Extracting Entitlements from Compiled Application

The procedures below preserve the original binary-carving approach from OWASP MASTG. Start with codesign, which asks the code-signing blob for its entitlements directly, then use carving when the signature is unavailable or malformed.^[1][2]

codesign -d --entitlements :- "Payload/Target.app" 2>/dev/null
security cms -D -i "Payload/Target.app/embedded.mobileprovision"

Extracting Entitlements and Mobile Provision Files

An IPA or installed app may not contain a standalone .entitlements file. Effective signed entitlements are embedded in the Mach-O code signature, while embedded.mobileprovision—when present—contains the provisioning profile and its permitted entitlement set. These are related but not guaranteed to be identical.

Even with encrypted binaries, certain steps can be employed to extract these files. Should these steps fail, tools such as Clutch (if compatible with the iOS version), frida-ios-dump, or similar utilities may be required to decrypt and extract the app.

Extracting the Entitlements Plist from the App Binary

With the app binary accessible on a computer, binwalk can be utilized to extract all XML files. The command below demonstrates how to do so:

$ binwalk -e -y=xml ./Telegram\ X

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
1430180       0x15D2A4        XML document, version: "1.0"
1458814       0x16427E        XML document, version: "1.0"

Alternatively, radare2 can be used to quietly run a command and exit, searching for all strings in the app binary that contain “PropertyList”:

$ r2 -qc 'izz~PropertyList' ./Telegram\ X

0x0015d2a4 ascii <?xml version="1.0" encoding="UTF-8" standalone="yes"?>...
0x0016427d ascii H<?xml version="1.0" encoding="UTF-8"?>...

Both Binwalk and radare2 can locate embedded property-list text. In this Telegram example, the first XML object at 0x0015d2a4 corresponds to the project’s entitlement file.^[3]

For app binaries accessed on jailbroken devices (e.g., via SSH), the grep command with the -a, --text flag can be used to treat all files as ASCII text:

$ grep -a -A 5 'PropertyList' /var/containers/Bundle/Application/...

Adjusting the -A num, --after-context=num flag allows for the display of more or fewer lines. This method is viable even for encrypted app binaries and has been verified against multiple App Store apps. Tools mentioned earlier may also be employed on jailbroken iOS devices for similar purposes.

[!NOTE] Plain strings may miss or truncate relevant data. Prefer code-signing tools, or use grep -a, radare2 (izz), and rabin2 (-zz) when carving is necessary.