ ││ │ ││ 0x10000518c ldr x8, [x19, 0x90] +│ ││ │ ││ 0x100005190 str x8, [x19, 0x80] +│ ││ │ ││ 0x100005194 adrp x0, segment.__DATA ; 0x100010000 +│ ││ │ ││ 0x100005198 add x0, x0, 0x350 ; int64_t arg1 +│ ││ │ ││ 0x10000519c bl sym.func.1000052a8 +│ ││ │ ││ 0x1000051a0 mov x1, x0 +│ ││ │ ││ 0x1000051a4 add x0, x19, 0x80 +│ ││ │ ││ 0x1000051a8 bl sym describing__String...clufC ; sym.imp.describing__String...clufC +│ ││ │ ││ 0x1000051ac mov x21, x1 +│ ││ │ ││ 0x1000051b0 sub x20, x29, 0x88 +│ ││ │ ││ 0x1000051b4 bl sym append...ySSF ; sym.imp.append...ySSF +│ ││ │ ││ 0x1000051b8 mov x0, x21 ; void *arg0 +│ ││ │ ││ 0x1000051bc bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││ │ ││ 0x1000051c0 ldp x8, x21, [x29, -0x88] +│ ││ │ ││ 0x1000051c4 ldr x10, [x19, 0x60] +│ ││ │ ││ 0x1000051c8 ldr x9, [x19, 0x68] +│ ││ │ ││ 0x1000051cc stp x10, x9, [x29, -0x88] +│ ││ │ ││ 0x1000051d0 ldr x9, [x19, 0x70] +│ ││ │ ││ 0x1000051d4 stur x9, [x29, -0x78] +│ ││ │ ││ 0x1000051d8 stp x8, x21, [x19, 0x80] +│ ││ │ ││ 0x1000051dc mov x0, x21 ; void *arg0 +│ ││ │ ││ 0x1000051e0 bl sym.imp.swift_bridgeObjectRetain ; void *swift_bridgeObjectRetain(void *arg0) +│ ││ │ ││ 0x1000051e4 adrp x0, segment.__DATA ; 0x100010000 +│ ││ │ ││ 0x1000051e8 add x0, x0, 0x358 ; int64_t arg1 +│ ││ │ ││ 0x1000051ec bl sym.func.1000052a8 +│ ││ │ ││ 0x1000051f0 mov x1, x0 +│ ││ │ ││ 0x1000051f4 add x0, x19, 0x80 +│ ││ │ ││ 0x1000051f8 sub x20, x29, 0x88 +│ ││ │ ││ 0x1000051fc bl sym SwiftUI.State.wrappedValue...s ; sym.imp.SwiftUI.State.wrappedValue...s +│ ││ │ ││ 0x100005200 ldr x0, [x19, 0x38] ; void *arg0 +│ ││ │ ││ 0x100005204 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││ │ ││ 0x100005208 ldp x0, x1, [x19, 0x20] ; int64_t arg2 +│ ││ │ ││ 0x10000520c bl sym.func.100005384 +│ ││ │ ││ 0x100005210 mov x0, x21 ; void *arg0 +│ ││ │ ││ 0x100005214 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││ │ ││ 0x100005218 ldr x0, [x19, 0x40] ; int64_t arg2 +│ ││ │ ││ 0x10000521c ldr x1, [x19, 0x50] +│ ││ │ ││ 0x100005220 bl sym.func.10000544c +│ ││ │ ││ 0x100005224 ldr x0, [x19, 0x18] ; void *arg0 +│ ││ │ ││ 0x100005228 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││ │ ││ 0x10000522c mov x0, x26 +│ ││ │ ││ 0x100005230 mov x1, x24 +│ ││ │ ││ ; CODE XREF from sym.func.10000491c @ 0x100004f64(x) +│ └───────> 0x100005234 bl sym.func.100005384 +│ │ │ ││ 0x100005238 bl sym.imp.objc_release_x28 +│ │ │ ││ 0x10000523c ldr x8, [x19, 0x30] +│ │ │ ││ 0x100005240 bl sym.imp.objc_release_x8 +│ │ │ ││ ; CODE XREFS from sym.func.10000491c @ 0x100005094(x), 0x100005158(x) +│ │ │ └└─> 0x100005244 ldur x8, [x29, -0x60] +│ │ │ 0x100005248 adrp x9, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ │ │ 0x10000524c ldr x9, reloc.__stack_chk_guard ; 0x10000c408 +│ │ │ 0x100005250 ldr x9, [x9] +│ │ │ 0x100005254 cmp x9, x8 +│ │ │ ┌─< 0x100005258 b.ne 0x10000527c +│ │ │ │ 0x10000525c sub sp, x29, 0x50 +│ │ │ │ 0x100005260 ldp x29, x30, [var_50h_2] +│ │ │ │ 0x100005264 ldp x20, x19, [var_40h] +│ │ │ │ 0x100005268 ldp x22, x21, [var_30h] +│ │ │ │ 0x10000526c ldp x24, x23, [var_20h] +│ │ │ │ 0x100005270 ldp x26, x25, [var_10h] +│ │ │ │ 0x100005274 ldp x28, x27, [sp], 0x60 +│ │ │ │ 0x100005278 ret +│ │ │ │ ; CODE XREF from sym.func.10000491c @ 0x100005258(x) +│ │ │ └─> 0x10000527c bl sym.imp.__stack_chk_fail ; void __stack_chk_fail(void) +│ │ │ ; CODE XREF from sym.func.10000491c @ 0x100004cd0(x) +│ │ └────> 0x100005280 ldr x0, [x19, 0x68] ; void *arg0 +│ │ 0x100005284 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ │ 0x100005288 ldr x0, [x19, 0x70] ; void *arg0 +│ │ 0x10000528c bl sym.imp.swift_release ; void swift_release(void *arg0) +│ │ 0x100005290 brk 1 +│ │ ; CODE XREF from sym.func.10000491c @ 0x100004dfc(x) +│ └──────> 0x100005294 ldr x0, [x19, 0x68] ; void *arg0 +│ 0x100005298 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ 0x10000529c ldr x0, [x19, 0x70] ; void *arg0 +│ 0x1000052a0 bl sym.imp.swift_release ; void swift_release(void *arg0) +└ 0x1000052a4 brk 1 diff --git a/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/key.asm b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/key.asm new file mode 100644 index 0000000000..f2015b7993 --- /dev/null +++ b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/key.asm @@ -0,0 +1,39 @@ +- offset - C8C9 CACB CCCD CECF D0D1 D2D3 D4D5 D6D7 89ABCDEF01234567 +0x1000100c8 3082 025b 0201 0002 8181 00bd f689 8fbd 0..[............ +0x1000100d8 0ce6 4f9a 97ec 301a 4893 4d2a bfdf f708 ..O...0.H.M*.... +0x1000100e8 154c db87 e5df b1cf 8da2 5e2a 7d92 a8bd .L........^*}... +0x1000100f8 30b9 10cf 96da 1025 d467 af92 26fa 43b7 0......%.g..&.C. +0x100010108 8683 a268 d47a 56ce 4141 edc0 100c 89a5 ...h.zV.AA...... +0x100010118 4e5f c459 cc55 091f a11f 1fb7 971d 531b N_.Y.U........S. +0x100010128 7338 4c3e e828 1dc1 686a 8d3e b0f2 0ab3 s8L>.(..hj.>.... +0x100010138 7426 d2dc cfa4 acf3 5b26 35d1 2dee 9141 t&......[&5.-..A +0x100010148 a693 ed91 fad7 4383 8553 e502 0301 0001 ......C..S...... +0x100010158 0281 8001 edbf 79cd ee94 3273 1c5f 5e88 ......y...2s._^. +0x100010168 0f62 9448 983b 5480 8f1b 9adc 9a91 16aa .b.H.;T......... +0x100010178 149c a86a e66c b0f9 7f92 8b0d c084 2513 ...j.l........%. +0x100010188 d3a6 75da 163a d30f fc8f 71fc 7e16 fbe5 ..u..:....q.~... +0x100010198 7167 c68a 4bfb 1213 6845 d617 bdd2 8369 qg..K...hE.....i +0x1000101a8 17c8 4484 b025 e449 9e51 9505 79e6 864a ..D..%.I.Q..y..J +0x1000101b8 f6c4 5e70 5218 f046 6342 321b 0752 83ee ..^pR..FcB2..R.. +0x1000101c8 d0bc 0b6e 12ed 27bb 0331 bba5 24c7 2e3b ...n..'..1..$..; +0x1000101d8 d6e9 2502 4100 cb78 2f7f 512f 49f0 f8db ..%.A..x/.Q/I... +0x1000101e8 2fc3 18c8 4162 4169 4cc0 7898 6cce db86 /...AbAiL.x.l... +0x1000101f8 1e04 9911 6c3d 988c a1cf b748 a28b 5328 ....l=.....H..S( +0x100010208 31fd 155f 56c0 c4c1 e625 8b69 83e8 59d2 1.._V....%.i..Y. +0x100010218 2b3e e7c9 bbfb 0241 00ef 01ad 4fdb a4b9 +>.....A....O... +0x100010228 5981 235e d110 ee0a a351 246f 6045 5cd5 Y.#^.....Q$o`E\. +0x100010238 705c a44a 3270 56a2 6f64 af68 c970 d893 p\.J2pV.od.h.p.. +0x100010248 3886 1a94 c0be b7b0 9d8d b559 f63a 3aed 8..........Y.::. +0x100010258 d754 7757 109a ad49 9f02 406c f395 5372 .TwW...I..@l..Sr +0x100010268 9084 e281 0f35 7b1d c915 a1dc 6edb 4771 .....5{.....n.Gq +0x100010278 0c05 af9a c32d 4dbe fd22 5db5 5310 ce5e .....-M.."].S..^ +0x100010288 5189 a05b 4df9 be90 7435 cb11 50d6 c121 Q..[M...t5..P..! +0x100010298 eec5 5064 d072 91c3 a235 8302 4062 eed6 ..Pd.r...5..@b.. +0x1000102a8 c6cf ac87 ecbc bfdf 67bb 124d e4fc 9990 ........g..M.... +0x1000102b8 60d1 5574 2466 b4ba e1d6 0e86 7e85 b6f6 `.Ut$f......~... +0x1000102c8 312c 3cf9 f3d3 cefc f42b fded 65ca 5adf 1,<......+..e.Z. +0x1000102d8 3a45 304f 736a cb5b 86cc 001f 1102 405e :E0Osj.[......@^ +0x1000102e8 6bae 7c7d fc8a f597 a939 3727 4ed9 e8d0 k.|}.....97'N... +0x1000102f8 8da9 32e4 6bde 760f eef1 2211 c41e 4a01 ..2.k.v..."...J. +0x100010308 73c4 348c 4d16 f12f 5fe4 e541 3a3b f1b1 s.4.M../_..A:;.. +0x100010318 787c 0e55 f9f7 cf64 93ad 77fd 3152 87 x|.U...d..w.1R. diff --git a/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/output.asm b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/output.asm new file mode 100644 index 0000000000..9446f020b9 --- /dev/null +++ b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/output.asm @@ -0,0 +1,8 @@ + + +Uses of SecKeyCreateWithData: +0x100007904 1 12 sym.imp.SecKeyCreateWithData + +xrefs to SecKeyCreateWithData: +sym.func.10000491c 0x100004b7c [CALL:--x] bl sym.imp.SecKeyCreateWithData + diff --git a/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/run.sh b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/run.sh new file mode 100755 index 0000000000..9aaedb35d3 --- /dev/null +++ b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/run.sh @@ -0,0 +1 @@ +r2 -q -i sec_hardcoded_rsa.r2 -A MASTestApp > output.asm \ No newline at end of file diff --git a/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/sec_hardcoded_rsa.r2 b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/sec_hardcoded_rsa.r2 new file mode 100644 index 0000000000..28837f4048 --- /dev/null +++ b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0013/sec_hardcoded_rsa.r2 @@ -0,0 +1,19 @@ +e asm.bytes = false +e scr.color=false +e asm.var=false + +!printf "\n\n" + +!printf "Uses of SecKeyCreateWithData:\n" +afl~SecKeyCreateWithData + +!printf "\n" + +!printf "xrefs to SecKeyCreateWithData:\n" +axt @ 0x100007904 + +!printf "\n" + +pdf @ sym.func.10000491c > function.asm + +px 607 @ 0x1000100c8 > key.asm \ No newline at end of file diff --git a/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/MASTG-DEMO-0014.md b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/MASTG-DEMO-0014.md new file mode 100644 index 0000000000..b6f624a8aa --- /dev/null +++ b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/MASTG-DEMO-0014.md @@ -0,0 +1,30 @@ +--- +platform: ios +title: Use of Hardcoded ECDSA Private Key in CryptoKit with r2 +code: [swift] +id: MASTG-DEMO-0014 +test: MASTG-TEST-0213 +--- + +### Sample + +{{ MastgTest.swift # function.asm }} + +### Steps + +1. Unzip the app package and locate the main binary file (@MASTG-TECH-0058), which in this case is `./Payload/MASTestApp.app/MASTestApp`. +2. Open the app binary with @MASTG-TOOL-0073 with the `-i` option to run this script. + +{{ cryptokit_hardcoded_ecdsa.r2 }} + +{{ run.sh }} + +### Observation + +The output reveals the different uses of `CryptoKit.P256.Signing.PrivateKey` functions, especially `sym.imp.CryptoKit.P256.Signing.PrivateKey.rawRepresentation` which is used to extract the raw representation of the private key. The output also reveals the hardcoded ECDSA private key within the binary's DATA section. + +{{ output.asm # key.asm }} + +### Evaluation + +The test fails because a hardcoded ECDSA private key was found in the code. diff --git a/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/MASTestApp b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/MASTestApp new file mode 100755 index 0000000000000000000000000000000000000000..cabd7d1fab684617265a3df6dcf5a8978a1b6189 GIT binary patch literal 120624 zcmeIb33wF6);C_$lVuVD1QPabScI@o_C$lsWF-O;lMoP>VMvB#AjyQ82_%3r5Em2| zq9|T*VR6Zf8!8H@S3yt_m&+zD*Xs@7g5Zh>2?F{5PIb?urxTX@e(&?X|L^&_pPZaJ zwVbN@Rn@7g?