abelrguezr iOS Corellium Connection Guide
This skill helps you connect to and interact with Corellium iOS virtual machines for security testing, exploitation, and development.
Quick Start
Method 1: Quick Connect (Recommended for most cases)
- Add your SSH key to Corellium at
/admin/projects(recommended for passwordless login) - Open the device page and click Connect
- Copy the Quick Connect SSH command displayed by Corellium
- Paste in your terminal and execute
# Example Quick Connect command (format varies)
ssh -J <domain> root@<quick-connect-host>
Method 2: VPN Connection (Use when you need local network access)
- Add your SSH key to Corellium at
/admin/projects - Navigate to device page → CONNECT → VPN
- Download the
.ovpnfile and connect with any TAP-mode VPN client - SSH to the VM's internal IP:
ssh root@10.11.1.1
When to use VPN: Choose VPN when you need the device on your local network for tools like proxies, network analyzers, or when Quick Connect doesn't work.
File Transfer Operations
Upload a Native Binary
With Quick Connect (jump host):
scp -J <domain> ./mytool root@10.11.1.1:/var/root/mytool
With VPN (direct IP):
scp ./mytool root@10.11.1.1:/var/root/mytool
Upload and Install an iOS App (.ipa)
Option A: Web UI (Fastest)
- Device page → Apps tab → Install App
- Select your
.ipafile - Use the same tab to launch, kill, or uninstall
Option B: Scripted via Corellium Agent
Use the Corellium API Agent for automated workflows:
// Node.js example using Corellium Agent
await agent.upload("./app.ipa", "/var/tmp/app.ipa");
await agent.install("/var/tmp/app.ipa", (progress, status) => {
console.log(`Progress: ${progress}, Status: ${status}`);
});
Option C: Non-Jailbroken Devices (Requires Signing)
- Use Sideloadly to re-sign with your Apple ID
- Or sign in Xcode with a valid provisioning profile
- Unsigned IPAs will not launch on non-jailbroken devices
Advanced Operations
Port Forwarding
Make the VM accessible locally for other tools:
# Forward local port 2222 to device port 22
ssh -N -L 2222:127.0.0.1:22 root@10.11.1.1
# Now use the forwarded port
scp -P 2222 file root@localhost:/var/root/
Remote Debugging with LLDB
- Navigate to device page → CONNECT → LLDB
- Copy the LLDB/GDB stub address shown at the bottom
- Connect from your local LLDB:
lldb
(lldb) platform select remote-ios
(lldb) process connect connect://<stub-address>
USBFlux (macOS/Linux)
Present the VM to Xcode or Sideloadly as if it were physically connected:
# Install USBFlux
brew install usbfluxd
# Run to expose the device
usbfluxd
Now Xcode and Sideloadly will detect the Corellium VM as a connected device.
Quick Reference
| Task | Command/Method |
|---|---|
| Quick SSH | Copy command from device page |
| VPN SSH | ssh root@10.11.x.x |
| Upload binary | scp -J <domain> ./file root@10.11.1.1:/path/ |
| Install .ipa | Web UI Apps tab or Agent API |
| Port forward | ssh -N -L 2222:127.0.0.1:22 root@10.11.1.1 |
| View logs | Device Console in UI |
Common Pitfalls
- Signing required: Non-jailbroken devices need properly signed IPAs. Unsigned apps won't launch.
- Quick Connect vs VPN: Quick Connect is simpler; use VPN for local network tools.
- No App Store: Corellium devices don't have App Store access. Bring your own signed IPAs.
- SSH keys: Add keys to
/admin/projectsto avoid password prompts. - Path differences: Quick Connect uses jump host (
-J), VPN uses direct IP.
Troubleshooting
Can't connect via Quick Connect?
- Try VPN method instead
- Verify SSH key is added to project
- Check Corellium status page for outages
VPN won't connect?
- Ensure VPN client supports TAP mode
- Check Corellium VPN docs
- Try different VPN client (OpenVPN Connect, Tunnelblick, etc.)
App won't launch?
- On non-jailbroken: re-sign with Sideloadly or Xcode
- Check provisioning profile validity
- Verify app architecture matches device (arm64)
SCP fails?
- Quick Connect: include
-J <domain>flag - VPN: use direct IP without jump host
- Verify SSH key authentication is working