360 Secure SkillHub
360 安全技能中心

iPhone Malware Scan

核心功能：自动安装配套工具，拉取iPhone崩溃日志，创建可断点续传的加密备份，解密后用MVT扫描Pegasus等已知间谍软件IOC，分析崩溃日志并生成评估报告。典型场景：用户怀疑iPhone被入侵、需检测间谍软件或做法医健康检查。需Mac环境、解锁的iPhone及备份密码，仅能检测已知威胁，无法排查未知零日。

lordx64
lordx64
热度 11.01
最近更新 2026-07-06 23:18:36
分类：安全依赖：代码执行 / 读写文件应用场景：自动化脚本 / 报告撰写 / 数据处理

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add iphone-malware-scan
Metadata
name
iphone-malware-scan
description
End-to-end iOS malware/spyware forensic assessment of a non-jailbroken iPhone from a Mac. Installs tooling (libimobiledevice + Mobile Verification Toolkit), pulls crash logs, creates a full ENCRYPTED device backup (auto-resuming on lock/disconnect), decrypts it, runs MVT against every spyware IOC feed (Pegasus, Predator, Candiru, Cellebrite, Intellexa, stalkerware, ...), sweeps every file in the backup manifest, analyzes crash logs for injected dylibs, and produces an assessment report. Use when the user suspects their iPhone is compromised, asks to check for spyware/Pegasus/stalkerware, or wants a full forensic health check of an iPhone connected over USB.
version
1.0.0
metadata
{"openclaw":{"emoji":"🛡️","homepage":"https://github.com/lordx64/iphone-malware-assessment","os":["macos"],"requires":{"bins":["brew","python3"]},"install":[{"brew":"libimobiledevice"},{"brew":"pipx"}],"primaryEnv":"BACKUP_PASSWORD","envVars":[{"name":"BACKUP_PASSWORD","required":true,"description":"Password used to enable and open the encrypted iPhone backup. Cannot be recovered if lost. Required for the backup/decrypt steps."},{"name":"WORKDIR","required":false,"description":"Directory for all output (crash logs, backup, decrypted data, results). Defaults to ./iphone-assessment."}]}}

iPhone malware/spyware assessment

This skill performs a full forensic assessment of a non-jailbroken iPhone connected to a Mac over USB. It is defensive/diagnostic: the user owns the device. All scripts live in scripts/ next to this file.

What it can and cannot do (state this to the user)

  • iOS sandboxing means no app can read another app's memory, and mandatory code signing means a foreign dylib cannot be injected into an app without a jailbreak. So "build an app to inspect WhatsApp" is not possible — the real check is a forensic backup scan, which this skill automates.
  • MVT matches against known spyware indicators. A clean result is strong evidence but cannot prove the absence of an unknown zero-day. Say this.

Prerequisites

  • macOS with Homebrew installed.
  • An iPhone + USB cable. The user must unlock the phone, tap Trust, and keep it unlocked and awake during the backup (Auto-Lock → Never).
  • A backup password. If backup encryption is not already enabled, this skill turns it on with a password the user provides — capture it and warn them it cannot be recovered if lost.

How to run it

Prefer the orchestrator, driven from this skill folder (scripts/ is alongside this file):

BACKUP_PASSWORD='<user-chosen-password>' \
WORKDIR="$PWD/iphone-assessment" \
  zsh scripts/run-all.sh

The backup and decrypt steps can each take a long time and produce tens of GB. Run long steps in the background and monitor for completion (watch for Manifest.db appearing under WORKDIR/backup/<UDID>/).

Running step by step (when you need control or a step fails)

  1. zsh scripts/01-preflight.sh — install/upgrade libimobiledevice + MVT, fetch latest IOCs.
  2. zsh scripts/02-pull-crashlogs.sh "$WORKDIR" — pull .ips crash logs (non-destructive).
  3. BACKUP_PASSWORD=... zsh scripts/03-backup.sh "$WORKDIR" — full encrypted backup, auto-resumes on lock/disconnect.
  4. BACKUP_PASSWORD=... zsh scripts/04-decrypt.sh "$WORKDIR" — decrypt for scanning.
  5. zsh scripts/05-scan.sh "$WORKDIR" — MVT check-backup + explicit check-iocs across all feeds.
  6. python3 scripts/06-analyze-crashes.py "$WORKDIR/crashlogs" WhatsApp — foreign-dylib / abnormal-kill scan.
  7. python3 scripts/07-assess.py "$WORKDIR/mvt-results" --json "$WORKDIR/assessment-summary.json" — final report.

Handling the common failures

  • Error Code 208: Device locked during backup → the phone locked. Tell the user to unlock it and set Auto-Lock → Never; step 3 retries automatically.
  • Could not receive from mobilebackup2 (-4) → USB dropped / device slept. Reconnect; step 3 resumes from what was already transferred.
  • Backup has no Manifest.db → it did not finish; it is unusable for scanning. Re-run step 3 to completion.

Interpreting results (how to report to the user)

  • Real IOC match = an entry in a *_detected.json with a non-null matched_indicator. This is the only thing that indicates known spyware. Treat any as serious; direct the user to Amnesty's Security Lab.
  • Heuristic notes (e.g. "Lockdown mode disabled") have matched_indicator: null — these are context/hardening advice, NOT detections.
  • The assessment (step 7) separates these automatically and prints a verdict, plus the full-manifest file sweep (unknown domains, jailbreak/hook artifacts, dylibs outside app bundles) and a coverage table proving what was examined.

Cleanup

WORKDIR/backup and WORKDIR/decrypted hold the user's personal data and can be very large. Offer to delete them when finished; never delete without asking. The mvt-results/ JSON is small and safe to keep for review.