&_X@ocZ~D1Y;V8O8^Z6MMg4qJJZ9(STE27klCDP%E_9Ml|O}i123L9 z(5sEa^#qfi!mR0qfx$fewm?57$w6uOR03 zyWudKov!LxPQRB@-^nUbpDRd=Lb6<+PSOVq`DHd2+bf-|1yt&*suuNSN}!P}sg^VZ zGL&zDZMG}X?5eG@I;^vm`ZmoM^-a);>3njamR1SnbGjV1%2LTosgErY^)2)@Dr9;2 z+rEY(Hi!D{IYKK)>zN3=9NJ$CFN*!|jetlIAyUX5oyfsPsr0&N^zASyzpE2x| zscDt^rYrQ3e6e<= z`RogSJNQaXTq91VMxUQlVM+G21I=l4`ReJLG{ka=Vd8&L-%7uiMp;jP2stEuPHQ;~ zC?8+c4y{pEO6Bw6MzS0?l&d}5csr0rW%(Xa=p$LK4>>FJl~`Ps*77Lzt(EkZN#K*L z(ASz6F0*--vvu|+Ik3KwS`oiUsTnA-uS=6#=1rn(y)!BI+KE}2x#H+z%qX?%HXe=3 zaV#VJV1*@y_xnTDNcCyeF|J&5e-*lMR^Y`JaL*pk}v63BG*0Z}=!4!j-zuSe28crbhO zb;5@a>*L_32k~YQx?mC3g_no7MMS@#5eSnvYz*p0dLAL8DZ56&P5#UXa)YFc$}=5A zVLT7b2Vsnj(u^&rb-Jt-V<*{WIV_IavDsug7uX$hony1@)s^TxHhbk5Zcxcr<|!&B zy(x0N>|02h*1DtqWC_NY#sCG|EHRack35}FW5Q4fOeYp?Ou9T}n|g4RknY0u$Z*tF zx$F~dE?G7Fe)95AKk(tB3nq(kQN0DUP@I}8(<=FpPAaEdUzuiFzf0(wnj2U~E|V_0 zNS_hpD<7P=WO(sqEA=++$gn%Ca@Z)HdjeAU)0fm-D!r`zTbqvb80C6+Z@OqXa%m3m z6{c-^D7$byGA$0Q4t$Bld;{wddJ5h7g865{_+?sM)?(g`TdTqGFpB!b@xX>(v>Y~P zmBm$D<}V4=Lyl)+&B)M;lq1_#Zq0Mp=i5rG4!;g$*tQ%|(_nrsSf9yOm!({;pe>$c zZ7-O9O2H(1>BZC2Om*S(v*r+%^Q{?@lD7Gi#kyen>#8jd*FstEr1bJ}q7`~W!3EP# zt+dUyJ1PpXn9VK064ZumhQleVkg`0wk|7r>&-6TBMG%WFr9BHO=>T5GJu)h^4da;q7=rc7p3*-*qGJFde#G!vY99mzB=(FG$R+WEUMZ(Ym1)PE`h zDgr73Dgr73Dgr73Dgr73Dgr73Dgr73Dgr73Dgr73Dgr73Dgr73Dgr73Dgr73Dgr73 zDgr73Dgr73Dgr73Dgr73Dgr73Dgr73Dgr73Dgr73Dgr73Dgyt*2()N}_nvjK=D+54 z_B0nqdQRWa#dC5>SI@acQJ!-3$x7XKre>YS*xaD)-E=5}HK(4vb^mnu_dITD z{zKc%i#Ie@>IQbI#|vDM;k8@04A+FO&}#-9Jepx_?)|T-{qT?0ot?Q~r(tu4_GE>< zZ!tcIml&eM^d?VlP1x~gday#DzAK~IrY&{7n#@}EyJ^Rhk2dD8=1m(kd+|C$z5sfI zu~nyXjLo}lH9mNBJVXAh8Sl>}j1Oh=)-hIidc3ijbf4Dt8i5yaqCXEeHZP2B+PtOi z`lj9IXFm8N%9QY@@qrkW>)3`6&+hXR_U}5MxBuvK!EjH9dnVjLaF@Yd1-BONn*A~7 zCcrItV$LCM6l+GEe`7aoAJ;g{J#NIg=?F)LrL}I~2?c zkD_cXg6{ap&TuD-?%kbO;lDeuRcjF!b@7t>sKAc@fcOrS|L9d>Ja0!<_l%w%z zhX=vOf^PsH3H~bhFz_AVgTeQM4*)*`-Us{-aMZg&+biX05AZ1PDDc7Hox$V5JAh|^ zhk_UMN@+Nv*&AhBkkT1t*aZx!+|Pxv!d;z2_uX*6jIy$DvE1aQa(}O5h0Zx;Dbz+Y z(J$Dxp!#D1Tcrte=O0G<-50@D9Y#GHhix0jg52YH|JsZG)t5DM_h)eHS#y+|rLGOS zW1lhPg%hmfKTc@2o!vJDY5zjnvs#Up`be+ACQp1Qs~;aa;rJj8D~#%Zc8Th>qR%|R zb2^08&j@9|Z{5GZv;B{j!f@1MKrs8garKkEsXrakMtKLJJb3?w_b2KfzqPdV_(O~O zYiBg&qU^)b?}ww`kJspq9}-w$qqe8_Poz7yr~qRmA7kY@jF~*oUvsB;&N_jMHn@J9 z)_hRU^auVE8iRV#J2!Y|hrb)T3mx~|qIW#!w5+~P;Qe`(TVT!S7Hw}J{imk=9rbI!DXfJSqC1TYC_NB0fTgg;jj!U|)WmpnlJy6sCJ zrLl1oI98)=2WYw-@4o$^M~eiuiMLr}Q2i}vvt7R|-mh88>Z#rIDB~&Q5dyArv%O)N zZ0`UK`#t96<&WylWj?5DUb6qQK^hNUmWnO{b_b7{nzt=u^%hV9$`upYZNf0 z_0|6xq`d}hbq(6eTQ{I-5Mv(=VC?r}+GUU49n`ehd`|m&SrEn?$`3oTujL49YQY#i zb^}Y*q0T=7heHUXc3un28V9rbLt35pQ|i+N#?&9D8B>qlU`%bq*frwmGGpyF#OLEi8;!C?p}hs~rwD&g)3lk=Qv8DyKS&&Bn-G7%B#q|~;-6b& z0)FrMvAa~h+hzH#Zztc42tQh9d1VP~!bH?l$2N8)cLdx~nxZx;^n;Nun9^F7= z^N(nMya%{4@*7h#6UHC>QOoLe<3K+zejrAp`>3HVx(WTip3;u>r;We7wA$9RU67V+ zT5se%0k->M`KBV@@hAr$qiePGt2APnFICfBEJ-*8{o@t zo3_3N`B{L;z_miX5#^@&3ZJi8`PyM^eIv$g6~f6ztc7jnWn@A1=?G8XWNJQy@Lv$V z7Hf!CwLP2GY6aNf?%vy|4$RohU}tn;#%2xEt*AjelAb>>E-438Y?6m#qz|e`-(E#yW^J*scN6Mi zM)`eptwh*685-ESEcD+@^y3Wl=XCUIljp4ceLkj_V=jNA?z*N%ZExTc?e&#$t2VOf zsJ0huMQ<6UP^Jnab4&U4+eIgpvYgxRX#_{srtgs=2?d_|HY-$+H_VxhZq>Tbz1x=fP z7v3=Dw$0b3)Rt$peY}6c#vRr6<>gO=&WC!j*G@uCk@9aw{(0wGR-Zvxs2vWW420zy z=wJA@$;wsBg3vFcy}L2TQ=b>djnpT%P@jzU=1TSK#m?@dI*NAa?7oH#VmS%R2Fx{D zlzBMvZKz{=8P%hh?bU!2=7jC$Vy9 z=;?h2xW87{y=hZ%Ag+QYuSvu-ujv5NHz5tRC5_hzUQg<4J$ZZnlb59zucKJ6z;et) z9T@7c7xAcEV*5Zp+NUS-A&hn-Y-VR*LAYqf2h?MSlx{7sJ%qM=2Xe!-8jly_*@N-y zMZ0(~o;?`P4WB2$26gj(Px{cm7{)HX>k%+^t0;Y_LmCr(`Iu<9vr3XhyF+6^hqBSQ zS&MP&8O-($giJPx>irRPP`~<+^KM>z8DrI2jI$S!*O~JzJ=UUJ?~)(NbqJj1Rr340 zK z>t}o*+{Ef9XkzZxYji7U{i}(<8W-`xa!si=rb`xpqmd0bNacMzj70~QL*tFXeidu~ zd2XyT286MB+rb~EJWtWuL0lU>fOI}L!dR3Yj^Se)F$6r$4Gt~P0ie9!aiRQT@+7e3aV%4p4{b&7og+bc63A= zn+H^8of#g@o-^ zv@^bIplB!bw;*G41f|EG#Fu_JFhRd<6E}t#J!Jy(BN;E(T@M=~y%7 zka2DMkd)^TqlfCbd?@q4Agyvke;H^w^7w`49k^b{J|e+{HMI_D!kC+{g>|uaJ&KPa zcA-3U@bkN88dGoj2sa)~*V@8f>MLi^ zSIDk3)b-$N?sr1ThV^LTV@XD|HgJEio#_47s3YP+_kT^n5g8q%)C9^mrJE=#{Hxc+HMkG;obr^kAU_8YwJjluN~ z@$}s!W-(kasAVP?P(zdb3_mC;>*Ox zw@=_@(}&boA|0&*E><^R+0u~rlPE)bo&VCbl0#{d@5=R zTk1|@OP8iauVblV+#cRg#B0R5^AOfoSl|7Yjyg65vsJH_rh4AMeg$1^wrE-N8`^xN?alZ4l$PdTn!|$-HyAtw@-Xm|(7#{H_0>1r>06(R z^V9?yJCm{QKz`)bL)=@#^zQt-=ET%cpP(|}rowNl)>C<-y|<%0l=e@g6T_pu_3(QaoB| z>rl@gV!C(5bPK4SSZ7fgjw1gkML+4q`w8t!qrJEAJbHLv!&;2$Qh@xOhe=PAw~&YR zLA<^qj)Outj%Mypb?SjWN%wW4yfe68U*JBC<4$-_g&(gk3$1^c>T7UswQxKrU9@+y zUr)662JWW3x_hT{H|-Uoxel=(clYMQ|5E$P9|v!(IBVBnuPI>9sm0zi2zyZ6KUoxl z`;NGWvO~MqbA;_3gnf`ltHBx;e6VJ(9=t)iuaXUX|06poyEn1|X=$xY`z`7xo?^B) zhTNAiS9t2gxPF^y46UC)xbgWS)_S>Qn`_D7DA3YWEenUgdKrC#%4c3_aF|#79YV_`WEBmJM`_N2qSw%`^eMKhv!MqBaSy3 zS0P+awATeaEV8se^W3w~{mF|b*532!34O&+Ck95`wr{)V`4j72{20#~&Yk!O`e?6C zz@P37P@g=ByyzZ<@BRSUzFVMwp_cNdG2IJkdwPF>Ev7n6MVKBo zfvv?lDprq(hvVLD!x73SuW4;p);tIC$Zq9;b33ptw0;%# z+k`ph7(UN1%rnd|x*qe*%5?qJ^$qC1q>JVost4`2s1CbP2T_Nvz79GxA!1pENoCP7 zwuf1^^XD_%Zg(>^_ki7|JvHrHd%|ARKD!s()Na(iG*0_KrgmZ4@duCY2zo{L+Ycw0 zrt}HYr};4b9C6{3^mE$C%Knt@Zzu=V&8Necmgm1$jIa4D{hWaKzBKnxn(maQn|BS| zgxz{@opEOW;UIDg;DbR883OJjU`{d3>^~5sN7!cVw5GLnpQllInPz2L!?QIN_|hZS z^VYBPJj?MMY^&B+uPC%1>Vr9{p$_|X%mFc2EA+rz=RtbCW)Id1?lj%gnu>0i2bSac zfH=2^X|@b@@%gVC(r_Fx{}GNf|8+&4f%Bg@2T)$yPHXI^(QlX*^B?A3%6ALqCekC0 zjc(pJv^j6X#*q51XhYxp=i&1owMkDJgTK8tD-`ogH}88=A57$&!n=9*!rg*#K^Tf_ zo$g+~{#!ObW_ZIi5Q1eZ{IrU?_76xq$|L@)l<~9UevXUhtWNq z?!dH%cOB`*-0s=H_NJoW^tz6DdYf3PX9wFG4>{_b#zVUQ#Clb%r>_2szfe!3d+Rzr z?}>Wu=X$9=wD#-mjpTBaG#68TJ-n;AAI;G{yka?8IFK`>ffRZC4n?)$aZEDxu=%cx}b;kwFzd4i3iL8-n~pQ4Sr-6NYkyWA5#M=kfxc`RTkf z@5a5tNiUvociMJBv-a%1g=ou5+3IHz$9KPt?DP$=lbhgo7UdW3Cz7q}!|n9LQr|em zZK}^s_w{D-I*9k@XneecXN6?@`oVv$q@S&v-9H6x-?+R6<8dy?20xk;*vgXr2Dl^O zHyU&;$PQvFt(UaTB}hlMncKUWJ?lFm-|896a};w&SvpH~bz;pm%UEjJGeX6j7qt~j z25C}j(>1B(uLoCDz8zAr0k*locmlA_L0e~|t+UVunP`iQieIlv zuRz=IXLlFf<7Nc$Jub~ZR5ofK^xHj5A6h?x`fcERy{ElBZW5li(0onyAr^Hc+ujH1 z%B1HsSgW*~&bR-1_cO7U&*ea z%-o*zLb+pjTpD+@-xAmMG5lFfcm5nfd=?}6`|OWzPxFhUht}mLDkpG!8vU${+gNd2 zldUBCPUWV#hxTV=1CC()QTb_p`WEvH&A+rCJB@lZVT_*T>y2*S2Tm<$IzlO19*o@SsQmu#fd&6Nzf5e`z0qxL&J>QSgevkUW#rAohV4n+p*sJ@-Vzl>T zo?jpDmB???=kq+T*X5_svk5%gNqGbNwKug>Q{KY<1bdnk4=}>|c1uGY?r#G_TI)7w zr=@rv^!ZO~B6}?QPfzje_xVrf>wVGx`V>zTUnfJ)^-aDtGo7LE6pQO;8|v*UVxIXJ zn+pzWJhkgt>cZZvdC_5(x_A(4rnbVmVoMpuDYYf7G0H~3ALZcwv*3?%aQ`^?qa56S zJ^ZyA(f>;Lqa55H@;}?68n}seMpO z2F^&?JHtLi!cKI7z32+Nf%8#|qH#texc)D+{TYn+&B+;_=kP4hLEW*;i27V^^4UCxC|5dpE#28D`u&#YU%iy1mI81NpKWNpg{^&o2 z+u-+(z~}h;8$a5%%ZT)!wYrb3R z(|=(sksaRN(y|9-tjD>HJvf(9kMl5l-al%>7^nHP7i_&dKMOd$i}(*C?avs$hjNTt z8(+OM+4RQGWj3l?5ztotO5^>UAEtos0dyWq#* zw;S#c(=-~*3+EOUqHPM$M)_!~>(FL-u<27gXhUwpTk5DSBjMi#;aw3g3h~j7i@M=l zKrqf>=)7;@Y}MurQ|eZ%0bab!HU)M8ZF)v()9{P5sTpl{u{Jep0^8Js=gp_@WLv+F z3iUL02=V+hHrR7$3fub2X07K)GTVAu8}99jHln$_4tO^K_dkIv?X@o4&SabW_}h5` z(hY!)V^}L4Nj5@v2J$d&{b_6#^33*pAC==deW!8jUtD)j?=RH$gN6EIinbTqy|*_P z`u>Koe;9M~GK~K}4J_RaI4UF)%yi>?+}^a7CYxd+^<(7(I-o`;+%eG}<4 zNH0K-7VVBRAzDp6tut}IW{*<{hCPk)j-&qfAI#aSXBj=Ka36mF@}qGj&cVU;BS{bL zRnq#obzd9pO*qrC`pa9HCmCbwbKs&!I+|<5=l-q?PC|^c<@KoaFl@xm?zd+&EWfMP1y$?ly3;kG?%T^{rCG^;!d`=kGUNfH(T!<@Fn}?~#tHo zq&i)y?*;aK9e*Z?=c@d9y6^cX?K$P~Xs<~aevf!~h_*@|PlM;A?Y8+q%;&x~hb`%j z^7+TKK1}RyELiMsd8Xz_=;iHkfie9y@}5BLr3q`d-R0%=wYmIx@u|~do6{J2j_Rv; zUQBCbxoxJsl#ZR<*Rp|mV9WWQT?&tbPZ|LSwHxZ2hi5;`zG^?XwcGKf^k#emwA@vr&wm!RK8m;)Z9VM=?*~-sC4}H&is1M!(zg>9FEZ!RwZP`0m@5=85PN7omY{^Mi$#9kCjZ{gYwuo5O^erd2G}z4a`GU&W$WFP=}H9qFpMaKElhBhBFF2 zUF!mM{fx5&+!hPsJxoDXMy_jHc>Q<4it6LT0`0po66dO!FyJ6}qfPv7%;A1FY`)(O zyYF`omAOaA+;K8@lFXega~H|nl`{8ynR}VceTU3_pUnM$%>Ag${e;Z@qRjn@%>BB| z{f5l_w#@ym%>BO1{i)1-Q0D$h=Ke9Tg0xx;1dPBM2_nY+8p-CO4FFLMu)xrfT!BV_I|GIyNJog{N#DRW;fbEnJP z*)sPvqMJz<>?yzSj3$8Noh5$#^DDZJjZfs)cjNc%<=6O=f6#Sg{A5!>q1EX!RaLPJ zd!-9MIa6e_E?}&A3S)0!q7W}F3xVTj_zgpba^85NrG@0LCH{rPkAl!|! zbwfz)~yh=1yVF zMEDmJ5Ii?9Y!p~fn9ccQo&$v9Ef^!5N7iMt*kzF~I z#OzlKhwyjIu~IIkEMW>oMVuT{oH@sIU9E5j6hoRuo?>#whB%X@-~39TZjpx?ZAP?O z;Yp-xsElsuSpnuSx;UcGqv`|w;ij-)XSNzB5h z_;1Rr75{{dR4Tt{$`<~O>wUqQc zB@(vzlP2+`2A))~QEXuc4`jjylKg#B7}6>VTaZe4mEsB2JT{er=PP_iWy=xzQ*5C| z49rGtx*>~NA&37b+|5D0J3^To5zFf3z!kn}q~0!OU~6M=CRKN1=!UP1*D(2oxx~>3^mWOR6w{gpCwSi1TOr z2$uy4&JjM!q`)hh+jluZzJ`DkruIQh1>C8#OOHJHZxf*+$mOSeCxRdc3b zrKpIRV~WMl%BvM5e2aLSGT~>0ll6a(=Nd}tVa>>(jf9Wz3zYG(P(dNWuRJ!iA?Tl! zk8m%g^VdT-g$Tk{U!oMA=nY>YLC@v8DVQ|;jWiI-69SdIOiElnC4W#Xq1vxR%r}cG z5jyd}GA=){@;wN(WFx8dOj4bW|P@1?LDqm?(D>7fe|> zE+$yv7V$vq*RYnb$Y1$-Axz*ic+u~C27i*Lv*AC=)H)x=V@;BWG<$d~%|J>+SGEPe zgjk|?+4aQ^tHov2S2=9+iO;pxjzM@~na!!kpGEJqR8*B)^?^S>FI)7CoosQsN@;O6 zhX3RxSI-J;rIi-?A#PG)tDJ8sx0R4y-xVI7S3RrTR;-_Bt<}d&u+|K}Qtt~R9vEC2DSc~dbY;XET9=n9vJWS^h81i#K%ZmBJ_*0@-@y`)zBhX=saL+Og}*R2qKdyvnS$lDi2{ANkk z@LzDmZ{;H1Ak>rc(1AQilMg=u@p^-N{tv_d?Aex<5{qMQj>A%$VK2Ai0i?fdaIy%> z^AD`sQNiWsTUzkWKuaXj-GiGczIxER=)oWZCBQ|Ta3qE}LEu5aB4_})jTk5JAUY`l zMQ-^;xJ9thY#Z0gf|p~9@`#oRo3u>3C5Q=&gP8_r^MtQMSWrYKrdf%b&IiCB>&%29 zkxWw($=G7>r@$M)zl~(t30)Ywu?y3z1)tEB1@-O8LJb3$cKHCN8#Ryx?TNu}bjL8^ zw-^@o+i>h_h69F?jOj-*VG{WCkxcXPXxuCt4Si#ncGXz?e(_lNjb%b4Dr_(?VH@}X z@M!7h#Rq6m=gussvxtHC+nA`EW???l)b!UxMhx)({_s<80aRS5t9WI0+9uo>(J%4| z&Evv@+Eqah2d@r!B=m2(N5j^HKNcZHQkjZ?ihzoMihzoMihzoMihzoMihzoMihzoM zihzoMihzoMihzoMihzoMihzoMihzoMihzoMihzoMihzoMihzoMihzoMihzoMihzoM zihzoMihzoMihzoMihzoMihzoMihzoMihzoMihzoMihzoMiopNd2t>N+y>G@M-Qqjm zk#6yogj*^VmySYE! zqvjm1b#snaxjFAD@hFMo{cBv2?rsvtH&eOXL*n>06_J$PlEjlGo+9y7iC-!4t0bN#@o^HrTH@m+Zj`u5;^`94 zka(uV@u>t{k@VRe&he2A&hZ5w&hhyr&hfn_&L>KIlEf!V{91`mk$9fOuakJb#PLmL zT#;_^djgSe{H6()izGfx;?pI5y~Jlo{052NDDj&lezU~Q5}zq?i^OM1yjbET61Pfx zw!