iOS Shortcuts
Overview
One of the
capabilities found in iOS devices is the Shortcuts application. This native
application can be used to create shortcuts for different types of functionalities in the system. This
article examines the homescreen of an iOS device after a shortcut to open a URL
was created using the Shortcut application. The article also addresses
artifacts indicating that a shortcut was used to accomplish a particular task
in the system. The test shortcut created for this article opens a webpage, https://thisweekin4n6.com, using the Safari browser.
Apple [1] describes the Shortcuts application as "a quick way to get one or more tasks done with your apps." Meaning that the Shrotcut application allows users to custom-create shortcuts capable of completing specific tasks when users activate them. Users are also able to have sutom names and icons for the shortcuts.
Creating
Test Shortcut
As mentioned, a test shortcut was
created to open the This Week in 4n6 website, https://thisweekin4n6.com/, in
Safari. An iPhone 7 Plus, Model: A1784, running iOS Version 15.7.5 was used
during testing. Figures 1 through 3 show the creation of a URL opening
shortcut.
Analysis
of Homescreen
A full filesystem was acquired from
the test device. The acquired image was examined to show the newly created
shortcut and any information indicating that the shortcut was activated. The
first file analyzed was the /private/var/mobile/Library/SpringBoard/IconState.plist,
which shows the icons found on the homescreen of an iOS device. A review of the
file did not show the “Test_Shortcut” but it showed a GUID, 41FE26DF37214EBABE491A0AE6C7894D. Table 1 shows a comparison between the list of applications as they appear in IconStat.plist and the icons as they appear on the homescreen. The last entry in the IconStat.plist and the last icon shown in the homescreen is the test shortcut.
Table 1. Comparison between IconStat.plist and the homescreen of the iOS device.
|
Homescreen |
IconStat.plist |
|
|
 |
A quick search of the filesystem image for the referenced GUID revealed a directory with the same name was located in /private/var/mobile/Library/WebClips/41FE26DF37214EBABE491A0AE6C7894D.webclip. Figure 4 shows the files found in the referenced directory. The directory contained the following files of interest:
-
icon.png:
The icon chosen by the user for the shortcut.
-
Info.plist:
This file contains information about the icon, including the shortcut name,
“Test_Shortcut.” Figure 5 shows the contents of the Info.plist file.
Testing the Shortcut
The
shortcut was activated in the device to determine whether the system would log
activities to indicate that Safari was used when the shortcut was activated in
the system. For this task, a timeline was reviewed around the timeframe when
the shortcut was activated. The resulting activities indicated that the KnowledgeC
database logged an entry related to com.apple.shortcuts.runtime when the
shortcut was activated. The following entries from KnowledgeC were related to
Safari and a web visit to the This Week In 4n6 website. Figure 6 shows the timeline
of events when the Test_Shortcut was activated.
Conclusion
iOS
has an application that allows users to create their own shortcuts to automate
tasks within the system. These shortcuts would not appear in the IconStat.plist
as a shortcut, but they appear as a GUID. This GUID is associated with a
directory that contains the icon file assigned to the shortcut and a plist
file, Info.plist, that has more information about the shortcut, including its
name. When a shortcut is activated in the system, the KnoweldgeC database would log
an entry for com.apple.shortcuts.runtime, which indicates that the activity resulted
from a shortcut.
References:
[1] Shortcuts User Guide. https://support.apple.com/guide/shortcuts/welcome/ios