Search code examples
iosswiftxcodejailbreakfrida

How to capture print statements from iOS app installed on iOS device?


I'm reading about some good practices for developing iOS apps and looking at the possibility of monitoring logs of an iOS app installed from App Store using Console.app. So, I was testing here, but I noticed that print statements didn't show up in Console.app, only NSLog does. My question is: is there any way that is possible to see logs that are made with print commands within iOS apps installed on a device? With Frida, Console.app or any other means?

If there is no other method, does it mean that print commands are more secure than NSLog? This seems very counterintuitive to me 🤔


Solution

  • print statement in iOS apps are not logged to one of the [persistent] logging systems on iOS, therefore you can not access the output of an app via print statements if they had occur in the past.

    By default you can only seem the output of print commands in XCode output panel. However the print commands themselves are always included in the debug and release builds and are therefore executed. Just the output of the print statements is discarded if no XCode is connected to retrieve it.

    I tested this by building the following SwiftUI test app (see the end of this answer), made sure the Archive profile is set to RELEASE and the archived the project, to build an IPA file. The IPA file was then analyzed in IdaPro to see the actual ARM assembler code.

    And in all tests using different options (e.g. "Rebuild from Bitcode" (de)activated) the code was always there.

    Therefore if you attach Frida to an app you can e.g. hook the print method print(_:separator:terminator:) to retrieve all output that would otherwise be discarded.

    struct ContentView: View {
        @State var number : Int = 1
        var body: some View {
            VStack {
                Button("  Print  ") {
                    print("print test abcdefgh number %d", number)
                }.padding()
                Button("  os_log  ") {
                    os_log("os_log test abcdefgh number %d", number)
                }.padding()
                Button("randomize") {
                    self.number = Int.random(in: 1...11111)
                }.padding()
            }
        }
    }