}*%UM6vy#OFwSuEfhFULo;HiQ6S!CGmL@r*Ae;y`2(wNxWL(^CgZ?zu}5>*GRlp z;tM6dNaBknj&G3Sige#9@g)*>OMI!smr1-%;#@~>;W!Ex*wGIDv3WN z@rNb8TH=pL{BNA=-JIdyqdr*>eLi**k7R4O80mgY;*U%G35h=`@wF1)NM8q$E@NnT zu+Ob>6#*3i6#*3i6#*3i6#*3i6#*3i6#*3i6#*3i6#*3i6#*3i6#*3i6#*3i6#*3i z6#*3i6#*3i6#*3i6#*3i6#*3i6#*3i6#*3i6#*3i6#*3i6#*3i6#*3i6#*3i6#*3i z6#*3i6#*3i6#*52%R_)(BaM+rp2FZJX{FrjqHZ@r>D^S{`>DRjqMn&P@sj)t>Alu< zJmyC6_2YI@=_Nm-#1{)AZY{XA_vp+82Tti%ME~>JdvEJ?aIpErwG;2{d2-bJ!yi|- zv^3)dT;llI`<8v+r@^JqFZh?>Y2Y7%mxFHwe;)i*@Dtz??k?tz~esLsw zT9TFNui@#9OnQx(_s3AgB{lRec2C~F^l*vSGa_?KqRLbRR0LE6R0LE6R0LE6R0LE6 zR0LE6R0LE6R0LE6R0LE6R0LE6R0LE6R0LE6R0LE6R0LE6R0LE6R0LE6R0LE6R0LE6 zR0LE6R0LE6R0LE6R0LE6R0LE6R0LE6R0LE6R0LE6R0LE6R0LE6R0LE6R0LE6{#Oyu zBX|1!a-Ej3XTj+WY~LmS0cU!D+8_n+-?cV|Ft*JXQ%vXgmub=9&1(%_$kyOT%QbsI zF&d^R2fYo75SV7Rz@k?PEI3`ug5LoB23i>e4vGn8!3#mJfO?0p;3Ciipszr;hO*$d zK>c+r_(srUph00QxCHbJ$Q#arBRjC*e9$IP_Xrj|1M~`LNJkcYALszc(1`^v12uwf z?97562Au_EN5Ty{2-0^!TF~pDUqC~0=c5Egph5T-c> zs=R_}J_Yq1%0g#=ZUx;llxfz3cN)f`M+{>c*Dw~^GlqrcgI0kyf_8(>#4v5o;Y@oa z=;q-p^fvI!3!EZWIe01*!zS z0U9zId4iUK)`H#|4ZJ~-V}J+94Z3nH3r4RDz5}$|z(NhNz!y{k@`Ans^^F6baV*3Y z2R(62_zApgJPREJnjJ58VDk`XtRdT8U0Gsr+3c0E@n&_1B@$6!DiIhoZp0r?oLFxR`OGQpL+h@;qT3rRUOUIpTQEE$| z5*NiLX8TLw-t+d)+ z?Mx>eOr~jh?Pq>1dB@qE22+B$++J#qFLBxp=?1g8w!m(%#G2ES&92%itJ!5S14FwZ zeoBFvybT%7*th~0urDrfIc$}sMb6}mB8$W1C^c7=xUxxYa=`-IY}eG>SVLAxsWrC} zI5~?F%$D+UQ$}oDhTUP!aagL#Y{f{LlU;7NxQfhZp^U(^1;q|~d3lk|x}a!sNXnV%|#avwK!}R zAV_deNhow!t;#YbOtMv4Ee^C?i4Eu$rIbppScB7Lak%pAwn~>F-db6bV=xt)44H-^ zGm4rpwbJIwF%+4uX#=}bqXNkUbDpK71U*cu5xRFA6>qY=#5UVzb@=+WA5mojg}y{7 zVF`^9s==kgYis72sRL1_rZ`Jh{zB9zE5(<8zS&VO4n=i%I7qh5MtF$e_C4q07L;-DbR^@z~!_LcAWGSz< z!W_&-D*)VVFxY6(iu!T7j0Dbr-rr6FWf_XB4j3&1IJRzBs(J7 z7FtV08#mEfTNE4b(_ItA_!&lvcQn;l; z6_mECQI-(JE~&jRDzcdE0TVdv6R13xLCM;P1*pa3Bv!(ZWq{=gSg}aa6K7+MB95O7 zd%4{~X)YL>Te4QI?P~PRBGPiqXXnK1+AFa+)n%DgZoL-sK+-G><8mw3B^BJZ7n@?+ zvrp!Nf`ZZld&;#1={$Z$L8;S_B(BtQsiI0tFJ@kA%BU$WsKt7sI&cBThcOLUL!!CD zGS`}6NSKd_Fv(U~RqevU(trg_@|0>9Nky0|S13cV@J^&IV=an}TYxosm9>O7C|^t0w3+YPjaw5q zmtP=G!1OJ}39NEbdbP`CuPjQk6w^j8vD`AtifI>JtG2e-+}=XomqMXOTo)_mz9im| z4yCWSO1^+EpWnpgptK3|4dfL6vN)-jI*bztTWU=v3GkdY$jMe<7g~kLq9m7FvFfgb z6;;e{sfE>5SY@JfD~g;-%Wl3TFS>Bz);K9Hhs9Pd&mlF#QCsD*Pqeub^5PPcrX&|& z-a-USU3m`Md~^|76d97Ls%MqkiZR`18ItlOcahiwE>A^lvcs|<-&*CcIumUjfZhJWyL0BWn>nZs8-y!h_VdGF^)FrzFjx% zw`jq6d6|jB{W9b73H-uwmE~*)FL|-WTLG790HxAP6gX9ES-uQTvN>TAY$bl=%miq` ztaczZ*SO?Gi~Y|Km1o+vkH{5YR-I+)#M%~2bQTmOXO&xNR?T-Ubd+Z$&A}$tT9WFt zR#_Z$Goc_3i+tYj1qJdPvl4Lk$&!M*HrR|-meSOVDW2ceDZ@mJSu-U|3iI!<6dIC% zT7|`BMiyn}fO{yCK~}_XRhUrinw{b|1s9Aa)v_Ro%y=bMR0Rc6O|GS$j560c#r-Qx zRZWh(dTs9`r8^U+=2p5=it?QcrCl#i1rQ}2_SkrFq3*kHWWbUsakizp++|9a%vM3I zJQoqf#A+uHj5A=_ZC^0S?sV2-q+>zvgw6M1iiJ%ernr+MHj5MM4snl`L+g+PEZP>J zrZ!$vXI#9w)ohp?4oj`?Hla90_$n1Bad><|{+4lychdawNr^h z3QDh?%x}+>(E2*JlKKd?36~cuw{o)8Wuf8E7fSL(fTq&wbQaRe-It>ckWoaN0#6Bj zUo;1Fw!%|gX|1UO_|}pvs<-@32VZ_r-)p_iDz4NM(y?nYWtdHt^g`e~#K}E;3luR< zAv&Zo-GAHizHr`!mH#)b?%T`aKV00mr-E-dIb7E*oL?FkBetD8OUip!Rg;UT>b0(E zocl1RJ05{8#qWXm8_Fc!8E&Vwc)Y;I5|h%-_yPsx5o&5Nc?4EK%!JA@CHeuu{M`Jcul$otH*5YcH)m(;!uGPVM_&y6QKJ$_Nce^#qLnHg%ChXMI zxHV-PI~g;F=rfI(nVH7upqQYvlIY9{#>mJ69aeRk{*<;U^kZ$KHYlj4TZp(#lbIG7 zISSmZxiK>{EhZ-DHjOcFqb4XJGcq!BQcxsiGqf*bY2fKu7XC;z2=2}r9>kxN(sNTh zclAGd%~!}v6!LQl`4feFN+I_XmHYKyqmV749F1iB+9JyS$G>|N@{bDn3VOcF@F-5Y zj0$cor?!H&7u@Rme_-T(6K{Q^=uc0J;953VE7Bp0AJ}R>)r}Cqx=By_13i)A$yi*}JD&(^YSsxyl|IG?{ zqeA{lAvY`JjvWH^r77e&3i&>T{G395M+xku-~^rIBALm}gcM?n3&3i+TyKBJKP!*t8XPrO35D&$29 zxn3bZtC0V$kpHcaBfBW_SIE;8a+N|}rI5FZGOU((omI%iU3q@~@I4CotU`{73XFe? zLViIZ55mj?JpKCTDdaVx3@amE8x-AES`3 z6=lqt;$>FI^Az%JqKsKwyjF{{U;jof8)3D@>q~`9KhB|HMp#wx8Y0TDisF?e%CKVM zRUyi-O5(LrlwnoGYqKc(+y84(hSdoZaIxBm$)Ge4d!3OTelZx4TXq$vCG?5~hVE9CJC`8tJMEz17(Sgw%Q zDde{l@_3N&QZu^3i&>Tyh9;>rI1f3WDVBaXncQtJ1b-YmcS;1 zgQXUuhNaF%9f&#wbp&cWbQ9Jeqz4TKT>%;fiUExPjReJk51EP$6h4Xc}lbXa?v8(2by*K_wt7Xf~(}WCP6s%>|W% zDnNEn6=)vF0dj(>LGwWiKsBIR&_WRHE!?1`pnE`TLF+*4K^s6%fu06E19}$J0P=vm zpyxo(gI)l=1lkCC8T1P1RnR8TYoOObn?YMZ?O{(1r2|O@!0l@b8nC|hpuyM`M1zdl zrW*)mjr9Qa1Yt-qbW4V=z|h>RABfs+07wrS2pR0Q&Fl zOHheBpKW*gxQ!scC#)Xl#BJ~YpB?86xREHkH5K6B-VH|e{3jhiRnLE_=Rf(qR2+zI z=YS}`SMR%J9NYFNrF#Ce{R5-YO?N+XmvNsy;LJ&TH}(S$j>IObM@E$gWd6sGj9&Hw z6kkWUyay#0JcvrCRNHxqq8?BUJhUtw1C@@miboB6EuaVsFmO_sdO+0=mU=)H&&L1D z2UG*igSZG)pJ?a#pE3Im1NgfeKX-ev2i_uv>bc+l_s;#&Yifbxsok@?>RDi%@S+p$ zIGskLN%^9SdKOqc3oJV#eTk#B0mrGu{fBxMxXqz++2P&)j`Pnlbz<{~Cz)_4Ry`B! zJI|}038o`%zGJ}G$_4)!;P%c0`_2Id9E%G)ZFkX=c0Aps&*S~qP9EFo3~|6Iz6%~k zmX7ykPsz{7GEbUf%EX~Tevpse-*5f?g6}x9x&4UzoiM!Ue~DtbTLIXymaX*#);tz)-T&uZpCXK^YOMdPTpQPn*S3N7l}kih3OFZ zg^E3;0585?ESw*!w#~QVjo}L_xemw5T??sME)r>KE?(uiSa_w4PD|72=-d*#5W!!u zzgV+P&%0Qe>`1B}XU8#rvvkzmcaT=>3GJMPm74ee?St<4q=e(jv11dHViOV*=#j4f zI`d7$Has<64Ub^SlOFd9I2rJ!=od_nG4XghG=>fofPaKE6n-ZYg2)4xh90@nqk6={ zV`$A?OfRqqxP2ErLcPGX&FA06?kF8&Utn=ojj6EUHE6uPP*pW%vZXR{{4c{&qusGT9%0I98>F6MOT6@uJ zM|P)%=(}>d9CBSZZ<4ut?aDsieNnXJ_V|()e|Nv|+Z{h$G%*5Sc~C!lMfH}?hwk|5 ziL^ca-+Qg}bg<#0B>RhZhaF-}(8;_!@KY_+JVp{ucHDyJ5stkw2V#{iR{w zoEqEr{jdKp{qtD2s}EnXZuW?+I}e0j^IY_uC7BPbsD0!`T}s;Ib7y|u9=vqXlM}ZO z|7zTel7m>UoqjXQO{l~y#KE^ zENs5+bx;1ZcfY>-{l){XPyaj^`C!CfU!I?@d;imOUEdwid&3)3j9Y(k=|6bt_W16H zydVE^=P>Qv&x|rYbA9jN9L-zR?1AQA`Ym%jJH2<^3mse&*0yxr9d!D&R|Y+F`;)cF z!Nn06~PBRx6j`^Y+biI>*EHV8~Z`_t_2%R&YS8U-5izD_uok? ze+em#FVY%s{H?_;g*Fx`p+1#bJQP^+8vF@rrlcgwdLD))9#Cz z{C&#Z8@(Ar|4;Q_D*Y!xe=NH9xgEp1E&jMR`{NsaUlA8N>hpVE98f%>`IYORpYYhF z(*K`^C;hS^dG29$rndj=zFWHJBF=To+BV|E6W`A9PW}73s}0o$ei)Mc==hWn&qHe; zT{Zu!o!7q^`p(ctZr*h4o#vtr)2d%t9yRK8*{Nr)32Qc{tX{RW{E-z6iC?uu+&{~3 ztm}lUZ#b~uteH4oxTf>F^GBXccss4<4G(9&y+2`mO8>r|Kc70HFIqox+Uf0QMi0Fv zV$O%_ns$DZ8~Sa(quMT-!@q4gF~;=fA235?kPd)|YeCWQ17q7jhsbYgK$FxZC z>9h@{>j0uF+*!?63u7{_>NBnLt>yMAdeQMpeHFeowXn=yURsUsm>A3K zE_{%qdetnm~hAG;*t=7BwS~{nTHcgn!lxu zuc;{4ORwvV8x%XnFi7uvD{|bRsfF32QwEK{Iy`M)=9G-W>+`boRpodKU!ONMeNt|Q ze$eQ#V|fY3j?FC0)aOmgEhyAO$Jnu1*ACJTDs#E2FdHmbuwV=NZxaT-sP(^{d0tFb=fOhN`8H2pY}Cr4JY;M09Vz(h+0+vuYY*BL-ha)gr=M)f%EA zIt5lhqiH$wO$YR%t{)rRAz{2R&9`=!58CXk&tTb zvQB>*mIYmBSf))~s}(eY5V`mzTlf{5Q_nA2leutv&3nI)0!gi=0~E}P?O+HC(M}Bt zi4vw3#6}sqkPsdf&U>Cdx3YLl>`=oH^6U`RPxQ>756aAz`iUNIOVYPvT(z;?4bc=& z8`V*amv6Vb^cf~Y{~jIV42HPa)Yz2R_=MycJvzoigcrYN7^-744e2~(#8qO-X?90> z$pZ91-{7=5^mxCKcTA`LLitNI=@230#QSR!A+L$Nu7+irL2@(zr*@g9GlPG)uuP+2 zU;KI3*@o*o-1)(z`Z1%6R_?Fq_mttsrziZ{A>*CVxBWHbrmQ~S9lt)Q>y3paPn6FZ zz3KhcyFX4lbugsxT30>jzi&*wS_T&waj2`1Jgs*Ph7T_}$cZ?!Rq)TEiRf-SJTOZ`p@WYWIBn>XqFW z9Spwl@#8r!c6@F0J)LZmje90ex+>_2dk4P!{FsbF!>8NtzGKxR6aPJ@WQZm>I8>tvN--oE z5`3~jb4QG1zU;+VC|dmXi$p{GXzt-a_bIj*#!xl`f`%EcFbrNhaP5FQ`bkNP9p$o= z6nhN34E-p6r=adZ(P8Jebz9l|Qc3s&UAGR6DUMkE)3dJ_I#FLm}2=luKS7wdop+5nG*ry6%7G zx{q$lxwc>Ru*$zT@4NAjCGVDZ2unI#^6k6H+UQ=N9h-p#TQ;+IOSNuA1i?>H^ z-An)Y=&c|BaqOXa8#iUG|Mq*ns+f_Rq;X9{lsowYQBvp0s}2q^Uox z=ylgO%@fQ241I2pK{(p;>ZZJ~{Yy*@k2LSyJ^QgCbGz)>@aDIDM(h~y&=U(Ip2}Hq z!-4L}@gME%Jo(dT+ujd*IsUw<(`QS}YffCDePinVlW*$ydr9KpZWFs*-|y8`r%yfh z#6R-h*gie4^nTqY{ppXMAEmcfy*^%JxMy?5KRQ1??vIhVF}-)4|Ma!3oxZ%e@4=78 zy>{gbCp&jy4|I5WVD~Yu&(b>nb5{4~Hq3h1F@WS!~G_`8?BY?%JjjG(xC%3i&{-#1ogOXWdPlm(UX3fNnO|fOHVd)NkWWliX_1;Tg#hhcKx9|1#O1-Ph=F}Jar#`EG zR;}JrS*yp#FkEoqqihvcr`}RrY^~yN?Cb5bk;Y0?si!9 zB&aOW7u)fDPFi$1DN(i4Iw~NeDm&6rW{By}AF=gS4*L2JiU*ze;273x&M}Ii$<5b| zNq?I(x@Pmw_pJH)j|FQ^%-^@bFlGCI+v{%c^S5z1$tOH(jQ5Q?@bb#8U%Y+Nx#pLB zC7nO2os#gy`m393TITKw{pps}x)lZb{V6+Ne&^9C;d5I?p1uCr;IPF#j744gyY_Eh zG5D&S4WHSE96r8xbJf2)XB`^0`}c~PpMQ9*M~{ZDZyl7l`-;!L?0j(Uf%QWMcR9W8 z`TLzqXTIO(hOn^@ywa38;kTJ7Pjvfp+|W|}-SKlycU<<5Z;o#m+gvc`hLUZ?@e590 z89J)y_*b0=cKYfKXRj%*eVMdm`<+w2eD-f!=7T%0 zO0Ei61<;!4e`!5J%cKNDN-S(zLW;ov0~ePliOGqnGYm^N#P&Ay3<(c=VCY>Bo)}f4 z(L{t#PmD`UiO-xCKOr{VV8mbu(nkE(w>7>+QwRAfHFf|Wr$ONn-7_qXa=TNXx5I-? zl751;OA1&)Vh9G{*=AMs+#f&Bb?&=w#NGublUM)n(8`yiCp}o+qkd%9XSR?1;h9f6 zR&2XRJL%01=epe--(}Qt*K@PG?K}G3imxLLe|&M*2mKohy9_hV`r!VaM-@`91435Sd1jz_J% zXPmtLuF#v_f92?}t0TVsVaW#%)ct+jEgNF5uypx8*m(ENZ@+ToD~BW#DWn*d2?>S> zzeyAffh($Z7cW&l1BDe;iD8yuv`;n&cMS9`i(n$0vW3xt1tpHs_%XO&Z;16r*W7W% zMHgUVB0~b2v%k;8c7xCbT;XwVN2jn>s}Z1`sWOji2Ah%fHW-u-&v)6u`4|N4cj zNk5#f8ojK;Q^We}?(rUcV)x7QUi1FcXZ@nXO%++I{+RR6p*wR<-E>`e!|1;6#+^Rb z^2>u$7R@afAG$4anDf;gSIn8*xaPTY9Um?jns_+l?aDJZls*66b=hMEwhUbt``qkL zYFCFgCN6PInisuwr0J`&bM>7EOxzQ?_`{DL{>QXu6K}3$e}4N=zAfZ#y)EIFA9SI6 zcaMC!>HhblJ6xY+U7U8`zlQ&Gvc6Zxm;SNh>G~^6gG|otGj}Eae7>`JggN!LV;??0 zN$ZUI&3es@XTCV~>GFv)*nz$K_q_OZ^oi>YBO8OZ{xCAq5xY!#FV?4b0XW0byZ)C9 zxDeUi#3I|RuU)1&00ZvZe}`#fJNSiAjiIk!2n&wwEKUaTv4-T>)VP!xhOw=oL9v5^ z^eJhbM@^sn{nBMU)@9q)6rK6$yBGd_eCPKgzg)C#m`UfohsjvbZ1!0hR(+~Ey*v9?{xCpLmiV=Y3_=MSn&MBqvJ*- z2*18pernR80YBWCUXZtb!3Vd!ojYuN-~Joc@5nirFf`|d=dvc=zHnCY$6s7u^v0xt zKRlEz3?4l7S;Jcg_BUtmfA)@`A674XyfkmyV~=-pKM}@Ey(vg=ub6S;EuFPTQWyLYc16^v2iITwT=f;d9ohB32E!