Sandbox operations are extracted either from kernel extension (for iOS 4-11) or from kernel cache (for iOS 12). Sandbox profiles are extracted from the kernel sandbox extension (as a bundle for iOS 4 and 9-11) or from kernel cache (as a bundle for iOS 12) or from the sandboxd file in the iOS filesystem (for iOS 5-8). Sandbox operations and sandbox profiles are extracted using the helpers/extract_sandbox_data.py script. In order to use SandBlaster you need access to the binary sandbox profiles and the sandbox operations, a set of strings that define sandbox-specific actions. More information about how to compile it can be found on the wiki page. If the installation of lief fails you need compile to it. SandBlaster requires Python2 for the reverser (in reverse-sandbox/), Python3 with lief library for helper script (in helpers/).Īfter cloning the SandBlaster repository, you have to install lief for Python3: Check the iExtractor documentation for information. SandBlaster may be installed and run standalone, though we recommend installing and running it from within iExtractor. The reverser (in the reverse-sandbox/ folder) and the helper tool (in the helpers/ folder) run on any Python running platform.

SandBlaster relied on previous work by Dionysus Blazakis and Stefan Esser's code and slides. The technical report SandBlaster: Reversing the Apple Sandbox presents extensive (though a bit outdated) information on SandBlaster internals. SandBlaster works on iOS from version 7 onwards including iOS 11. SandBlaster is, to our knowledge, the first tool that reverses binary sandbox profiles to their original SBPL format. Primarily used on iOS, sandbox profiles are present on macOS as well. Apple sandbox profiles are written in SBPL ( Sandbox Profile Language), a Scheme-like language, and are then compiled into an undocumented binary format and shipped.

SandBlaster is a tool for reversing (decompiling) binary Apple sandbox profiles.

Apple sandbox coding