codesigning issue with free developer account #113

leonjza · 2020-10-16T04:39:53Z

Hey, I'm hoping I am just being dumb here, but it seems like signing using free developer accounts may be broken at the moment? Using DVIA as an example app, I get error code 0xe8008001 when trying to install a resigned app. I am not really sure why.

To reproduce

Using a mobileprovision generated using a blank app deployed to an iPhone, I would first run applesign:

applesign -a DVIA-v2-swift.ipa -m /Users/.../embedded.mobileprovision -i ...319

Next, I would deploy the resultant IPA to the device which bails with the aforementioned error:

ios-deploy -b DVIA-v2-swift-resigned.ipa
...
2020-10-16 06:34:36.019 ios-deploy[27277:3460674] [ !! ] Error 0xe8008001: An unknown error has occurred. AMDeviceSecureInstallApplication(0, device, url, options, install_callback, 0)

Device logs have these:

0x16f017000 +[MICodeSigningVerifier _validateSignatureAndCopyInfoForURL:withOptions:error:]: 77: Failed to verify code signature of /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.ThMpQm/extracted/Payload/DVIA-v2.app : 0xe8008001 (An unknown error has occurred.)

0x16f3d3000 handle_install: Installation failed: Error Domain=MIInstallerErrorDomain Code=13 "Failed to verify code signature of /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.ThMpQm/extracted/Payload/DVIA-v2.app : 0xe8008001 (An unknown error has occurred.)" UserInfo={LibMISErrorNumber=-402620415, LegacyErrorString=ApplicationVerificationFailed, SourceFileLine=77, FunctionName=+[MICodeSigningVerifier _validateSignatureAndCopyInfoForURL:withOptions:error:], NSLocalizedDescription=Failed to verify code signature of /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.ThMpQm/extracted/Payload/DVIA-v2.app : 0xe8008001 (An unknown error has occurred.)}

The text was updated successfully, but these errors were encountered:

trufae · 2020-10-16T10:24:41Z

Try using -c

leonjza · 2020-10-16T10:29:32Z

With -c I am getting the same error in ios-deploy.

2020-10-16 12:28:56.875 ios-deploy[30292:3661681] [ !! ] Error 0xe8008001: An unknown error has occurred. AMDeviceSecureInstallApplication(0, device, url, options, install_callback, 0)

trufae · 2020-10-16T10:36:54Z

Drop the -a, its no longer needed

leonjza · 2020-10-16T10:44:09Z

Thanks for the responses. Still seems the same.

applesign DVIA-v2-swift.ipa -m /.../embedded.mobileprovision -i ...19

ios-deploy -b DVIA-v2-swift-resigned.ipa
...
2020-10-16 12:41:16.898 ios-deploy[30484:3668512] [ !! ] Error 0xe8008001: An unknown error has occurred. AMDeviceSecureInstallApplication(0, device, url, options, install_callback, 0)

For completions sake from Console.app

0x16f347000 handle_install: Installation failed: Error Domain=MIInstallerErrorDomain Code=13 "Failed to verify code signature of /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.SVEC5j/extracted/Payload/DVIA-v2.app : 0xe8008001 (An unknown error has occurred.)" UserInfo={LibMISErrorNumber=-402620415, LegacyErrorString=ApplicationVerificationFailed, SourceFileLine=77, FunctionName=+[MICodeSigningVerifier _validateSignatureAndCopyInfoForURL:withOptions:error:], NSLocalizedDescription=Failed to verify code signature of /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.SVEC5j/extracted/Payload/DVIA-v2.app : 0xe8008001 (An unknown error has occurred.)}

rustymagnet3000 · 2020-11-16T13:35:06Z

Hey @leonjza, did you get it working?

I wrote up some ways to fix ios-deploy errors here.

https://gist.github.com/rustymagnet3000/605c333519cd265c7eac9d556f46dc75

Hope it helps. I spent a long time getting unknown error with ios-deploy when I had my device proxying via Burp. I forgot that Apple's "Trust the Developer Profile and App" won't work when proxied [ as it has it's own cert pinning ].

leonjza · 2020-11-17T13:57:25Z

Hey @leonjza, did you get it working?

I did not with applesign, but using this tool I was able to get the signing to work: https://github.com/DanTheMan827/ios-app-signer

xfoxfu · 2021-02-12T11:44:08Z

I am experiencing similar issue, and found out that adding -c to preserve entitlements works.

trufae · 2021-02-13T01:27:00Z

@leonjza can you confirm the issue is gone?

leonjza · 2021-02-15T11:43:23Z

@trufae I have to test this myself still, but have heard of some folks still experiencing this. Will feedback with my own results soonest.

Manouchehri · 2021-02-24T17:24:28Z

Stolen advice from @Siguza, check what you're allowed to sign with first:

openssl smime -verify -noverify -inform der -in yourthing.mobileprovision

leonjza · 2021-03-02T11:51:42Z

@leonjza can you confirm the issue is gone?

Just tested this again, same issue. ios-app-signer however still works.

dki · 2021-03-03T23:47:07Z

I'm able to reproduce this - will try to get a PR in to fix it tomorrow.

dki · 2021-03-04T14:48:37Z

@leonjza When you have a chance, can you try signing with -b and the bundle ID in your mobile provision file to see if you get different results? Something like this:

$ applesign -b com.janethepirate.JaneProvisionApp -m embedded.mobileprovision -c -a iGoat-Swift.ipa

leonjza · 2021-03-04T15:07:36Z

@dki hah! That worked!

