WIP: do a spike for ios testing

Author: pimterry

.github/workflows/ios-gadget-spike.yml

@@ -0,0 +1,187 @@
+name: iOS gadget spike
+
+# A spike, not a test suite: this answers one question, which is whether Frida's gadget can load
+# our scripts into an app running in the iOS simulator, with no jailbreak and no app changes. If
+# it can, automated iOS testing is worth building on top of it. If it can't, nothing else matters.
+#
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - '.github/workflows/ios-gadget-spike.yml'
+      - 'ios/**'
+      - 'config.js'
+      - 'native-*.js'
+
+env:
+  FRIDA_VERSION: 17.16.4
+  APP_REPO: httptoolkit/ios-ssl-pinning-demo
+  APP_TARGET: ios-pinning-demo
+  BUNDLE_ID: com.httptoolkit.ios-pinning-demo
+
+jobs:
+  gadget-spike:
+    name: Load our scripts via Frida gadget in the simulator
+    runs-on: macos-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Check out the demo app
+        uses: actions/checkout@v7
+        with:
+          repository: httptoolkit/ios-ssl-pinning-demo
+          path: demo-app
+
+      - name: Build the demo app for the simulator
+        working-directory: demo-app
+        run: |
+          # N.b. no shared scheme in that project, so we build the target directly. Signing is
+          # irrelevant for the simulator, and requiring it would need credentials we don't have:
+          xcodebuild -list -project $APP_TARGET.xcodeproj || true
+
+          xcodebuild build \
+            -project $APP_TARGET.xcodeproj \
+            -target $APP_TARGET \
+            -configuration Debug \
+            -sdk iphonesimulator \
+            -derivedDataPath ./build \
+            CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO
+
+          echo "APP_PATH=$(pwd)/build/Build/Products/Debug-iphonesimulator/$APP_TARGET.app" >> $GITHUB_ENV
+
+      - name: Boot a simulator
+        run: |
+          UDID=$(xcrun simctl list devices available -j | python3 -c "
+          import json, sys
+          devices = json.load(sys.stdin)['devices']
+          for runtime, entries in sorted(devices.items()):
+              for device in entries:
+                  if 'iPhone' in device['name']:
+                      print(device['udid'], device['name'], runtime, file=sys.stderr)
+                      print(device['udid'])
+                      sys.exit(0)
+          sys.exit('No iPhone simulator available')
+          ")
+          echo "UDID=$UDID" >> $GITHUB_ENV
+
+          xcrun simctl boot "$UDID"
+          xcrun simctl bootstatus "$UDID"
+
+      - name: Install the app
+        run: xcrun simctl install "$UDID" "$APP_PATH"
+
+      - name: Download the Frida gadget for the simulator
+        run: |
+          # N.b. the simulator build specifically - the normal iOS gadget is built for devices,
+          # and won't load here:
+          curl -sSfL -o gadget.dylib.xz \
+            "https://github.com/frida/frida/releases/download/$FRIDA_VERSION/frida-gadget-$FRIDA_VERSION-ios-simulator-universal.dylib.xz"
+          unxz gadget.dylib.xz
+          mv gadget.dylib "$RUNNER_TEMP/frida-gadget.dylib"
+          file "$RUNNER_TEMP/frida-gadget.dylib"
+
+      - name: Assemble the scripts to inject
+        run: |
+          # config.js refuses to run without a real certificate, so we give it a throwaway one:
+          openssl req -x509 -newkey rsa:2048 -nodes -keyout /dev/null -out ca.pem -days 1 \
+            -subj "/CN=iOS Gadget Spike CA" 2>/dev/null
+
+          python3 - <<'EOF'
+          import os, re
+
+          cert = open('ca.pem').read().strip()
+          config = open('config.js').read()
+          config = re.sub(r'(?<=const CERT_PEM = `)[^`]+(?=`)', lambda _: cert, config, flags=re.S)
