iOS and macOS reverse engineering: jailbreak detection, code signing, Objective-C/Swift, tweaks, and protocol analysis.
44 articles
From device-side risk detection to a policy closed loop: designing a risk-control SDK, scoring engine, and investigation agent end to end, with the setup and commands all covered.
De-obfuscating an OLLVM CFF and MBA/BDD dylib, reconstructing 167 hooks hidden behind 223 trampolines to recover the real logic, with the setup and commands all covered.
Swift reverse engineering from string memory layout to recovering ChaCha20-Poly1305 plaintext, key, and nonce from a running app, with the algorithm recovered in detail.
ιldb, a command-line scripting layer for LLDB debugging, adding scripting and automation on top of the debugger for faster workflows, and the code traced down to the core.
Reverse engineering an iOS device-registration request, decoding the parameters the device sends during enrollment to register with a service, with the algorithm recovered in detail.
Analyzing the mtop device risk-control SDK: its jailbreak detection, VMP layer, and multi-stage encryption, broken down end to end, with every step broken down clearly.
Analyzing the control-flow flattening obfuscation pass, explaining how it breaks the CFG into a dispatcher loop and what it looks like in decompiled code.
Packet capturing on iOS with Charles, Clash, and Shadowrocket, comparing VPN-based capture setups and how to route around SSL pinning, including the pitfalls and the fix.
Source analysis of Hikari's AntiDebug LLVM pass, how it injects randomized ptrace-based anti-debugging checks into iOS binaries at compile time, and the internals laid out in detail.
Source analysis of Hikari's AntiHook LLVM pass, how it detects inline hooks, blocks fishhook rebinding, and guards the Objective-C runtime, for anyone reversing similar targets.
Source analysis of Hikari's AntiClassDump LLVM pass, showing how it rewrites Objective-C method lists to defeat class-dump tooling entirely, with every step broken down clearly.
Analyzing a fitness app's login protocol, reversing its MD5, SHA1, and AES layers with Frida to reconstruct the sign and password scheme, with the algorithm recovered in detail.
Analyzing an iOS app's login to reverse its _sign and userpwd parameters, tracing CC_MD5 with Frida and IDA to rebuild the exact request, with the result and caveats spelled out.
Reversing a modified AES in a mobile app, reconstructing Bangcle's white-box laes cipher with Frida Stalker and IDA on ARM64 to recover the original algorithm.
How iOS apps detect jailbreaks and how to bypass every check with Frida, hooking stat, dyld, canOpenURL, and fork to hide the jailbreak entirely, with the analysis method shown end to end.
Comparing four iOS app decryption tools, Clutch, dumpdecrypted, CrackerXI, and frida-ios-dump, with hands-on experience on when each one works best, for anyone reversing similar targets.
Configuring iOS Wi-Fi and proxy settings directly with Frida, driving SpringBoard's WiFikit APIs to script device network setup without ever touching the UI.
A first look at a connected-car app wrapped in a commercial packer, mapping its control-flow obfuscation and SSL pinning with Frida, Objection, and Stalker.
Reverse engineering an iOS rhythm game: binary patching with IDA, bypassing TrustKit cert pinning, and intercepting mutual-TLS traffic to capture its API.
Hooking objc_msgSend to capture every Objective-C method argument on ARM64, using FishHook and inline hooks to intercept message dispatch right at its core.
Analyzing the network protocol of the blockchain game Mir4, digging into its Unreal Engine build to decode the Protobuf messages exchanged with the server.
Anti-disassembly tricks on ARM64: building data blocks that decode as bogus instructions, and using B and DCQ to confuse IDA while keeping the code runnable.
Locating the SM4 encryption key in an iOS ARM64 binary, tracing the key schedule and cipher calls through the disassembly to recover the secret material.
Building a universal iOS tweak that lets you tick any app in settings and bypass its anti-debugging, integrating AppList and PreferenceLoader with Dobby and HookZz.
An end-to-end iOS reversing journey: jailbreak, dump the FairPlay-encrypted binary, then hook a chat app's dice roll with method swizzling and inline hooks.
Using A64Dbg's ADCpp to call iTunesStored's kbsync remotely over LLDB, invoking an Objective-C method on-device from outside the running process, with a full walkthrough of the technique.
Bypassing an iOS app's layered anti-debugging: well-timed initialization checks, combined ptrace and svc guards, and periodic re-checks, defeated with targeted hooks.
Reversing a messaging app jailbreak-free with MonkeyDev, hooking red packets, message revoke, and step-count spoofing without ever having to jailbreak the device.
From use-after-free to kernel task port: a full exploit walkthrough of CVE-2019-8605, with the heap spraying and Mach ool-message tricks that turn a socket UAF into TFP0.
A root-cause analysis of CVE-2020-27950, an iOS kernel memory leak from an uninitialized Mach message trailer, including the full PoC send and receive flow.
Reverse engineering SGAVMP, a commercial anti-bot SDK's virtual machine: breaking its anti-F5 decompilation, string encryption, and the signature scheme it protects.
A practical guide to decrypting iOS apps with dumpdecrypted, covering the Mach-O injection, the codesign fix, and the otool verification steps needed to dump a clean binary.
Setting up an iOS reverse-engineering environment from scratch, then cracking an app's sign algorithm by tracing CCCrypt and CC_MD5 with Frida to recover the key material.
A source-level exploration of FishHook, walking the Mach-O load commands and the symbol and string tables to show exactly how it rewrites lazy GOT pointers to hook functions.
Localizing an iOS game without touching its source code: reuse the bundled translations and drive hook-based text replacement through a dylib to swap in-game strings on the fly.
Bypassing a short-video app's iOS anti-debugging from scratch, working through its ptrace and sysctl checks with MonkeyDev and IDA so the process stays debuggable during analysis.
A first look at the Swift runtime by building a Frida-based packet capture tool that hooks Alamofire's request flow and defeats SSL pinning on a real device.
Reverse engineering Apple's GSA login to document the SRP6a variant it uses, tracing the PBKDF2 key derivation and the AES steps behind Apple ID authentication straight from the binary.
Injecting a theos tweak into an iOS game to hijack its avatar upload, swapping the request so the server serves an animated GIF instead of a static image.
Part two of the iOS code-signing deep dive: resource rules, mobileprovision, entitlements, and the exact steps to re-sign an IPA with codesign or ldid.
Part one of a two-part deep dive into iOS code signing: how FairPlay DRM, SC_Info, and CodeResources fit together and what third-party distribution means under the hood.
Combining Frida's API resolver with its Interceptor to hook Objective-C methods reliably, plus method swizzling and file-monitoring tricks from a real iOS session.
A hands-on Frida tutorial on intercepting stripped sub_xxxx functions on iOS, covering NativeFunction and NativeCallback to hook targets that have no symbol names.
How to print Objective-C block parameter signatures straight from LLDB, speeding up iOS reverse engineering by recovering block types without digging through class-dump output.