Applications uses 'UserDefaults' To store data such as configuration and user information, it's also called (NS)UserDefaults. It's stored as plist inside the application data folder (/Data/Application/{BUNDLE-ID}/Library/Preferences/).
We can view the plist file with the content by going to the dir above or we can view the UserDefault settings via objection:
iron@MacOS Payload-signed % objection -g "DVIA-v2" explore
Using USB device `iPhone`
Agent injected and responds ok!
_ _ _ _
___| |_|_|___ ___| |_|_|___ ___
| . | . | | -_| _| _| | . | |
|___|___| |___|___|_| |_|___|_|_|
|___|(object)inject(ion) v1.11.0
Runtime Mobile Exploration
by: @leonjza from @sensepost
[tab] for command suggestions
* on (iPhone: 14.6) [usb] # ios nsuserdefaults get
{
AKLastEmailListRequestDateKey = "2021-06-16 10:13:44 +0000";
AKLastIDMSEnvironment = 0;
AddingEmojiKeybordHandled = 1;
AppleITunesStoreItemKinds = (
"itunes-u",
movie,
album,
ringtone,
"software-update",
booklet,
tone,
"music-video",
"tv-episode",
"tv-season",
song,
podcast,
software,
audiobook,
"podcast-episode",
wemix,
eBook,
mix,
artist,
document
);
AppleLanguages = (
"en-GB"
);
AppleLanguagesDidMigrate = 18F72;
AppleLanguagesSchemaVersion = 2000;
AppleLocale = "en_GB";
ApplePasscodeKeyboards = (
"en_GB@sw=QWERTY;hw=Automatic",
"emoji@sw=Emoji"
);
INNextFreshmintRefreshDateKey = "645617603.467853";
INNextHearbeatDate = "645973764.728657";
NSInterfaceStyle = macintosh;
NSLanguages = (
"en-GB",
en
);
PKKeychainVersionKey = 8;
PKLogNotificationServiceResponsesKey = 0;
"com.apple.content-rating.AppRating" = 1000;
"com.apple.content-rating.ExplicitBooksAllowed" = 1;
"com.apple.content-rating.ExplicitMusicPodcastsAllowed" = 1;
"com.apple.content-rating.MovieRating" = 1000;
"com.apple.content-rating.TVShowRating" = 1000;
}
* on (iPhone: 14.6) [usb] # env
Name Path
----------------- -------------------------------------------------------------------------------------------
BundlePath /private/var/containers/Bundle/Application/3A52DA3E-3998-4DEC-9DB0-69585AA8DC44/DVIA-v2.app
CachesDirectory /var/mobile/Containers/Data/Application/03B7F74C-3CEF-4FB5-9712-3143A9B44FDA/Library/Caches
DocumentDirectory /var/mobile/Containers/Data/Application/03B7F74C-3CEF-4FB5-9712-3143A9B44FDA/Documents
LibraryDirectory /var/mobile/Containers/Data/Application/03B7F74C-3CEF-4FB5-9712-3143A9B44FDA/Library
* on (iPhone: 14.6) [usb] # cd /var/mobile/Containers/Data/Application/03B7F74C-3CEF-4FB5-9712-3143A9B44FDA/Library
/var/mobile/Containers/Data/Application/03B7F74C-3CEF-4FB5-9712-3143A9B44FDA/Library
* on (iPhone: 14.6) [usb] # ls
NSFileType Perms NSFileProtection Read Write Owner Group Size Creation Name
------------ ------- ------------------ ------ ------- ------------ ------------ ------- ------------------------- -----------------------
Directory 493 n/a True True mobile (501) mobile (501) 128.0 B 2021-06-16 13:56:28 +0000 Caches
Directory 493 n/a True True mobile (501) mobile (501) 64.0 B 2021-06-16 13:57:45 +0000 FlurryFiles
Directory 493 n/a True True mobile (501) mobile (501) 96.0 B 2021-06-16 13:57:45 +0000 Saved Application State
Directory 493 n/a True True mobile (501) mobile (501) 64.0 B 2021-06-16 13:56:28 +0000 Preferences
Directory 493 n/a True True mobile (501) mobile (501) 96.0 B 2021-06-16 13:57:45 +0000 Application Support
Readable: True Writable: True
* on (iPhone: 14.6) [usb] # cd Preferences
/var/mobile/Containers/Data/Application/03B7F74C-3CEF-4FB5-9712-3143A9B44FDA/Library/Preferences
* on (iPhone: 14.6) [usb] # ls
NSFileType Perms NSFileProtection Read Write Owner Group Size Creation Name
------------ ------- ------------------ ------ ------- ------- ------- ------ ---------- ------
Readable: True Writable: True