+          config = re.sub(r"(?<=const PROXY_HOST = ')[^']+(?=')", '127.0.0.1', config)
+          config = re.sub(r'(?<=const PROXY_PORT = )\d+(?=;)', '8000', config)
+
+          # The gadget loads a single script, so we combine them exactly as the README's iOS
+          # command does, plus a marker so we can tell the whole set ran to completion:
+          scripts = [
+              config,
+              open('ios/ios-connect-hook.js').read(),
+              open('ios/ios-disable-detection.js').read(),
+              open('native-tls-hook.js').read(),
+              open('native-connect-hook.js').read(),
+              'console.log("SPIKE-MARKER: all scripts loaded");'
+          ]
+
+          with open(os.environ['RUNNER_TEMP'] + '/spike.js', 'w') as output:
+              output.write('\n'.join(scripts))
+          EOF
+
+          # Script mode, so the gadget runs our script at startup instead of pausing the app to
+          # wait for a client to attach:
+          cat > "$RUNNER_TEMP/frida-gadget.config" <<EOF
+          {
+            "interaction": {
+              "type": "script",
+              "path": "$RUNNER_TEMP/spike.js",
+              "on_change": "ignore"
+            }
+          }
+          EOF
+
+          wc -l "$RUNNER_TEMP/spike.js"
+
+      - name: Launch the app with the gadget injected
+        run: |
+          # Capture the simulator's log too, as a fallback in case the gadget's output doesn't
+          # reach the app's stdout:
+          xcrun simctl spawn "$UDID" log stream --level debug \
+            --predicate 'processImagePath CONTAINS "ios-pinning-demo"' > simulator.log 2>&1 &
+          LOG_PID=$!
+
+          # DYLD_INSERT_LIBRARIES via SIMCTL_CHILD_ injects into the app with no modification to
+          # it at all - no repackaging, no re-signing:
+          SIMCTL_CHILD_DYLD_INSERT_LIBRARIES="$RUNNER_TEMP/frida-gadget.dylib" \
+            xcrun simctl launch --console-pty --terminate-running-process \
+            "$UDID" "$BUNDLE_ID" > launch.log 2>&1 &
+          LAUNCH_PID=$!
+
+          # The app doesn't exit by itself, so we give it time to start & hook, then stop watching:
+          sleep 60
+          kill $LAUNCH_PID $LOG_PID 2>/dev/null || true
+
+          echo "=== app process still running?"
+          pgrep -fl "$APP_TARGET" || echo "(no - the app is not running)"
+
+      - name: Report what happened
+        run: |
+          echo "=== launch output:"
+          cat launch.log || true
+          echo
+          echo "=== simulator log:"
+          cat simulator.log || true
+          echo
+          echo "=== crash reports, if any:"
+          find ~/Library/Logs/DiagnosticReports -name "*ios-pinning-demo*" -newermt '-10 minutes' \
+            -exec echo '--- {}' \; -exec head -40 {} \; 2>/dev/null || echo "(none)"
+
+      - name: Check the result
+        run: |
+          OUTPUT="$(cat launch.log simulator.log 2>/dev/null || true)"
+
+          check() {
+            if grep -qF "$1" <<< "$OUTPUT"; then
+              echo "PASS: $2"
+            else
+              echo "FAIL: $2 (expected to find '$1')"
+              FAILED=1
+            fi
+          }
+
+          # The marker proves every script ran to completion; the rest prove they did something:
+          check "SPIKE-MARKER: all scripts loaded" "our scripts ran under the gadget"
+          check "== Redirecting" "native-connect-hook installed its hooks"
+          check "libboringssl.dylib" "native-tls-hook found iOS's TLS library"
+
+          if ! pgrep -f "$APP_TARGET" > /dev/null; then
+            echo "FAIL: the app is not running - it may have crashed (see the report above)"
+            FAILED=1
+          else
+            echo "PASS: the app survived injection"
+          fi
+
+          exit ${FAILED:-0}