hacktricks/src/binary-exploitation/ios-exploiting/ios-corellium.md

iOS How to Connect to Corellium

{{#include ../../banners/hacktricks-training.md}}

Prereqs

• A Corellium iOS VM (jailbroken or not). In this guide we assume you have access to Corellium.
• Local tools: ssh/scp.
• (Optional) SSH keys added to your Corellium project for passwordless logins.

Connect to the iPhone VM from localhost

A) Quick Connect (no VPN)

0. Add you ssh key in /admin/projects (recommended).
1. Open the device page → Connect
2. Copy the Quick Connect SSH command shown by Corellium and paste it in your terminal.
3. Enter the password or use your key (recommended).

B) VPN → direct SSH

0. Add you ssh key in /admin/projects (recommended).
1. Device page → CONNECT → VPN → download .ovpn and connect with any VPN client that supports TAP mode. (Check https://support.corellium.com/features/connect/vpn if you have issues.)
2. SSH to the VM’s 10.11.x.x address:

ssh root@10.11.1.1

Upload a native binary & execute it

2.1 Upload

• If Quick Connect gave you a host/port:

scp -J <domain> ./mytool root@10.11.1.1:/var/root/mytool

• If using VPN (10.11.x.x):

scp ./mytool -J <domain> root@10.11.1.1:/var/root/mytool

Upload & install an iOS app (.ipa)

Path A — Web UI (fastest)

1. Device page → Apps tab → Install App → pick your .ipa.
2. From the same tab you can launch/kill/uninstall.

Path B — Scripted via Corellium Agent

1. Use the API Agent to upload then install:

// Node.js (pseudo) using Corellium Agent
await agent.upload("./app.ipa", "/var/tmp/app.ipa");
await agent.install("/var/tmp/app.ipa", (progress, status) => {
  console.log(progress, status);
});

Path C — Non-jailbroken (proper signing / Sideloadly)

• If you don’t have a provisioning profile, use Sideloadly to re-sign with your Apple ID, or sign in Xcode.

• You can also expose the VM to Xcode using USBFlux (see §5).

• For quick logs/commands without SSH, use the device Console in the UI.

Extras

• Port-forwarding (make the VM feel local for other tools):

# Forward local 2222 -> device 22
ssh -N -L 2222:127.0.0.1:22 root@10.11.1.1
# Now you can: scp -P 2222 file root@10.11.1.1:/var/root/

• LLDB remote debugging: use the LLDB/GDB stub address shown at the bottom of the device page (CONNECT → LLDB).

• USBFlux (macOS/Linux): present the VM to Xcode/Sideloadly like a cabled device.

Common pitfalls

• Proper signing is required on non-jailbroken devices; unsigned IPAs won’t launch.
• Quick Connect vs VPN: Quick Connect is simplest; use VPN when you need the device on your local network (e.g., local proxies/tools).
• No App Store on Corellium devices; bring your own (re)signed IPAs.

{{#include ../../banners/hacktricks-training.md}}