🐍 Python Phone Debugging

1 Install pymobiledevice3

Open Terminal and run:

# Install via pip
pip3 install pymobiledevice3

# Or install with all optional dependencies
pip3 install pymobiledevice3[all]

# Verify installation
python3 -m pymobiledevice3 --help

2 Connect Your iPhone

Connect your iPhone via USB cable. When prompted, tap "Trust" on your iPhone and enter your passcode.

# List connected devices
python3 -m pymobiledevice3 usbmux list

# You should see output like:
# UDID: 00008030-001234567890802E
# ProductType: iPhone14,2
# ConnectionType: USB

3 Stream System Logs (Syslog)

This is the most powerful feature for detecting suspicious activity. System logs show everything happening on your device in real-time.

# Stream live system logs
python3 -m pymobiledevice3 syslog live

# Filter for specific keywords (e.g., network activity)
python3 -m pymobiledevice3 syslog live | grep -i "network\|connection\|socket"

# Save logs to file for analysis
python3 -m pymobiledevice3 syslog live > iphone_syslog_$(date +%Y%m%d).txt

4 List Installed Apps

Get a complete list of all installed applications, including hidden ones:

# List all installed apps
python3 -m pymobiledevice3 apps list

# Get detailed info about a specific app
python3 -m pymobiledevice3 apps list --bundle-id com.suspicious.app

# Export to JSON for analysis
python3 -m pymobiledevice3 apps list --json > installed_apps.json

Compare this list against apps visible on your home screen. Hidden apps are a major red flag.

5 Check Configuration Profiles

Configuration profiles can install root certificates, VPN configurations, and MDM (Mobile Device Management) that allows remote control:

# List all configuration profiles
python3 -m pymobiledevice3 profile list

# Look for:
# - MDM profiles (enterprise management)
# - VPN profiles you didn't install
# - Certificate profiles (can intercept HTTPS)

6 Analyze Network Connections

See what servers your iPhone is communicating with:

# Start a PCAP capture (requires root on some systems)
sudo python3 -m pymobiledevice3 pcap live -o capture.pcap

# Then analyze with Wireshark or tshark
tshark -r capture.pcap -Y "ip.dst != 10.0.0.0/8 and ip.dst != 172.16.0.0/12 and ip.dst != 192.168.0.0/16"

Look for connections to:

• Unknown IP addresses (especially in foreign countries)
• Non-standard ports (anything other than 80, 443)
• Frequent "heartbeat" connections (spyware checking in)

🔬 Suspicious Process Detector

import pymobiledevice3
from pymobiledevice3.lockdown import create_using_usbmux
from pymobiledevice3.services.syslog import SyslogService

# Known suspicious process names (add more as needed)
SUSPICIOUS_KEYWORDS = [
    'mspy', 'flexispy', 'cocospy', 'spyic',
    'keylogger', 'tracker', 'monitor', 'stealth'
]

def check_for_suspicious_activity():
    lockdown = create_using_usbmux()
    
    with SyslogService(lockdown) as syslog:
        for entry in syslog.watch():
            message = entry.message.lower()
            for keyword in SUSPICIOUS_KEYWORDS:
                if keyword in message:
                    print(f"⚠️ SUSPICIOUS: {entry}")

if __name__ == "__main__":
    print("Monitoring for suspicious activity... (Ctrl+C to stop)")
    check_for_suspicious_activity()

📊 App Permission Auditor

import json
from pymobiledevice3.lockdown import create_using_usbmux
from pymobiledevice3.services.installation_proxy import InstallationProxyService

def audit_app_permissions():
    lockdown = create_using_usbmux()
    
    with InstallationProxyService(lockdown) as installer:
        apps = installer.get_apps('User')
        
        print("Apps with Location Access:")
        for bundle_id, info in apps.items():
            # Check for location-related entitlements
            entitlements = info.get('Entitlements', {})
            if 'com.apple.locationd' in str(entitlements):
                print(f"  📍 {info.get('CFBundleDisplayName', bundle_id)}")

if __name__ == "__main__":
    audit_app_permissions()

1 Create Unencrypted Backup

# First, disable backup encryption in iTunes/Finder if enabled
# Then create backup:
idevicebackup2 backup --full ./forensic_backup/

2 Analyze with iBackup Viewer or Python

# Install backup analysis tools
pip3 install iphone_backup_decrypt

# Or use built-in Python to explore the backup structure
import os
import plistlib

backup_path = "./forensic_backup/[UDID]/"

# Read Manifest.plist for file inventory
with open(os.path.join(backup_path, "Manifest.plist"), "rb") as f:
    manifest = plistlib.load(f)
    print("Backup contains:", len(manifest.get('Applications', {})), "apps")