-c4_b29 Void) { + + // Step 1: Use a hardcoded ECDSA P-256 private key (32 bytes for P-256) in bytes + let privateKeyBytes: [UInt8] = [ + 0x7c, 0x02, 0x2a, 0x7e, 0x53, 0x7e, 0x1a, 0x2d, + 0x44, 0x77, 0xd4, 0xf6, 0x20, 0x8b, 0x14, 0xdb, + 0x4e, 0x8d, 0x84, 0x19, 0xd6, 0x23, 0x5f, 0xf2, + 0x4e, 0x4b, 0x8d, 0x18, 0xf4, 0x2c, 0x76, 0xe2 + ] + let privateKeyData = Data(privateKeyBytes) + + guard let privateKey = try? P256.Signing.PrivateKey(rawRepresentation: privateKeyData) else { + completion("Failed to create private key.") + return + } + + let publicKey = privateKey.publicKey + + // Data to sign + let dataToSign = "This is a sample text".data(using: .utf8)! + + // Step 2: Sign the data with the hardcoded private key + let signature = try! privateKey.signature(for: dataToSign) + + // Convert signature to hex string for display + let signatureHex = signature.rawRepresentation.map { String(format: "%02hhx", $0) }.joined() + + // Step 3: Verify the signature with the public key + let verificationStatus = publicKey.isValidSignature(signature, for: dataToSign) + + let verificationResult = verificationStatus ? "Signature is valid." : "Signature is invalid." + + let value = """ + Original: \(String(data: dataToSign, encoding: .utf8)!) + + Public Key (Hex): \(publicKey.rawRepresentation.map { String(format: "%02hhx", $0) }.joined()) + + Signature (Hex): \(signatureHex) + + Verification: \(verificationResult) + """ + + completion(value) + } +} diff --git a/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/cryptokit_hardcoded_ecdsa.r2 b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/cryptokit_hardcoded_ecdsa.r2 new file mode 100644 index 0000000000..181ff6a7e8 --- /dev/null +++ b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/cryptokit_hardcoded_ecdsa.r2 @@ -0,0 +1,20 @@ +e asm.bytes = false +e scr.color=false + +!printf "Uses of CryptoKit.P256.Signing.PrivateKey:\n" +afl~CryptoKit.P256.Signing.PrivateKey + +!printf "\n" + +!printf "xrefs to CryptoKit.P256.Signing.PrivateKey.rawRepresentation:\n" +axt @ 0x100007388 + +!printf "\n" + +!printf "Use of CryptoKit.P256.Signing.PrivateKey.rawRepresentation:\n" + +pd-- 9 @ 0x1000048d4 + +pdf @ sym.func.1000046dc > function.asm + +px 32 @ 0x1000100c8 > key.asm \ No newline at end of file diff --git a/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/evaluation.txt b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/evaluation.txt new file mode 100644 index 0000000000..2069b1a81e --- /dev/null +++ b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/evaluation.txt @@ -0,0 +1,6 @@ +0x1000047b4 adrp x0, segment.__DATA ; 0x100010000 -> This instruction loads the base address of the `.data` segment into register `x0`. +0x1000047b8 add x0, x0, 0xe8 ; int64_t arg1 -> This adds an offset to the base address, pointing to a specific memory location within the `.data` segment, possibly where the hardcoded key or related data is stored. +0x1000047bc bl sym.func.100004e0c -> A function is called, with `x0` as an argument, likely using the data at the computed address (which could be the key) for further operations. +0x1000047c0 ldur x8, [x0, -8] -> This loads data from the memory location computed earlier (potentially part of the key) into register `x8`. +0x1000047c4 ldr x8, [x8, 0x40] -> Further data manipulation, loading another piece of data related to the earlier load. This could be part of the key processing. +0x1000047f0 bl sym CryptoKit.P256.Signing.PrivateKey. -> This calls the `PrivateKey` initializer, which may use the previously loaded data (potentially a hardcoded key) in its process of key creation. diff --git a/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/function.asm b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/function.asm new file mode 100644 index 0000000000..04b2eb0424 --- /dev/null +++ b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/function.asm @@ -0,0 +1,513 @@ + ; CALL XREF from sym.func.100005f30 @ 0x100005f68(x) +┌ 1840: sym.func.1000046dc (int64_t arg1, int64_t arg2, int64_t arg3); +│ ; arg int64_t arg1 @ x0 +│ ; arg int64_t arg2 @ x1 +│ ; arg int64_t arg3 @ x2 +│ ; var int64_t var_0h_2 @ sp+0x0 +│ ; var int64_t var_0h_10 @ sp+0x8 +│ ; var int64_t var_10h @ sp+0x10 +│ ; var int64_t var_0h_11 @ sp+0x18 +│ ; var int64_t var_20h @ sp+0x20 +│ ; var int64_t var_0h_9 @ sp+0x28 +│ ; var int64_t var_30h @ sp+0x30 +│ ; var int64_t var_0h_8 @ sp+0x38 +│ ; var int64_t var_40h @ sp+0x40 +│ ; var void *var_e8h @ sp+0x48 +│ ; var int64_t var_50h_2 @ sp+0x50 +│ ; var int64_t var_e0h @ sp+0x58 +│ ; var int64_t var_d0h @ sp+0x60 +│ ; var int64_t var_d0h_2 @ sp+0x68 +│ ; var int64_t var_0h_4 @ sp+0x70 +│ ; var int64_t var_0h_3 @ sp+0x78 +│ ; var int64_t var_0h @ sp+0x80 +│ ; var void *var_a8h @ sp+0x88 +│ ; var void *var_a0h @ sp+0x90 +│ ; var int64_t var_0h_12 @ sp+0x98 +│ ; var void *var_0h_7 @ sp+0xb0 +│ ; var void *arg0 @ sp+0xb8 +│ ; var int64_t var_0h_13 @ sp+0xc0 +│ ; var int64_t var_0h_5 @ sp+0xc8 +│ ; var int64_t var_0h_6 @ sp+0xd0 +│ ; var int64_t var_60h @ sp+0xe0 +│ ; var int64_t var_60h_2 @ sp+0xe8 +│ ; var int64_t var_10h_2 @ sp+0xf0 +│ ; var int64_t var_10h_3 @ sp+0xf8 +│ ; var int64_t var_20h_2 @ sp+0x100 +│ ; var int64_t var_20h_3 @ sp+0x108 +│ ; var int64_t var_30h_2 @ sp+0x110 +│ ; var int64_t var_30h_3 @ sp+0x118 +│ ; var int64_t var_40h_2 @ sp+0x120 +│ ; var int64_t var_40h_3 @ sp+0x128 +│ ; var int64_t var_50h @ sp+0x130 +│ ; var int64_t var_50h_3 @ sp+0x138 +│ 0x1000046dc stp x28, x27, [sp, -0x60]! +│ 0x1000046e0 stp x26, x25, [var_10h] +│ 0x1000046e4 stp x24, x23, [var_20h] +│ 0x1000046e8 stp x22, x21, [var_30h] +│ 0x1000046ec stp x20, x19, [var_40h] +│ 0x1000046f0 stp x29, x30, [var_50h_2] +│ 0x1000046f4 add x29, sp, 0x50 +│ 0x1000046f8 sub sp, sp, 0xe0 +│ 0x1000046fc stp x1, x2, [x29, -0xa8] ; arg3 +│ 0x100004700 stur x0, [x29, -0xb0] ; arg1 +│ 0x100004704 mov x0, 0 +│ 0x100004708 bl sym CryptoKit.P256.Signing.ECDSASignature...VMa ; sym.imp.CryptoKit.P256.Signing.ECDSASignature...VMa +│ 0x10000470c ldur x8, [x0, -8] +│ 0x100004710 stp x8, x0, [x29, -0xe0] +│ 0x100004714 ldr x8, [x8, 0x40] +│ 0x100004718 mov x9, x8 +│ 0x10000471c adrp x16, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004720 ldr x16, reloc.__chkstk_darwin ; 0x10000c3b8 +│ 0x100004724 blr x16 +│ 0x100004728 mov x9, sp +│ 0x10000472c add x8, x8, 0xf +│ 0x100004730 and x8, x8, 0xfffffffffffffff0 +│ 0x100004734 sub x8, x9, x8 +│ 0x100004738 stur x8, [x29, -0xb8] +│ 0x10000473c mov sp, x8 +│ 0x100004740 mov x0, 0 +│ 0x100004744 bl sym Foundation...8EncodingVMa ; sym.imp.Foundation...8EncodingVMa +│ 0x100004748 ldur x8, [x0, -8] +│ 0x10000474c stp x8, x0, [x29, -0xd0] +│ 0x100004750 ldr x8, [x8, 0x40] +│ 0x100004754 mov x9, x8 +│ 0x100004758 adrp x16, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x10000475c ldr x16, reloc.__chkstk_darwin ; 0x10000c3b8 +│ 0x100004760 blr x16 +│ 0x100004764 mov x9, sp +│ 0x100004768 add x8, x8, 0xf +│ 0x10000476c and x8, x8, 0xfffffffffffffff0 +│ 0x100004770 sub x8, x9, x8 +│ 0x100004774 stur x8, [x29, -0xc0] +│ 0x100004778 mov sp, x8 +│ 0x10000477c mov x0, 0 +│ 0x100004780 bl sym CryptoKit.P256.Signing.PublicKey...VMa ; sym.imp.CryptoKit.P256.Signing.PublicKey...VMa +│ 0x100004784 mov x27, x0 +│ 0x100004788 ldur x26, [x0, -8] +│ 0x10000478c ldr x8, [x26, 0x40] +│ 0x100004790 mov x9, x8 +│ 0x100004794 adrp x16, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004798 ldr x16, reloc.__chkstk_darwin ; 0x10000c3b8 +│ 0x10000479c blr x16 +│ 0x1000047a0 mov x9, sp +│ 0x1000047a4 add x8, x8, 0xf +│ 0x1000047a8 and x8, x8, 0xfffffffffffffff0 +│ 0x1000047ac sub x25, x9, x8 +│ 0x1000047b0 mov sp, x25 +│ 0x1000047b4 adrp x0, segment.__DATA ; 0x100010000 +│ 0x1000047b8 add x0, x0, 0xe8 ; int64_t arg1 +│ 0x1000047bc bl sym.func.100004e0c +│ 0x1000047c0 ldur x8, [x0, -8] +│ 0x1000047c4 ldr x8, [x8, 0x40] +│ 0x1000047c8 mov x9, x8 +│ 0x1000047cc adrp x16, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x1000047d0 ldr x16, reloc.__chkstk_darwin ; 0x10000c3b8 +│ 0x1000047d4 blr x16 +│ 0x1000047d8 mov x9, sp +│ 0x1000047dc add x8, x8, 0xf +│ 0x1000047e0 and x8, x8, 0xfffffffffffffff0 +│ 0x1000047e4 sub x20, x9, x8 +│ 0x1000047e8 mov sp, x20 +│ 0x1000047ec mov x0, 0 +│ 0x1000047f0 bl sym CryptoKit.P256.Signing.PrivateKey...VMa ; sym.imp.CryptoKit.P256.Signing.PrivateKey...VMa +│ 0x1000047f4 mov x23, x0 +│ 0x1000047f8 ldur x28, [x0, -8] +│ 0x1000047fc ldr x8, [x28, 0x40] +│ 0x100004800 mov x9, x8 +│ 0x100004804 adrp x16, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004808 ldr x16, reloc.__chkstk_darwin ; 0x10000c3b8 +│ 0x10000480c blr x16 +│ 0x100004810 mov x9, sp +│ 0x100004814 add x8, x8, 0xf +│ 0x100004818 and x8, x8, 0xfffffffffffffff0 +│ 0x10000481c sub x24, x9, x8 +│ 0x100004820 mov sp, x24 +│ 0x100004824 adrp x0, segment.__DATA ; 0x100010000 +│ 0x100004828 add x0, x0, 0xf0 ; int64_t arg1 +│ 0x10000482c bl sym.func.100004e0c +│ 0x100004830 adrp x1, segment.__DATA ; 0x100010000 +│ 0x100004834 add x1, x1, 0xa8 +│ 0x100004838 bl sym.imp.swift_initStaticObject +│ 0x10000483c mov x19, x0 +│ 0x100004840 adrp x21, segment.__DATA ; 0x100010000 +│ 0x100004844 add x21, x21, 0xf8 +│ 0x100004848 mov x0, x21 ; int64_t arg1 +│ 0x10000484c bl sym.func.100004e0c +│ 0x100004850 mov x22, x0 +│ 0x100004854 stur x0, [x29, -0x68] +│ 0x100004858 adrp x0, segment.