Can't find mono runtime

[alexdetrano]

I'm trying to hook a Xamarin-based iOS app and am getting the following error:

~/t/s/s/f/fridax > ./fridax.js inject --device usb --scripts scripts/aot_modify_class_function_argument.js
[*] Awaiting storage initialization.
[*] Awaiting USB device.
[*] Up and running on iPhone.
? Which application do you want to inject? XXXXX
[*] Happy hacking.
[*] Attached to application (session: 74911).
[*] Injected a test script (this runs from within the injected application)!
Error: Can't find Mono runtime!
    at <anonymous> (vendors/frida-mono-api/mono-module.js:33)
    at call (native)
    at o (node_modules/browser-pack/_prelude.js:1)
    at <anonymous> (node_modules/browser-pack/_prelude.js:1)
    at <anonymous> (vendors/frida-mono-api/mono-api.js:2)
    at call (native)
    at o (node_modules/browser-pack/_prelude.js:1)
    at <anonymous> (node_modules/browser-pack/_prelude.js:1)
    at <anonymous> (vendors/frida-mono-api/index.js:1)
    at call (native)
    at o (node_modules/browser-pack/_prelude.js:1)
    at <anonymous> (node_modules/browser-pack/_prelude.js:1)
    at <anonymous> (scripts/aot_modify_class_function_argument.js:1)
    at call (native)
    at o (node_modules/browser-pack/_prelude.js:1)
    at r (node_modules/browser-pack/_prelude.js:1)
    at <eval> (/script2.js:1246)

I've looked at #1 and the issue was fixed but I'm still having the issue. I've tried poking around but am just getting started with frida. Things I've tried:

• looking for mono using Process.enumerateModulesSync()
• looking for mono using Process.enumerateExports()
• hooking dlopen and looking for any import of mono

but nothing shows up. Is there anything else I can do to troubleshoot the issue? Sadly I can't share the ipa.

[omareltf]

I have the same problem on iOS with a different file.

I have executed grep on the Application folder and this is the result:

grep -ir "mono"
Binary file System.aotdata.arm64 matches
Binary file Seling.Mobile.dll matches
CodeSignature/CodeResources: Mono.Security.aotdata.arm64
_CodeSignature/CodeResources: Mono.Security.dll
_CodeSignature/CodeResources: Mono.Security.aotdata.arm64
_CodeSignature/CodeResources: Mono.Security.dll

Binary file APPNAME.iOS matches
Binary file Mono.Security.aotdata.arm64 matches
Binary file zxing.portable.dll matches
Binary file System.Core.dll matches
Binary file mscorlib.dll matches
Binary file Xamarin.iOS.dll matches
Binary file Xamarin.Forms.Platform.iOS.dll matches
Binary file Mono.Security.dll matches
Binary file SQLitePCLRaw.provider.sqlite3.dll matches
Binary file Firebase.Core.dll matches
Binary file System.Net.Http.dll matches
Binary file APPNAME.iOS.exe matches
Binary file System.dll matches

Furthermore:

grep -ir "mono_thread_attach"
Binary file APPNAME.iOS matches

[sammyjeng]

Hey @alexdetrano and @omareltf,

The above mentioned issue arises because, the Xamarin apps are compiled Ahead of Time in case of iOS and they work just like any other native app with ObjC runtime. There is no Mono runtime to begin with, hence you won't be able to find mono module/mono exports/mono runtime using Fridax.

I am pretty sure that is the case, because following this hunch has yielded results. But If someone has successfully used Fridax to hook into iOS applications and has found mono-module (very unlikely), I would love to know how they did it and get the full picture of what's going on.

What one can do to hook into Xamarin apps on iOS?

• Hook into ObjC classes and methods using Objection or Frida scripts and it should work just fine.

References:

1. https://www.c-sharpcorner.com/article/how-xamarin-works-on-different-platforms/
2. https://learn.microsoft.com/en-us/xamarin/ios/internals/architecture
3. https://www.mono-project.com/docs/advanced/embedding/

Update:

• It seems that you can't find the mono module/runtime if the build was compiled without theDEBUG flag.
• Fridax will work fine on debug builds where you'll be able to find the mono module.
• If the app is compiled using these conditional symbols, Fridax is useful __IOS__;__MOBILE__;__UNIFIED__;DEBUG
• if the above mentioned DEBUG flag is missing in the compiler flags then the alternative way is to hook into ObjC classes and methods. For both the cases, hooking into ObjC runtime works totally fine.