[bug] objection patchipa freezes indefinitely when .mobileprovision is invalid
Author: mehradn7Created Mar 29, 2023Updated Apr 12, 2026
Labelsfreshissue
Describe the bug
Hello,
The objection patchipa command freezes indefinitely when specifying an invalid .mobileprovision file.
To Reproduce
Run the following command and provide an empty or invalid .mobileprovision file:
objection patchipa --source iGoat-Swift.ipa --codesign-signature XXXXX -P /dev/nullExpected behavior
The command should immediately return with an error message. Instead, it freezes indefinitely and never returns:

The issue seems to happen when fetching the bundle id from the .mobileprovision file (https://github.com/sensepost/objection/blob/master/objection/utils/patchers/ios.py#L475), the chain of commands is prepended with cat | , thus the whole command never returns whereas the underlying security cms command immediately returns an error when ran separately:
$ security cms -D -i /dev/null | plutil -extract Entitlements.application-identifier xml1 -o - - | grep string | sed 's/^<string>[^\.]*\.\(.*\)<\/string>$/\1/g'
security: failed to decode message: UNKNOWN (-8183(d)
security: problem decodingEnvironment :
- OS: macOS 13
- Frida Version: 16.0.11
- Objection Version: 1.11.0
Thank you.
Source: sensepost/objection