__DATA ; 0x100010000 +│ 0x10000485c add x0, x0, 0x100 ; int64_t arg1 +│ 0x100004860 adrp x2, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x100004864 ldr x2, reloc.Foundation.ContiguousBytes.UInt8...szlMc ; 0x10000c368 ; int64_t arg3 +│ 0x100004868 mov x1, x21 ; int64_t arg2 +│ 0x10000486c bl sym.func.100005024 +│ 0x100004870 stur x0, [x29, -0x60] +│ 0x100004874 stur x19, [x29, -0x80] +│ 0x100004878 sub x0, x29, 0x80 ; int64_t arg1 +│ 0x10000487c mov x1, x22 ; int64_t arg2 +│ 0x100004880 bl sym.func.100004e90 +│ 0x100004884 ldr x8, [x0] +│ 0x100004888 add x0, x8, 0x20 ; int64_t arg1 +│ 0x10000488c ldr x8, [x8, 0x10] +│ 0x100004890 add x1, x0, x8 ; int64_t arg2 +│ 0x100004894 bl sym.func.100004674 +│ 0x100004898 mov x22, x0 +│ 0x10000489c mov x19, x1 +│ 0x1000048a0 sub x0, x29, 0x80 ; int64_t arg1 +│ 0x1000048a4 bl sym.func.100004eb4 +│ 0x1000048a8 stp x22, x19, [x29, -0x80] +│ 0x1000048ac mov x0, x22 ; int64_t arg2 +│ 0x1000048b0 mov x1, x19 +│ 0x1000048b4 bl sym.func.100004ed4 +│ 0x1000048b8 adrp x1, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x1000048bc ldr x1, [x1, 0x38] ; 0x10000c038 +│ ; reloc.Foundation.Data...VN +│ 0x1000048c0 adrp x2, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x1000048c4 ldr x2, [x2, 0x30] ; 0x10000c030 +│ ; reloc.Foundation.Data...VAA15ContiguousBytesAAWP.ContiguousBytes...WP +│ 0x1000048c8 sub x0, x29, 0x80 +│ 0x1000048cc mov x8, x20 +│ 0x1000048d0 mov x21, 0 +│ 0x1000048d4 bl sym CryptoKit.P256.Signing.PrivateKey.rawRepresentation.Foundation.ContiguousBytes...lufC ; sym.imp.CryptoKit.P256.Signing.PrivateKey.rawRepresentation.Foundation.ContiguousBytes...lufC +│ ┌─< 0x1000048d8 cbz x21, 0x100004900 +│ │ 0x1000048dc mov x0, x21 +│ │ 0x1000048e0 bl sym.imp.swift_errorRelease +│ │ 0x1000048e4 ldr x8, [x28, 0x38] +│ │ 0x1000048e8 mov x0, x20 +│ │ 0x1000048ec mov w1, 1 +│ │ 0x1000048f0 mov w2, 1 +│ │ 0x1000048f4 mov x3, x23 +│ │ 0x1000048f8 blr x8 +│ ┌──< 0x1000048fc b 0x100004940 +│ ││ ; CODE XREF from sym.func.1000046dc @ 0x1000048d8(x) +│ │└─> 0x100004900 stp x27, x24, [x29, -0xf0] +│ │ 0x100004904 stur x26, [x29, -0xf8] +│ │ 0x100004908 ldur x27, [x29, -0xb8] +│ │ 0x10000490c ldr x8, [x28, 0x38] +│ │ 0x100004910 mov x0, x20 +│ │ 0x100004914 mov w1, 0 +│ │ 0x100004918 mov w2, 1 +│ │ 0x10000491c mov x3, x23 +│ │ 0x100004920 blr x8 +│ │ 0x100004924 ldr x8, [x28, 0x30] +│ │ 0x100004928 mov x0, x20 +│ │ 0x10000492c mov w1, 1 +│ │ 0x100004930 mov x2, x23 +│ │ 0x100004934 blr x8 +│ │ 0x100004938 cmp w0, 1 +│ │┌─< 0x10000493c b.ne 0x1000049c4 +│ ││ ; CODE XREF from sym.func.1000046dc @ 0x1000048fc(x) +│ └──> 0x100004940 mov x0, x20 ; int64_t arg1 +│ │ 0x100004944 bl sym.func.100004f18 +│ │ 0x100004948 ldur x9, [x29, -0xb0] +│ │ 0x10000494c ldur x8, [x29, -0xa8] +│ │ 0x100004950 stp x9, x8, [x29, -0x80] +│ │ 0x100004954 ldur x8, [x29, -0xa0] +│ │ 0x100004958 stur x8, [x29, -0x70] +│ │ 0x10000495c mov x8, 0x13 +│ │ 0x100004960 movk x8, 0xd000, lsl 48 +│ │ 0x100004964 add x8, x8, 0xa +│ │ 0x100004968 adrp x9, 0x100007000 +│ │ 0x10000496c add x9, x9, 0xf00 ; 0x100007f00 ; "Failed to create private key." +│ │ 0x100004970 sub x9, x9, 0x20 +│ │ 0x100004974 orr x9, x9, 0x8000000000000000 +│ │ 0x100004978 stp x8, x9, [x29, -0x98] +│ │ 0x10000497c adrp x0, segment.__DATA ; 0x100010000 +│ │ 0x100004980 add x0, x0, 0x108 ; int64_t arg1 +│ │ 0x100004984 bl sym.func.100004e0c +│ │ 0x100004988 mov x1, x0 +│ │ 0x10000498c sub x0, x29, 0x98 +│ │ 0x100004990 sub x20, x29, 0x80 +│ │ 0x100004994 bl sym SwiftUI.State.wrappedValue...s ; sym.imp.SwiftUI.State.wrappedValue...s +│ │ ; CODE XREF from sym.func.1000046dc @ 0x100004db0(x) +│ ┌──> 0x100004998 mov x0, x22 ; void *arg0 +│ ╎│ 0x10000499c mov x1, x19 ; int64_t arg2 +│ ╎│ 0x1000049a0 bl sym.func.100004f58 +│ ╎│ 0x1000049a4 sub sp, x29, 0x50 +│ ╎│ 0x1000049a8 ldp x29, x30, [var_50h_2] +│ ╎│ 0x1000049ac ldp x20, x19, [var_40h] +│ ╎│ 0x1000049b0 ldp x22, x21, [var_30h] +│ ╎│ 0x1000049b4 ldp x24, x23, [var_20h] +│ ╎│ 0x1000049b8 ldp x26, x25, [var_10h] +│ ╎│ 0x1000049bc ldp x28, x27, [sp], 0x60 +│ ╎│ 0x1000049c0 ret +│ ╎│ ; CODE XREF from sym.func.1000046dc @ 0x10000493c(x) +│ ╎└─> 0x1000049c4 ldr x8, [x28, 0x20] +│ ╎ 0x1000049c8 ldur x26, [x29, -0xe8] +│ ╎ 0x1000049cc mov x0, x26 +│ ╎ 0x1000049d0 mov x1, x20 +│ ╎ 0x1000049d4 mov x2, x23 +│ ╎ 0x1000049d8 blr x8 +│ ╎ 0x1000049dc stur x25, [x29, -0x100] +│ ╎ 0x1000049e0 mov x8, x25 +│ ╎ 0x1000049e4 mov x20, x26 +│ ╎ 0x1000049e8 bl sym CryptoKit.P256.Signing.PrivateKey.public...F0AE06PublicF0Vvg.Public...F0Vvg...Vvg ; sym.imp.CryptoKit.P256.Signing.PrivateKey.public...F0AE06PublicF0Vvg.Public...F0Vvg...Vvg +│ ╎ 0x1000049ec mov x8, 0x13 +│ ╎ 0x1000049f0 movk x8, 0xd000, lsl 48 +│ ╎ 0x1000049f4 add x8, x8, 2 +│ ╎ 0x1000049f8 adrp x9, 0x100007000 +│ ╎ 0x1000049fc add x9, x9, 0xf20 ; 0x100007f20 ; "This is a sample text" +│ ╎ 0x100004a00 sub x9, x9, 0x20 +│ ╎ 0x100004a04 orr x9, x9, 0x8000000000000000 +│ ╎ 0x100004a08 stp x8, x9, [x29, -0x80] +│ ╎ 0x100004a0c ldur x25, [x29, -0xc0] +│ ╎ 0x100004a10 mov x8, x25 +│ ╎ 0x100004a14 bl sym Foundation...8EncodingV4utf8ACvgZ ; sym.imp.Foundation...8EncodingV4utf8ACvgZ +│ ╎ 0x100004a18 bl sym.func.100004f9c +│ ╎ 0x100004a1c mov x3, x0 +│ ╎ 0x100004a20 adrp x2, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ ╎ 0x100004a24 ldr x2, reloc....SSN ; 0x10000c358 +│ ╎ 0x100004a28 sub x20, x29, 0x80 +│ ╎ 0x100004a2c mov x0, x25 +│ ╎ 0x100004a30 mov w1, 0 +│ ╎ 0x100004a34 bl sym Foundation...btF ; sym.imp.Foundation...btF +│ ╎ 0x100004a38 mov x20, x0 +│ ╎ 0x100004a3c mov x24, x1 +│ ╎ 0x100004a40 ldp x8, x1, [x29, -0xd0] +│ ╎ 0x100004a44 ldr x8, [x8, 8] +│ ╎ 0x100004a48 mov x0, x25 +│ ╎ 0x100004a4c blr x8 +│ ╎ 0x100004a50 ldur x0, [x29, -0x78] ; void *arg0 +│ ╎ 0x100004a54 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ╎ 0x100004a58 stur x24, [x29, -0xc8] +│ ╎ 0x100004a5c lsr x8, x24, 0x3c +│ ╎ 0x100004a60 cmp x8, 0xe +│ ╎┌─< 0x100004a64 b.hi 0x100004db4 +│ ╎│ 0x100004a68 sub x8, x29, 0x10 +│ ╎│ 0x100004a6c stur x28, [x8, -0x100] +│ ╎│ 0x100004a70 sub x8, x29, 8 +│ ╎│ 0x100004a74 stur x23, [x8, -0x100] +│ ╎│ 0x100004a78 stur x20, [x29, -0xd0] +│ ╎│ 0x100004a7c ldur x8, [x29, -0xc8] +│ ╎│ 0x100004a80 stp x20, x8, [x29, -0x80] +│ ╎│ 0x100004a84 bl sym.func.100004fe0 +│ ╎│ 0x100004a88 mov x2, x0 +│ ╎│ 0x100004a8c adrp x1, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ ╎│ 0x100004a90 ldr x1, [x1, 0x38] ; 0x10000c038 +│ ╎│ ; reloc.Foundation.Data...VN +│ ╎│ 0x100004a94 sub x0, x29, 0x80 +│ ╎│ 0x100004a98 mov x28, x27 +│ ╎│ 0x100004a9c mov x27, x2 +│ ╎│ 0x100004aa0 mov x8, x28 +│ ╎│ 0x100004aa4 mov x20, x26 +│ ╎│ 0x100004aa8 bl sym CryptoKit.P256.Signing.PrivateKey.signature.for.ECDSASignature.Foundation.DataProtocol...lF ; sym.imp.CryptoKit.P256.Signing.PrivateKey.signature.for.ECDSASignature.Foundation.DataProtocol...lF +│ ┌───< 0x100004aac cbnz x21, 0x100004ddc +│ │╎│ 0x100004ab0 mov x20, x28 +│ │╎│ 0x100004ab4 bl sym CryptoKit.P256.Signing.ECDSASignature.rawRepresentation.Foundation.Data...Vvg ; sym.imp.CryptoKit.P256.Signing.ECDSASignature.rawRepresentation.Foundation.Data...Vvg +│ │╎│ 0x100004ab8 mov x20, x0 +│ │╎│ 0x100004abc mov x25, x1 +│ │╎│ 0x100004ac0 bl sym.func.100004000 +│ │╎│ 0x100004ac4 mov x26, x0 +│ │╎│ 0x100004ac8 mov x0, x20 ; void *arg0 +│ │╎│ 0x100004acc mov x1, x25 ; int64_t arg2 +│ │╎│ 0x100004ad0 bl sym.func.100004f58 +│ │╎│ 0x100004ad4 stur x26, [x29, -0x80] +│ │╎│ 0x100004ad8 adrp x20, segment.__DATA ; 0x100010000 +│ │╎│ 0x100004adc add x20, x20, 0x120 +│ │╎│ 0x100004ae0 mov x0, x20 ; int64_t arg1 +│ │╎│ 0x100004ae4 bl sym.func.100004e0c +│ │╎│ 0x100004ae8 mov x23, x0 +│ │╎│ 0x100004aec adrp x0, segment.__DATA ; 0x100010000 +│ │╎│ 0x100004af0 add x0, x0, 0x128 ; int64_t arg1 +│ │╎│ 0x100004af4 adrp x2, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ │╎│ 0x100004af8 ldr x2, reloc....SayxGSKsMc ; 0x10000c370 ; int64_t arg3 +│ │╎│ 0x100004afc mov x1, x20 ; int64_t arg2 +│ │╎│ 0x100004b00 bl sym.func.100005024 +│ │╎│ 0x100004b04 mov x3, x0 +│ │╎│ 0x100004b08 mov x25, -0x2000000000000000 +│ │╎│ 0x100004b0c sub x20, x29, 0x80 +│ │╎│ 0x100004b10 mov x0, 0 +│ │╎│ 0x100004b14 mov x1, -0x2000000000000000 +│ │╎│ 0x100004b18 sub x8, x29, 0x28 +│ │╎│ 0x100004b1c stur x23, [x8, -0x100] +│ │╎│ 0x100004b20 mov x2, x23 +│ │╎│ 0x100004b24 sub x8, x29, 0x30 +│ │╎│ 0x100004b28 stur x3, [x8, -0x100] +│ │╎│ 0x100004b2c bl sym Element...F ; sym.imp.Element...F +│ │╎│ 0x100004b30 sub x8, x29, 0x20 +│ │╎│ 0x100004b34 stur x0, [x8, -0x100] +│ │╎│ 0x100004b38 sub x8, x29, 0x18 +│ │╎│ 0x100004b3c stur x1, [x8, -0x100] +│ │╎│ 0x100004b40 mov x0, x26 ; void *arg0 +│ │╎│ 0x100004b44 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ │╎│ 0x100004b48 ldp x23, x24, [x29, -0xd0] +│ │╎│ 0x100004b4c stp x23, x24, [x29, -0x80] +│ │╎│ 0x100004b50 adrp x2, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ │╎│ 0x100004b54 ldr x2, [x2, 0x38] ; 0x10000c038 +│ │╎│ ; reloc.Foundation.Data...VN +│ │╎│ 0x100004b58 sub x1, x29, 0x80 +│ │╎│ 0x100004b5c mov x0, x28 +│ │╎│ 0x100004b60 mov x3, x27 +│ │╎│ 0x100004b64 ldur x27, [x29, -0x100] +│ │╎│ 0x100004b68 mov x20, x27 +│ │╎│ 0x100004b6c bl sym CryptoKit.P256.Signing.PublicKey.isValidSignature.for.ECDSASignature.Foundation.DataProtocol...lF ; sym.imp.CryptoKit.P256.Signing.PublicKey.isValidSignature.for.ECDSASignature.Foundation.DataProtocol...lF +│ │╎│ 0x100004b70 mov x26, x0 +│ │╎│ 0x100004b74 stp xzr, x25, [x29, -0x80] +│ │╎│ 0x100004b78 sub x20, x29, 0x80 +│ │╎│ 0x100004b7c mov w0, 0x49 ; 'I' +│ │╎│ 0x100004b80 bl sym _StringGuts.grow...SiF ; sym.imp._StringGuts.grow...SiF +│ │╎│ 0x100004b84 ldp x8, x9, [x29, -0x80] +│ │╎│ 0x100004b88 stp x8, x9, [x29, -0x80] +│ │╎│ 0x100004b8c sub x20, x29, 0x80 +│ │╎│ 0x100004b90 mov x0, 0x724f ; 'Or' +│ │╎│ 0x100004b94 movk x0, 0x6769, lsl 16 ; 'ig' +│ │╎│ 0x100004b98 movk x0, 0x6e69, lsl 32 ; 'in' +│ │╎│ 0x100004b9c movk x0, 0x6c61, lsl 48 ; 'al' +│ │╎│ 0x100004ba0 mov x1, 0x203a ; ': ' +│ │╎│ 0x100004ba4 movk x1, 0xea00, lsl 48 +│ │╎│ 0x100004ba8 bl sym append...ySSF ; sym.imp.append...ySSF +│ │╎│ 0x100004bac ldur x20, [x29, -0xc0] +│ │╎│ 0x100004bb0 mov x8, x20 +│ │╎│ 0x100004bb4 bl sym Foundation...8EncodingV4utf8ACvgZ ; sym.imp.Foundation...8EncodingV4utf8ACvgZ +│ │╎│ 0x100004bb8 mov x0, x23 +│ │╎│ 0x100004bbc mov x1, x24 +│ │╎│ 0x100004bc0 mov x2, x20 +│ │╎│ 0x100004bc4 bl sym Foundation__String...AAE8EncodingVtcfC ; sym.imp.Foundation__String...AAE8EncodingVtcfC +│ ┌────< 0x100004bc8 cbz x1, 0x100004dc8 +│ ││╎│ 0x100004bcc mov x23, x27 +│ ││╎│ 0x100004bd0 mov x24, x1 +│ ││╎│ 0x100004bd4 adrp x8, 0x100007000 +│ ││╎│ 0x100004bd8 add x8, x8, 0xf60 ; 0x100007f60 ; "Signature is invalid." +│ ││╎│ 0x100004bdc sub x8, x8, 0x20 +│ ││╎│ 0x100004be0 orr x8, x8, 0x8000000000000000 +│ ││╎│ 0x100004be4 adrp x9, 0x100007000 +│ ││╎│ 0x100004be8 