demo_app_enumeration.sh

#!/bin/bash

# DEMO: How To Find Evidence of App Enumeration in a Binary
# Educational tool to detect if an app is spying on you

BINARY="${1:?Usage: $0 <path-to-binary>}"

echo "=============================================================================="
echo "DEMO: Detecting App Enumeration in iOS Binaries"
echo "=============================================================================="
echo ""
echo "Analyzing: $BINARY"
echo ""
echo ""

# Check if binary exists
if [ ! -f "$BINARY" ]; then
    echo "❌ Binary not found: $BINARY"
    exit 1
fi

echo "STEP 1: Extract All Bundle IDs From Binary"
echo "=============================================================================="
echo ""
echo "Command: strings \$BINARY | grep -E '^com\.[a-z0-9]+\.' | sort | uniq"
echo ""

bundle_ids=$(strings "$BINARY" 2>/dev/null | grep -E '^com\.[a-z0-9]+\.' | sort | uniq)

if [ -z "$bundle_ids" ]; then
    echo "❌ No bundle IDs found"
else
    echo "✅ Found bundle IDs:"
    echo "$bundle_ids" | head -30
    count=$(echo "$bundle_ids" | wc -l)
    if [ $count -gt 30 ]; then
        echo "... and $((count - 30)) more"
    fi
fi

echo ""
echo ""
echo "STEP 2: Check For Competitor Apps"
echo "=============================================================================="
echo ""

competitors=("com.vietcombank" "com.paypal" "com.coinbase" "com.kraken" "com.fxstreet")

echo "Looking for competitor apps in binary..."
echo ""

for competitor in "${competitors[@]}"; do
    if echo "$bundle_ids" | grep -q "$competitor"; then
        echo "⚠️  FOUND: $competitor"
    fi
done

echo ""
echo ""
echo "STEP 3: Check For Risk Indicators"
echo "=============================================================================="
echo ""

risk_strings=(
    "jailbreak"
    "VPN"
    "Frida"
    "VirtualDevice"
    "Simulator"
    "debugger"
)

echo "Searching for jailbreak/security detection strings..."
echo ""

found_any=0
for risk_str in "${risk_strings[@]}"; do
    count=$(strings "$BINARY" 2>/dev/null | grep -i "$risk_str" | wc -l)
    if [ $count -gt 0 ]; then
        echo "⚠️  Found '$risk_str' ($count occurrences)"
        found_any=1
    fi
done

if [ $found_any -eq 0 ]; then
    echo "✅ No obvious jailbreak detection found"
fi

echo ""
echo ""
echo "STEP 4: Check For Private API Calls"
echo "=============================================================================="
echo ""

private_apis=(
    "SBSLaunchApplicationWithIdentifier"
    "_machineModel"
    "_deviceIdentifierForVendor"
    "dlopen.*PrivateFrameworks"
)

echo "Searching for private API usage..."
echo ""

found_private=0
for api in "${private_apis[@]}"; do
    count=$(strings "$BINARY" 2>/dev/null | grep -c "$api" 2>/dev/null || echo 0)
    if [ $count -gt 0 ]; then
        echo "⚠️  Found '$api' ($count occurrences)"
        found_private=1
    fi
done

if [ $found_private -eq 0 ]; then
    echo "✅ No obvious private API strings found"
    echo "   (May be obfuscated with XOR/Base64)"
fi

echo ""
echo ""
echo "STEP 5: Check For Obfuscation Patterns"
echo "=============================================================================="
echo ""

echo "Searching for potential obfuscation..."
echo ""

# Look for long hex strings (XOR encrypted)
hex_strings=$(strings "$BINARY" 2>/dev/null | grep -E '^[0-9a-f]{40,}$' | wc -l)
if [ $hex_strings -gt 10 ]; then
    echo "⚠️  Found $hex_strings long hex strings (possible XOR encryption)"
fi

# Look for base64
base64_strings=$(strings "$BINARY" 2>/dev/null | grep -E '^[A-Za-z0-9+/]{50,}={0,2}$' | wc -l)
if [ $base64_strings -gt 10 ]; then
    echo "⚠️  Found $base64_strings long base64 strings (possible encoding)"
fi

echo ""
echo ""
echo "STEP 6: Summary Report"
echo "=============================================================================="
echo ""

total_bundles=$(echo "$bundle_ids" | wc -l)
echo "📊 Statistics:"
echo "   • Total unique bundle IDs found: $total_bundles"
echo "   • Competitor apps detected: $found_any"
echo "   • Private API usage: $found_private"
echo "   • Suspicious bundle ID count: $([ $total_bundles -gt 20 ] && echo "YES (>20)" || echo "NO (<20)")"
echo ""

# Calculate risk score
risk_score=0

if [ $total_bundles -gt 20 ]; then
    risk_score=$((risk_score + 25))
fi

if [ $found_private -eq 1 ]; then
    risk_score=$((risk_score + 40))
fi

if [ $found_any -eq 1 ]; then
    risk_score=$((risk_score + 25))
fi

if [ $hex_strings -gt 10 ] || [ $base64_strings -gt 10 ]; then
    risk_score=$((risk_score + 10))
fi

echo "🎯 Risk Assessment:"
if [ $risk_score -eq 0 ]; then
    echo "   Risk Level: ✅ LOW (${risk_score}%)"
    echo "   Verdict: No obvious private API usage detected"
elif [ $risk_score -lt 40 ]; then
    echo "   Risk Level: 🟡 MEDIUM (${risk_score}%)"
    echo "   Verdict: Some suspicious patterns detected"
else
    echo "   Risk Level: 🔴 HIGH (${risk_score}%)"
    echo "   Verdict: STRONG EVIDENCE of private API spying!"
fi

echo ""
echo ""
echo "=============================================================================="
echo "HOW TO USE THIS INFORMATION"
echo "=============================================================================="
echo ""
echo "1. For Learning:"
echo "   This shows techniques apps use to spy on other apps installed on your phone"
echo ""
echo "2. For Defense:"
echo "   Use this tool to check if YOUR apps are being monitored"
echo ""
echo "3. For Interview:"
echo "   Reference real-world examples (BIDV, Agribank) that use these techniques"
echo ""
echo ""