$ applesign -b za.sensepost.ipewpew DVIA-v2-swift.ipa -m embedded.mobileprovision -i <ident> -c

dki · 2021-03-04T16:49:47Z

@leonjza I think there must be different restrictions on free accounts vs. paid that enforce the bundle ID matching between the provisioning file and the ipa. In any case, glad we found a solution! Thanks for reporting it!

leonjza · 2021-03-04T16:55:06Z

Yeah I also suspect free accounts are to blame here. I'll update the use case in objection to extract the bundle identifier from the mobile provision and set that, regardless of account type for now.

Appreciate you looking into this @dki :D

dki · 2021-03-04T17:02:07Z

Happy to help @leonjza! I updated the wiki page as well (https://github.com/nowsecure/node-applesign/wiki/Setting-up-your-resigning-environment#re-signing) to be a bit more explicit about what options work with free accounts too. Feel free to point folks there if you hear of similar issues!

For free accounts, the bundleid needs to be set. (see: nowsecure/node-applesign#113). A hecky fix to shell out and grep that out of the mobile provision is added. It can also be manually set to something else with the `--bundle-id` flags. Fixes #434

rcM0D · 2021-07-30T09:40:27Z

Hi @dki , I've experienced an error while installing the application after I signed it.

applesign -m embedded.mobileprovision -i F65C7C7C47767CE97C0FFEFC351726AED5BFB7B0 -I frida-gadget-12.9.7-ios-universal.dylib -c -a Sample.ipa

then when I try to install it using ideviceinstaller. This is the error:
Install: VerifyingApplication (40%)ERROR: Install failed. Got error "ApplicationVerificationFailed" with code 0xe8008001: Failed to verify code signature of /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.BtoW52/extracted/Payload/Sample.app : 0xe8008001 (An unknown error has occurred.)

But when I tried to use IOS App SIgner and tried to patch it again with applesign to inject Frida it worked.

I'm using a Free Developer Account.

Any help will do!
Thank you

dki · 2021-08-04T19:09:00Z

@kaleb-g What happens if you try signing with the -b flag?

applesign -m embedded.mobileprovision -b [bundle identifier] -i F65C7C7C47767CE97C0FFEFC351726AED5BFB7B0 -I frida-gadget-12.9.7-ios-universal.dylib -c -a Sample.ipa

rcM0D · 2021-08-04T19:58:18Z

applesign -m embedded.mobileprovision -b [bundle identifier] -i F65C7C7C47767CE97C0FFEFC351726AED5BFB7B0 -I frida-gadget-12.9.7-ios-universal.dylib -c -a Sample.ipa

Hi @dki Different errors occur still when installing the resigned IPA.

"Install: PreflightingApplication (30%)ERROR: Install failed. Got error "AppexBundleIDNotPrefixed" with code 0x00000000: Appex bundle at "/var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.xMsKhk/extracted/Payload/Sample.app/PlugIns/OneSignalNotificationServiceExtension.appex" with identifier "com.sample.OneSignalNotificationServiceExtension" does not have expected identifier prefix "com.PT.sample-."

dki · 2021-08-05T16:35:09Z

@kaleb-g I'm going to move discussion to the new issue you opened.

fuomag9 mentioned this issue Dec 20, 2020

Cannot install the generated ipa file (free apple account) sensepost/objection#434

Closed

dki mentioned this issue Mar 4, 2021

Fix for empty entitlements and delete keychain-access-groups when not cloned #119

Merged

leonjza closed this as completed Apr 6, 2021

leonjza mentioned this issue May 17, 2021

[bug] Resign App changes to the provision file BID sensepost/objection#461

Closed

dki mentioned this issue Aug 5, 2021

Failed to Install after signing the application #128

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

codesigning issue with free developer account #113

codesigning issue with free developer account #113

leonjza commented Oct 16, 2020

trufae commented Oct 16, 2020

leonjza commented Oct 16, 2020

trufae commented Oct 16, 2020

leonjza commented Oct 16, 2020

rustymagnet3000 commented Nov 16, 2020

leonjza commented Nov 17, 2020

xfoxfu commented Feb 12, 2021

trufae commented Feb 13, 2021

leonjza commented Feb 15, 2021

Manouchehri commented Feb 24, 2021

leonjza commented Mar 2, 2021

dki commented Mar 3, 2021

dki commented Mar 4, 2021

leonjza commented Mar 4, 2021

dki commented Mar 4, 2021

leonjza commented Mar 4, 2021

dki commented Mar 4, 2021

rcM0D commented Jul 30, 2021 •

edited

Loading

dki commented Aug 4, 2021

rcM0D commented Aug 4, 2021 •

edited

Loading

dki commented Aug 5, 2021

codesigning issue with free developer account #113

codesigning issue with free developer account #113

Comments

leonjza commented Oct 16, 2020

To reproduce

trufae commented Oct 16, 2020

leonjza commented Oct 16, 2020

trufae commented Oct 16, 2020

leonjza commented Oct 16, 2020

rustymagnet3000 commented Nov 16, 2020

leonjza commented Nov 17, 2020

xfoxfu commented Feb 12, 2021

trufae commented Feb 13, 2021

leonjza commented Feb 15, 2021

Manouchehri commented Feb 24, 2021

leonjza commented Mar 2, 2021

dki commented Mar 3, 2021

dki commented Mar 4, 2021

leonjza commented Mar 4, 2021

dki commented Mar 4, 2021

leonjza commented Mar 4, 2021

dki commented Mar 4, 2021

rcM0D commented Jul 30, 2021 • edited Loading

dki commented Aug 4, 2021

rcM0D commented Aug 4, 2021 • edited Loading

dki commented Aug 5, 2021

rcM0D commented Jul 30, 2021 •

edited

Loading

rcM0D commented Aug 4, 2021 •

edited

Loading