add x9, x9, 0xfe0 ; 0x100007fe0 ; "Signature is valid." +│ ││╎│ 0x100004bec sub x9, x9, 0x20 +│ ││╎│ 0x100004bf0 orr x9, x9, 0x8000000000000000 +│ ││╎│ 0x100004bf4 tst w26, 1 +│ ││╎│ 0x100004bf8 csel x26, x9, x8, ne +│ ││╎│ 0x100004bfc mov x27, 0x13 +│ ││╎│ 0x100004c00 movk x27, 0xd000, lsl 48 +│ ││╎│ 0x100004c04 add x8, x27, 2 +│ ││╎│ 0x100004c08 csel x8, x27, x8, ne +│ ││╎│ 0x100004c0c stur x8, [x29, -0xc0] +│ ││╎│ 0x100004c10 sub x20, x29, 0x80 +│ ││╎│ 0x100004c14 bl sym append...ySSF ; sym.imp.append...ySSF +│ ││╎│ 0x100004c18 mov x0, x24 ; void *arg0 +│ ││╎│ 0x100004c1c bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││╎│ 0x100004c20 add x0, x27, 1 +│ ││╎│ 0x100004c24 adrp x8, 0x100007000 +│ ││╎│ 0x100004c28 add x8, x8, 0xf80 ; 0x100007f80 ; "\n\nPublic Key (Hex): " +│ ││╎│ 0x100004c2c sub x8, x8, 0x20 +│ ││╎│ 0x100004c30 orr x1, x8, 0x8000000000000000 +│ ││╎│ 0x100004c34 sub x20, x29, 0x80 +│ ││╎│ 0x100004c38 bl sym append...ySSF ; sym.imp.append...ySSF +│ ││╎│ 0x100004c3c mov x20, x23 +│ ││╎│ 0x100004c40 bl sym CryptoKit.P256.Signing.PublicKey.rawRepresentation.Foundation.Data...Vvg ; sym.imp.CryptoKit.P256.Signing.PublicKey.rawRepresentation.Foundation.Data...Vvg +│ ││╎│ 0x100004c44 mov x20, x0 +│ ││╎│ 0x100004c48 mov x24, x1 +│ ││╎│ 0x100004c4c bl sym.func.100004000 +│ ││╎│ 0x100004c50 mov x21, x0 +│ ││╎│ 0x100004c54 mov x0, x20 ; void *arg0 +│ ││╎│ 0x100004c58 mov x1, x24 ; int64_t arg2 +│ ││╎│ 0x100004c5c bl sym.func.100004f58 +│ ││╎│ 0x100004c60 stur x21, [x29, -0x98] +│ ││╎│ 0x100004c64 sub x20, x29, 0x98 +│ ││╎│ 0x100004c68 mov x0, 0 +│ ││╎│ 0x100004c6c mov x1, -0x2000000000000000 +│ ││╎│ 0x100004c70 sub x8, x29, 0x28 +│ ││╎│ 0x100004c74 ldur x2, [x8, -0x100] +│ ││╎│ 0x100004c78 sub x8, x29, 0x30 +│ ││╎│ 0x100004c7c ldur x3, [x8, -0x100] +│ ││╎│ 0x100004c80 bl sym Element...F ; sym.imp.Element...F +│ ││╎│ 0x100004c84 mov x24, x0 +│ ││╎│ 0x100004c88 mov x25, x1 +│ ││╎│ 0x100004c8c mov x0, x21 ; void *arg0 +│ ││╎│ 0x100004c90 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││╎│ 0x100004c94 sub x20, x29, 0x80 +│ ││╎│ 0x100004c98 mov x0, x24 +│ ││╎│ 0x100004c9c mov x1, x25 +│ ││╎│ 0x100004ca0 bl sym append...ySSF ; sym.imp.append...ySSF +│ ││╎│ 0x100004ca4 mov x0, x25 ; void *arg0 +│ ││╎│ 0x100004ca8 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││╎│ 0x100004cac adrp x8, 0x100007000 +│ ││╎│ 0x100004cb0 add x8, x8, 0xfa0 ; 0x100007fa0 ; "\n\nSignature (Hex): " +│ ││╎│ 0x100004cb4 sub x8, x8, 0x20 +│ ││╎│ 0x100004cb8 orr x1, x8, 0x8000000000000000 +│ ││╎│ 0x100004cbc sub x20, x29, 0x80 +│ ││╎│ 0x100004cc0 mov x0, 0x13 +│ ││╎│ 0x100004cc4 movk x0, 0xd000, lsl 48 +│ ││╎│ 0x100004cc8 bl sym append...ySSF ; sym.imp.append...ySSF +│ ││╎│ 0x100004ccc sub x20, x29, 0x80 +│ ││╎│ 0x100004cd0 sub x8, x29, 0x20 +│ ││╎│ 0x100004cd4 ldur x0, [x8, -0x100] +│ ││╎│ 0x100004cd8 sub x8, x29, 0x18 +│ ││╎│ 0x100004cdc ldur x24, [x8, -0x100] +│ ││╎│ 0x100004ce0 mov x1, x24 +│ ││╎│ 0x100004ce4 bl sym append...ySSF ; sym.imp.append...ySSF +│ ││╎│ 0x100004ce8 sub x0, x27, 3 +│ ││╎│ 0x100004cec adrp x8, 0x100007000 +│ ││╎│ 0x100004cf0 add x8, x8, 0xfc0 ; 0x100007fc0 ; "\n\nVerification: " +│ ││╎│ 0x100004cf4 sub x8, x8, 0x20 +│ ││╎│ 0x100004cf8 orr x1, x8, 0x8000000000000000 +│ ││╎│ 0x100004cfc sub x20, x29, 0x80 +│ ││╎│ 0x100004d00 bl sym append...ySSF ; sym.imp.append...ySSF +│ ││╎│ 0x100004d04 sub x20, x29, 0x80 +│ ││╎│ 0x100004d08 ldur x0, [x29, -0xc0] +│ ││╎│ 0x100004d0c mov x1, x26 +│ ││╎│ 0x100004d10 bl sym append...ySSF ; sym.imp.append...ySSF +│ ││╎│ 0x100004d14 ldp x8, x21, [x29, -0x80] +│ ││╎│ 0x100004d18 ldur x10, [x29, -0xb0] +│ ││╎│ 0x100004d1c ldur x9, [x29, -0xa8] +│ ││╎│ 0x100004d20 stp x10, x9, [x29, -0x80] +│ ││╎│ 0x100004d24 ldur x9, [x29, -0xa0] +│ ││╎│ 0x100004d28 stur x9, [x29, -0x70] +│ ││╎│ 0x100004d2c stp x8, x21, [x29, -0x98] +│ ││╎│ 0x100004d30 mov x0, x21 ; void *arg0 +│ ││╎│ 0x100004d34 bl sym.imp.swift_bridgeObjectRetain ; void *swift_bridgeObjectRetain(void *arg0) +│ ││╎│ 0x100004d38 adrp x0, segment.__DATA ; 0x100010000 +│ ││╎│ 0x100004d3c add x0, x0, 0x108 ; int64_t arg1 +│ ││╎│ 0x100004d40 bl sym.func.100004e0c +│ ││╎│ 0x100004d44 mov x1, x0 +│ ││╎│ 0x100004d48 sub x0, x29, 0x98 +│ ││╎│ 0x100004d4c sub x20, x29, 0x80 +│ ││╎│ 0x100004d50 bl sym SwiftUI.State.wrappedValue...s ; sym.imp.SwiftUI.State.wrappedValue...s +│ ││╎│ 0x100004d54 ldp x8, x1, [x29, -0xe0] +│ ││╎│ 0x100004d58 ldr x8, [x8, 8] +│ ││╎│ 0x100004d5c mov x0, x28 +│ ││╎│ 0x100004d60 blr x8 +│ ││╎│ 0x100004d64 ldp x8, x1, [x29, -0xf8] +│ ││╎│ 0x100004d68 ldr x8, [x8, 8] +│ ││╎│ 0x100004d6c mov x0, x23 +│ ││╎│ 0x100004d70 blr x8 +│ ││╎│ 0x100004d74 sub x8, x29, 0x10 +│ ││╎│ 0x100004d78 ldur x8, [x8, -0x100] +│ ││╎│ 0x100004d7c ldr x8, [x8, 8] +│ ││╎│ 0x100004d80 ldur x0, [x29, -0xe8] +│ ││╎│ 0x100004d84 sub x9, x29, 8 +│ ││╎│ 0x100004d88 ldur x1, [x9, -0x100] +│ ││╎│ 0x100004d8c blr x8 +│ ││╎│ 0x100004d90 mov x0, x24 ; void *arg0 +│ ││╎│ 0x100004d94 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││╎│ 0x100004d98 mov x0, x26 ; void *arg0 +│ ││╎│ 0x100004d9c bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││╎│ 0x100004da0 mov x0, x21 ; void *arg0 +│ ││╎│ 0x100004da4 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││╎│ 0x100004da8 ldp x0, x1, [x29, -0xd0] ; int64_t arg2 +│ ││╎│ 0x100004dac bl sym.func.100005064 +│ ││└──< 0x100004db0 b 0x100004998 +│ ││ │ ; CODE XREF from sym.func.1000046dc @ 0x100004a64(x) +│ ││ └─> 0x100004db4 ldur x0, [x29, -0xa8] ; void *arg0 +│ ││ 0x100004db8 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ ││ 0x100004dbc ldur x0, [x29, -0xa0] ; void *arg0 +│ ││ 0x100004dc0 bl sym.imp.swift_release ; void swift_release(void *arg0) +│ ││ 0x100004dc4 brk 1 +│ ││ ; CODE XREF from sym.func.1000046dc @ 0x100004bc8(x) +│ └────> 0x100004dc8 ldur x0, [x29, -0xa8] ; void *arg0 +│ │ 0x100004dcc bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ │ 0x100004dd0 ldur x0, [x29, -0xa0] ; void *arg0 +│ │ 0x100004dd4 bl sym.imp.swift_release ; void swift_release(void *arg0) +│ │ 0x100004dd8 brk 1 +│ │ ; CODE XREF from sym.func.1000046dc @ 0x100004aac(x) +│ └───> 0x100004ddc ldur x0, [x29, -0xa8] ; void *arg0 +│ 0x100004de0 bl sym.imp.swift_bridgeObjectRelease ; void swift_bridgeObjectRelease(void *arg0) +│ 0x100004de4 ldur x0, [x29, -0xa0] ; void *arg0 +│ 0x100004de8 bl sym.imp.swift_release ; void swift_release(void *arg0) +│ 0x100004dec adrp x1, 0x100007000 +│ 0x100004df0 add x1, x1, 0xf40 ; 0x100007f40 ; "MASTestApp/MastgTest.swift" +│ 0x100004df4 mov x0, x21 ; void *arg0 +│ 0x100004df8 mov w2, 0x1a +│ 0x100004dfc mov w3, 1 +│ 0x100004e00 mov w4, 0x1b +│ 0x100004e04 bl sym.imp.swift_unexpectedError ; void swift_unexpectedError(void *arg0) +└ 0x100004e08 brk 1 diff --git a/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/key.asm b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/key.asm new file mode 100644 index 0000000000..e5d3c64ff4 --- /dev/null +++ b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/key.asm @@ -0,0 +1,3 @@ +- offset - C8C9 CACB CCCD CECF D0D1 D2D3 D4D5 D6D7 89ABCDEF01234567 +0x1000100c8 7c02 2a7e 537e 1a2d 4477 d4f6 208b 14db |.*~S~.-Dw.. ... +0x1000100d8 4e8d 8419 d623 5ff2 4e4b 8d18 f42c 76e2 N....#_.NK...,v. diff --git a/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/output.asm b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/output.asm new file mode 100644 index 0000000000..5be6139d99 --- /dev/null +++ b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/output.asm @@ -0,0 +1,30 @@ +Uses of CryptoKit.P256.Signing.PrivateKey: +0x100007364 1 12 sym.imp.CryptoKit.P256.Signing.PrivateKey.public...F0AE06PublicF0Vvg.Public...F0Vvg...Vvg +0x100007370 1 12 sym.imp.CryptoKit.P256.Signing.PrivateKey.rawRepresentation.Foundation.ContiguousBytes...lufC +0x10000737c 1 12 sym.imp.CryptoKit.P256.Signing.PrivateKey.signature.for.ECDSASignature.Foundation.DataProtocol...lF +0x100007388 1 12 sym.imp.CryptoKit.P256.Signing.PrivateKey...VMa + +xrefs to sym.imp.CryptoKit.P256.Signing.PrivateKey...VMa: +sym.func.1000046dc 0x1000047f0 [CALL:--x] bl sym.imp.CryptoKit.P256.Signing.PrivateKey...VMa + +Use of sym.imp.CryptoKit.P256.Signing.PrivateKey: +│ 0x1000048b0 mov x1, x19 +│ 0x1000048b4 bl sym.func.100004ed4 +│ 0x1000048b8 adrp x1, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x1000048bc ldr x1, [x1, 0x38] ; 0x10000c038 +│ ; reloc.Foundation.Data...VN +│ 0x1000048c0 adrp x2, reloc.Foundation.