Disassembling the TiVo App

Now that we have a memory dump of an unencrypted TiVo App (IPA), we need to use a disassembler to view the commands (in assembly) that the program executes.

Unpacking the IPA

The IPA itself is a simply gzipped file that contains a bunch of files that the application needs (images, etc)

Renaming it to "gzip" and launching a compression tool presents us with its contents.

Exploring the contents of the IPA, I found quite a few interesting files:

subca.cer
cdata.p12

More on these later...

What we are really interested in here is the "Quicksilver" file in the "Quicksilver.app" folder, this is the file that contains the actual code that makes up the application:

Running a dissassembler on the TiVo IPA

Thankfully, IDA offers a great disassembler with a trial period that works on iOS (objective-c) applications. The demo version can be found here: https://www.hex-rays.com/products/ida/support/download_demo.shtml

I fired up IDA Pro & imported my Quicksilver file:

Because Objective-C uses objc_send to to execute every single object method, this makes understanding what is being executed fairly simply as each command is in plain text.

Now, I need to figure out where to look in this code for what I need...