/
← Voltar ao feed
low

Hakai Security releases Beerus Framework for iOS, an on-device pentesting toolkit built on Frida and Palera1n

1 fonte(s) · 1 atualização(ões) · publicado 18/09/2026 10:49 · coletado há 1 dia

Hakai Security has released the Beerus Framework for iOS, following the v1.1 Android release in July. It is a defensive-side, offensive-security testing tool, not a threat campaign. It runs on jailbroken iOS devices and is built on Frida and Palera1n. It offers a single GUI for dynamic instrumentation, IPA extraction, memory dumping, proxy configuration, LLDB debugging and a root terminal. The post credits Daniel Franca Lima, Daniel "Daniboy" Lima, Gabriel "Texugo" Rodrigues and Kelvin Montini. It has no direct threat impact on defenders, though the tooling is dual-use.

Technical Details

  • Architecture: a sandboxed app delegates privileged actions to a root daemon, beerusd, over the UNIX socket /var/run/beerus.sock. The daemon is started by launchd. Before serving a command it validates the client PID via LOCAL_PEERPID, the executable path and the CDHash.
  • Frida Setup: downloads, installs and starts frida-server, offering the 10 most recent versions. It handles the .deb install and launchctl bootstrap/bootout. Readiness is checked on 127.0.0.1:27042.
  • Script Editor / Auto Inject: uses Frida Swift to attach to a target PID and run scripts on-device.
  • IPA Extractor: dumps the decrypted executable from memory, removing FairPlay DRM protection, and rebuilds the IPA for static analysis.
  • Memory Dump: dumps process memory into a compressed archive.
  • LLDB Server: launches debugserver attached to a chosen PID and listening on 0.0.0.0:1234.
  • Proxy Profiles: the daemon rewrites the system network preferences.plist to enable or disable HTTP/HTTPS proxies.
  • Terminal: runs arbitrary shell commands as root through the daemon.

Remediation

No remediation applies. Defenders and app owners should be aware that tools like this lower the effort for runtime instrumentation, decryption and memory inspection of iOS apps on jailbroken devices. Consider jailbreak and Frida detection and runtime-integrity controls.

Linha do tempo

  1. yokai.hakaisecurity.io ↗ · pub. 18/09/2026 10:49 · coletado 19/10 18:03 primeiro registro

    Hakai Security releases Beerus Framework for iOS, an on-device pentesting toolkit built on Frida and Palera1n

    ler a análise desta fonte

    Hakai Security has released the Beerus Framework for iOS, following the v1.1 Android release in July. It is a defensive-side, offensive-security testing tool, not a threat campaign. It runs on jailbroken iOS devices and is built on Frida and Palera1n. It offers a single GUI for dynamic instrumentation, IPA extraction, memory dumping, proxy configuration, LLDB debugging and a root terminal. The post credits Daniel Franca Lima, Daniel "Daniboy" Lima, Gabriel "Texugo" Rodrigues and Kelvin Montini. It has no direct threat impact on defenders, though the tooling is dual-use.

    Technical Details

    • Architecture: a sandboxed app delegates privileged actions to a root daemon, beerusd, over the UNIX socket /var/run/beerus.sock. The daemon is started by launchd. Before serving a command it validates the client PID via LOCAL_PEERPID, the executable path and the CDHash.
    • Frida Setup: downloads, installs and starts frida-server, offering the 10 most recent versions. It handles the .deb install and launchctl bootstrap/bootout. Readiness is checked on 127.0.0.1:27042.
    • Script Editor / Auto Inject: uses Frida Swift to attach to a target PID and run scripts on-device.
    • IPA Extractor: dumps the decrypted executable from memory, removing FairPlay DRM protection, and rebuilds the IPA for static analysis.
    • Memory Dump: dumps process memory into a compressed archive.
    • LLDB Server: launches debugserver attached to a chosen PID and listening on 0.0.0.0:1234.
    • Proxy Profiles: the daemon rewrites the system network preferences.plist to enable or disable HTTP/HTTPS proxies.
    • Terminal: runs arbitrary shell commands as root through the daemon.

    Remediation

    No remediation applies. Defenders and app owners should be aware that tools like this lower the effort for runtime instrumentation, decryption and memory inspection of iOS apps on jailbroken devices. Consider jailbreak and Frida detection and runtime-integrity controls.