__DataStorage.bytes.allocator...itcfc ; 0x10000c000 +│ 0x1000048c4 ldr x2, [x2, 0x30] ; 0x10000c030 +│ ; reloc.Foundation.Data...VAA15ContiguousBytesAAWP.ContiguousBytes...WP +│ 0x1000048c8 sub x0, x29, 0x80 +│ 0x1000048cc mov x8, x20 +│ 0x1000048d0 mov x21, 0 +│ 0x1000048d4 bl sym CryptoKit.P256.Signing.PrivateKey.rawRepresentation.Foundation.ContiguousBytes...lufC ; sym.imp.CryptoKit.P256.Signing.PrivateKey.rawRepresentation.Foundation.ContiguousBytes...lufC +│ ┌─< 0x1000048d8 cbz x21, 0x100004900 +│ │ 0x1000048dc mov x0, x21 +│ │ 0x1000048e0 bl sym.imp.swift_errorRelease +│ │ 0x1000048e4 ldr x8, [x28, 0x38] +│ │ 0x1000048e8 mov x0, x20 +│ │ 0x1000048ec mov w1, 1 +│ │ 0x1000048f0 mov w2, 1 +│ │ 0x1000048f4 mov x3, x23 diff --git a/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/run.sh b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/run.sh new file mode 100755 index 0000000000..18d8db679d --- /dev/null +++ b/demos/ios/MASVS-CRYPTO/MASTG-DEMO-0014/run.sh @@ -0,0 +1 @@ +r2 -q -i cryptokit_hardcoded_ecdsa.r2 -A MASTestApp > output.asm diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md new file mode 100644 index 0000000000..94f248a315 --- /dev/null +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0213.md @@ -0,0 +1,35 @@ +--- +title: Use of Hardcoded Cryptographic Keys in Code +platform: ios +id: MASTG-TEST-0213 +type: [static] +weakness: MASWE-0014 +--- + +## Overview + +In this test case, we will examine iOS applications for the presence of hardcoded cryptographic keys. Hardcoded keys can be typically found in calls to cryptographic functions or stored as constants or variables within the code. In iOS, cryptographic keys are often used in the following frameworks: + +- **Security Framework**: The [`SecKeyCreateWithData`](https://developer.apple.com/documentation/security/seckeycreatewithdata(_:_:_:)) function allows developers to create a cryptographic key from raw data. +- **CommonCrypto**: The [`CCCrypt`](https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/CCCrypt.3cc.html) can be initialized with raw key data in its `key` parameter. +- **CryptoKit**: Although `CryptoKit` provides higher-level abstractions for cryptographic operations, developers might still hardcode cryptographic keys in different formats and feed it to methods like [`P256.Signing.PrivateKey.init(rawRepresentation:)`](https://developer.apple.com/documentation/cryptokit/p256/signing/privatekey/init(rawrepresentation:)) or similar. + +## Steps + +1. Run a static analysis tool such as @MASTG-TOOL-0073 on the app binary looking for cryptographic APIs as indicated above. + +## Observation + +The output should include any instances where the app uses cryptographic functions that accept raw key data. Whenever possible, the output should also try to point to the raw key data from the binary. + +## Evaluation + +The test fails if calls to cryptographic functions with hardcoded keys are found within binary. + +You may find the keys being directly passed as arguments to cryptographic functions (byte arrays or string literals) or stored in variables or constants within the code. Typical representations of hardcoded keys include: + +- **Raw Byte Arrays**: Cryptographic keys may be directly embedded in the code as arrays of `UInt8` or `Data` objects. For example, a 256-bit AES key might be represented as a `[UInt8]` array. +- **Base64-Encoded Strings**: Developers might encode cryptographic keys as Base64 strings within the code, which can be easily decoded by attackers if discovered. +- **Hex-Encoded Strings**: Keys are sometimes stored as hexadecimal strings, which are then converted to `Data` objects at runtime for cryptographic operations. + +Ensure that any identified keys are indeed cryptographic keys used for security-relevant purposes. Avoid false positives by verifying the key's usage context (e.g., configuration settings or non-security-related constants might be misidentified as cryptographic keys). diff --git a/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md new file mode 100644 index 0000000000..afdddca927 --- /dev/null +++ b/tests-beta/ios/MASVS-CRYPTO/MASTG-TEST-0214.md @@ -0,0 +1,31 @@ +--- +title: Hardcoded Cryptographic Keys in Files +platform: ios +id: MASTG-TEST-0214 +type: [static] +weakness: MASWE-0014 +--- + +## Overview + +Cryptographic keys may be embedded files such as configuration files or key files, certificate files, or other resource files bundled with the app, making them accessible to anyone who can extract the app's resources. Real-world cases include storing API keys, SSL/TLS private keys, or encryption keys within these files, which can lead to serious security vulnerabilities if the app is reverse-engineered. + +- **Identified by File Extension**: Files with extensions such as `.key`, `.pem`, `.crt`, `.p12`, `.cer`, or `.der` often contain cryptographic keys or certificates. +- **Identified by PEM Markers**: Strings such as `-----BEGIN PRIVATE KEY-----`, `-----BEGIN CERTIFICATE-----`, or the byte sequence `0x2d 0x2d 0x2d 0x2d 0x2d` (representing `-----` in ASCII) within files indicate the presence of PEM-encoded keys or certificates. +- **Identified by Common Byte Patterns**: Binary files containing specific byte sequences that match known DER or PKCS#12 formats, such as `0x30 0x82` (indicating the start of a DER-encoded structure), can indicate the presence of cryptographic material. +- **Embedded in Property Lists or JSON Files**: Keys might be stored within `.plist` or `.json` configuration files, often encoded as Base64 strings. +- **Identified by Specific Strings**: Keywords such as `privateKey`, `key`, or `secret` within files or variable names can indicate embedded keys or sensitive data. + +## Steps + +1. Run a static analysis tool such as @MASTG-TOOL-0073 on the app binary looking for strings or sequences of bytes as indicated above. + +## Observation + +The output should include any instances where potential cryptographic keys are found hardcoded within the application's source code or binary. + +## Evaluation + +The test fails if hardcoded cryptographic keys are found within the source code or binary. + +Ensure that any identified keys are indeed cryptographic keys used for security-relevant purposes. Avoid false positives by verifying the key's usage context (e.g., configuration settings or non-security-related constants might be misidentified as cryptographic keys). diff --git a/weaknesses/MASVS-AUTH/MASWE-0036.md b/weaknesses/MASVS-AUTH/MASWE-0036.md index 5c207a2201..9284a74df5 100644 --- a/weaknesses/MASVS-AUTH/MASWE-0036.md +++ b/weaknesses/MASVS-AUTH/MASWE-0036.md @@ -9,18 +9,15 @@ mappings: refs: - https://developers.google.com/identity/blockstore/android?hl=en -- https://cloud.google.com/docs/authentication/api-keys#securing_an_api_key -- https://cloud.google.com/docs/authentication/api-keys#adding_application_restrictions - https://cloud.google.com/docs/authentication/best-practices-applications#semi-trusted_or_restricted_environments - https://cloud.google.com/docs/authentication/best-practices-applications#security_considerations - https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/authenticating_users_with_sign_in_with_apple/ draft: - description: General authentication best practice. + description: General authentication material management best practices. Note that API keys are covered separately. topics: - session IDs - tokens - passwords - - API keys - use of sign-in with Apple/Google status: draft diff --git a/weaknesses/MASVS-CRYPTO/MASWE-0014.md b/weaknesses/MASVS-CRYPTO/MASWE-0014.md index d4a87e04ab..37b9e3b9b2 100644 --- a/weaknesses/MASVS-CRYPTO/MASWE-0014.md +++ b/weaknesses/MASVS-CRYPTO/MASWE-0014.md @@ -7,19 +7,36 @@ profiles: [L1, L2] mappings: masvs-v1: [MSTG-STORAGE-1] masvs-v2: [MASVS-CRYPTO-2, MASVS-STORAGE-1] - + cwe: [321] + android: https://developer.android.com/privacy-and-security/risks/hardcoded-cryptographic-secrets refs: - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf -draft: - description: e.g. storing keys in SharedPreferences, storing keys in files, hardcoded - keys, etc. - topics: - - platform keystore (Android KeyStore / iOS KeyChain) - - TEE/SE - - Cryptographic Keys Not Encrypted with key from platform keystore. envelope encryption - (DEK+KEK) (considered "equivalent protection") - - Key Wrapping (NIST.SP.800-175Br1 5.3.5) -status: draft - +- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-175Br1.pdf +status: new --- +## Overview + +Cryptographic keys are essential for securing sensitive data in mobile applications. However, if these keys are not properly protected at rest, they can be easily compromised. This weakness involves storing cryptographic keys in insecure locations, such as unencrypted SharedPreferences, unprotected files, hardcoding them within the application code, or including them in source control and versioning systems which may end in the final application package in production. + +Attackers can decompile or reverse-engineer the app to extract hardcoded keys. + +## Impact + +- **Unauthorized Access**: If cryptographic keys are not properly protected, attackers may gain unauthorized access to sensitive data and potential identity theft. +- **Data Tampering**: Compromised keys can allow attackers to tamper with encrypted data, leading to data integrity issues. +- **Loss of Confidentiality**: Sensitive information can be exposed, resulting in a loss of confidentiality. Once keys are exposed, all data encrypted with those keys is at risk. + +## Modes of Introduction + +- **Insecure Storage Locations**: Storing cryptographic keys in unencrypted SharedPreferences, unprotected files, or other insecure locations. +- **Hardcoded Keys**: Including cryptographic keys directly in the application code, making them susceptible to extraction through decompilation and reverse-engineering. +- **Lack of Encryption**: Exporting cryptographic keys in plain text without encrypting them using a secure method. + +## Mitigations + +- **Use Platform Keystores**: Where possible, generate cryptographic keys dynamically on the device, rather than using predefined keys, and ensure that they are securely stored after creation. For this you can use the platform-specific keystores, such as the [Android KeyStore](https://developer.android.com/training/articles/keystore) or [iOS KeyChain](https://developer.apple.com/documentation/security/keychain_services). +- **Implement Strongest Hardware Security Solutions**: For the most critical cases and whenever [available and compatible](https://developer.android.com/privacy-and-security/keystore#HardwareSecurityModule) for the use case at hand, leverage the strongest hardware-backed security options such as [Android StrongBox](https://source.android.com/docs/security/features/keystore/strongbox) or iOS's Secure Enclave [`kSecAttrTokenIDSecureEnclave`](https://developer.apple.com/documentation/security/ksecattrtokenidsecureenclave) option to ensure the highest protection including physical and side-channel attacks. +- **Use Cryptographic Key Management Systems**: Securely retrieve keys from server-side services that provide secure storage, access control, and auditing for sensitive data. For example, AWS Secrets Manager, Azure Key Vault, or Google Cloud Secret Manager are some popular managed secrets storage solutions. The app can securely retrieve the necessary secrets at runtime through secure, authenticated API calls. +- **Encrypt and Wrap Keys**: Whenever storing keys in platform keystores is not suitable for the use case or keys need to be exported, use envelope encryption (DEK+KEK) and key wrapping techniques as specified in [NIST.SP.800-175Br1 5.3.5](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-175Br1.pdf) to protect cryptographic keys before storing them. +- **Follow Standard Key Management Best Practices**: Implement proper key management practices, including key rotation and robust protection mechanisms for keys in storage as outlined in [NIST.SP.800-57pt1r5 6.2.2](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf), ensuring availability, integrity, confidentiality, and proper association with usage, entities, and related information. diff --git a/weaknesses/MASVS-STORAGE/MASWE-0005.md b/weaknesses/MASVS-STORAGE/MASWE-0005.md index a546f56663..912926000a 100644 --- a/weaknesses/MASVS-STORAGE/MASWE-0005.md +++ b/weaknesses/MASVS-STORAGE/MASWE-0005.md @@ -1,33 +1,35 @@ --- -title: Sensitive Data Hardcoded in the App Package +title: API Keys Hardcoded in the App Package id: MASWE-0005 -alias: data-hardcoded-app-package +alias: api-keys-hardcoded-app-package platform: [android, ios] profiles: [L1, L2] mappings: - masvs-v2: [MASVS-STORAGE-1] + masvs-v2: [MASVS-AUTH-1] mastg-v1: [] - cwe: [259, 321, 798] - android: https://developer.android.com/privacy-and-security/risks/hardcoded-cryptographic-secrets + cwe: [798] + android: https://developer.android.com/privacy-and-security/risks/insecure-api-usage status: new +refs: +- https://cloud.google.com/docs/authentication/api-keys#securing +- https://cloud.google.com/docs/authentication/api-keys#api_key_restrictions --- ## Overview -Sensitive data, including cryptographic keys and authentication material, hardcoded in the app package, source code, or compiled binaries, poses significant security risks, as attackers can easily extract this data through reverse engineering. +API keys hardcoded in the app package, source code, or compiled binaries, can be easily extracted through reverse engineering. ## Impact -Hardcoding sensitive information in the app can lead to a variety of security issues, including but not limited to: +Hardcoding API keys in the app can lead to a variety of security issues, including but not limited to: -- **Unauthorized Data Access**: The use of hardcoded credentials can lead to attackers impersonating legitimate users. This breach directly threatens user privacy by allowing unauthorized access to personal areas and accounts within the app, violating user trust. -- **Bypass Protection Mechanism**: Hardcoded data can facilitate bypassing app protection mechanisms. Attackers might exploit this to access restricted content, cheat in app functionalities, or unlock features intended for purchase, impacting both revenue and user experience. -- **Cryptographic Key Compromise**: Hardcoded cryptographic keys can result in the decryption of sensitive data intended to be securely transmitted or stored. This not only violates the confidentiality of the data, but also potentially exposes it to manipulation or theft. -- **Compromise of System Integrity and Business Operations**: Extracting hardcoded data, such as API keys, from the app can give attackers unauthorized access to sensitive resources and services. This directly impacts developers and enterprises by compromising app integrity, privacy, and service continuity - potentially leading to disruptions such as Denial of Service (DoS). Such breaches can significantly erode user confidence and have a detrimental effect on business reputation and operations. +- **Financial Loss**: Attackers can exploit the compromised hardcoded API keys to make unauthorized API calls and abuse services that are billed on a per-use basis (e.g., AI or ML API services), resulting in unexpected charges to the app owner. +- **Compromise of System Integrity and Business Operations**: Extracted API keys can give attackers unauthorized access to sensitive resources and services. This directly impacts developers and enterprises by compromising app integrity, privacy, and service continuity - potentially leading to disruptions such as Denial of Service (DoS) or service suspension due to policy violations. Such incidents can significantly impact the user experience, erode user trust, and negatively impact business reputation and operations. +- **Bypass Protection Mechanism**: Hardcoded API keys can make it easier to bypass app protection mechanisms. Attackers can use this to access restricted content, cheat in app functionality, or unlock features that are intended for purchase, impacting both revenue and user experience. ## Modes of Introduction -Sensitive data can be hardcoded in several areas: +API keys can be hardcoded in several areas: - **App Source Code**: directly embedded in the app source code. - **App Assets**: included in files that are destined for the final deliverable app package (typically APK/IPA), such as configuration files, manifest files, and resource files. @@ -35,12 +37,10 @@ Sensitive data can be hardcoded in several areas: ## Mitigations -To mitigate the risks associated with hardcoded sensitive data, developers should: - -- Use platform specific solutions to encrypt sensitive data, such as Android Keystore or iOS Keychain, before storing them locally. -- Implement proper key management practices, including key rotation and using environment-specific keys. -- Avoid storing sensitive data within the app package or source code, and instead securely retrieve it from server-side services that provide secure storage, access control, and auditing for sensitive data. For example, AWS Secrets Manager, Azure Key Vault, or Google Cloud Secret Manager are some popular managed secrets storage solutions. The app can securely retrieve the necessary secrets at runtime through secure, authenticated API calls. -- Where possible, generate cryptographic keys dynamically on the device, rather than using predefined keys, and ensure that they don't leave the platform-provided keystore. This approach reduces the risk associated with key transmission and storage. -- If data must be hardcoded, such as some API keys, be sure to configure them with the minimum required permissions to reduce the impact in case of exposure. Many services allow you to create keys with restricted access, which limits the operations that can be performed. +- Use a stateful API service that provides secure authentication, client validation, and session controls. Implement dynamic tokens that expire after a reasonably short time (e.g., 1 hour). This can help reduce the impact of key exposure. Also, ensure proper error handling and logging to detect and respond to unauthorized access attempts. Consider using OAuth 2.0 and security libraries like AppAuth to simplify secure OAuth flows. +- If a stateful API service is not viable, consider using a stateless API service with a middleware solution (sometimes known as API proxy or API Gateway). This involves proxying requests between the app and API endpoint. Use JSON Web Tokens (JWT) and JSON Web Signature (JWS) to store the vulnerable static key server-side rather than in the application (client). Implement secure key management practices and consider using a cloud key management service. +- If API keys must be hardcoded, be sure to configure them with the minimum required permissions to reduce the impact in case of exposure. Many services allow you to create keys with restricted access, which limits the operations that can be performed. +- Consider using a [Key Management Service](https://cloud.google.com/kms/docs/key-management-service) to get API keys on runtime after validating app integrity. - Regularly audit the codebase and dependencies for hardcoded sensitive data (e.g. using tools such as [gitLeaks](https://github.com/gitleaks/gitleaks)). -- While not foolproof, and **to be used as a last resort** when no other secure options are available, code and resource obfuscation and encryption can deter attackers by making it more difficult to analyze your app and discover hard-coded secrets. +- Use white-box cryptography techniques to encrypt API keys and sensitive data within the app, ensuring that the cryptographic algorithms and keys remain protected even if the app is reverse-engineered. +- While not foolproof, and **to be used as a last resort** when no other secure options are available, code and resource obfuscation and encryption can deter attackers by making it more difficult to analyze your app and discover hardcoded secrets. Avoid custom implementations and use well-established solutions such as RASP (Runtime Application Self-Protection) which can ensure that the API keys are only fully assembled in memory when necessary, keeping them obfuscated or split across different components otherwise. RASP can also dynamically retrieve and manage keys securely at runtime by integrating with secure key management solutions.