Ios Reverse Engineering

iOS Reverse Engineering

Extract and analyze iOS IPA files, .app bundles, Mach-O binaries, dynamic libraries, and frameworks using ipsw (blacktop/ipsw), otool, strings, radare2/rizin, and Ghidra headless. Trace call flows through application code, analyze security patterns, deep-scan for cloud provider credentials (Firebase, GCP, AWS, Azure), perform LLM-assisted binary reversing with decompilation and Ghidra headless scripts, fingerprint embedded third-party SDKs with version detection and CVE cross-referencing, and detect anti-tampering protections (obfuscation tools, anti-debugging, dylib injection prevention, integrity checks, jailbreak detection). Produce structured documentation of extracted APIs and security findings. Works with both Swift and Objective-C applications.

Prerequisites

This skill requires ipsw (which includes class-dump functionality and much more) and, on macOS, the standard developer tools (otool, strings, plutil, codesign) via Xcode Command Line Tools. For deep binary analysis, radare2 (or rizin) is recommended; Ghidra headless is optional for advanced decompilation. On Linux, ipsw provides cross-platform Mach-O analysis, entitlements, class-dump and thinning; libplist/plistutil (or python3 plistlib) provide plist parsing; binutils provides strings/nm. otool/codesign/plutil/PlistBuddy/lipo are macOS-only and the scripts fall back to ipsw/plistutil/python3 automatically — no macOS tools required on Linux. Run the dependency checker to verify:

bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/check-deps.sh

If anything is missing, follow the installation instructions in ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/references/setup-guide.md.

Workflow

Phase 1: Verify and Install Dependencies

Before analyzing, confirm that the required tools are available — and install any that are missing.

Action: Run the dependency check script.

bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/check-deps.sh

The output contains machine-readable lines:

• INSTALL_REQUIRED: — must be installed before proceeding
• INSTALL_OPTIONAL: — recommended but not blocking

If required dependencies are missing (exit code 1), install them automatically:

bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/install-dep.sh 

The install script detects the OS and package manager, then:

• Installs via Homebrew when available (brew install blacktop/tap/ipsw)
• Falls back to downloading from GitHub releases to ~/.local/share/, symlinks in ~/.local/bin/
• If installation fails, it prints the exact manual command and exits with code 2 — show these instructions to the user

For optional dependencies, ask the user if they want to install them. jtool2 and frida are recommended for deeper analysis.

After installation, re-run check-deps.sh to confirm everything is in place. Do not proceed to Phase 2 until all required dependencies are OK.

Phase 2: Extract and Dump Classes

Use the extraction script to process the target file. The script supports IPA, .app, Mach-O, .dylib, and .framework files.

Action: Run the extraction script.

bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/extract-ipa.sh [OPTIONS] 

For IPA files: the script extracts the ZIP archive, locates the .app bundle inside Payload/, identifies the main Mach-O binary, runs ipsw class-dump, extracts Info.plist, entitlements, embedded frameworks, string constants, the Mach-O header flags (macho-flags.txt — PIE / hardened-runtime indicators), and Apple's privacy manifest (PrivacyInfo.xcprivacy, copied to the analysis root when present).

For .app bundles: the script works directly on the bundle directory (same artifacts as IPA).

For Mach-O binaries, .dylib, and .framework files: the script runs ipsw class-dump and string extraction directly.

On Linux, the Mach-O artifacts (load-commands.txt, linked-libraries.txt, symbols.txt, macho-flags.txt, objc-info.txt, entitlements) are produced via ipsw macho info instead of otool/codesign/lipo/nm, and plists are read via python3 plistlib / plistutil. The output is equivalent to the macOS run.

Options:

• -o — Custom output directory (default: -analysis)
• --no-classdump — Skip class-dump (faster, metadata-only analysis)
• --thin — Extract a specific architecture from fat binaries (e.g., arm64)
• --swift-demangle — Demangle Swift symbols in output

See ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/references/class-dump-usage.md for the full ipsw class-dump reference.

Phase 3: Analyze Structure

Navigate the extracted output to understand the app's architecture.

Actions:

1. Read Info.plist from /Info.plist:

• Identify the bundle identifier (CFBundleIdentifier)
• Check minimum iOS version (MinimumOSVersion)
• Find URL schemes (CFBundleURLTypes)
• Note App Transport Security settings (NSAppTransportSecurity)
• Find background modes (UIBackgroundModes)
• Check for privacy usage descriptions (camera, location, etc.)

1. Review entitlements from /entitlements.plist:

• Keychain access groups
• App groups
• Push notification entitlements
• Associated domains (universal links)

1. Survey the ipsw class-dump output in /class-dump/:

• Identify ViewControllers — these are the UI entry points
• Look for classes named with API, Network, Service, Client, Manager, Repository
• Distinguish app code from framework code
• Identify architecture pattern (MVC, MVVM, VIPER, Coordinator)

1. List embedded frameworks in /frameworks/:

• Identify third-party frameworks (Alamofire, AFNetworking, Firebase, etc.)
• Note any custom frameworks that may contain networking code

1. Identify the architecture pattern:

• MVC: ViewControllers with direct networking code
• MVVM: ViewModel classes with binding patterns
• VIPER: Interactor, Presenter, Router classes
• Coordinator: Coordinator/Flow classes managing navigation
• This informs where to look for network calls in the next phases

Phase 4: Trace Call Flows

Follow execution paths from user-facing entry points down to network calls.

Actions:

1. Start from entry points: Read the main ViewController or AppDelegate identified in Phase 3.

1. Follow the initialization chain: AppDelegate.application(_:didFinishLaunchingWithOptions:) or @main App struct often sets up the HTTP client, base URL, and DI framework. Read this first.

1. Trace user actions: From a ViewController, follow:

• viewDidLoad() → setup → IBAction/button targets
• IBAction/target → ViewModel/Presenter method
• ViewModel → Repository/Service → API client
• API client → URLSession/Alamofire call

1. Map DI and service creation: Find where networking services are instantiated:

• Swinject containers
• Manual dependency injection via init parameters
• Singleton patterns (shared, default, instance)

1. Handle Swift name mangling: When symbols are mangled, use strings output and ipsw class-dump headers as anchors. Protocol conformances and property names are readable even in optimized builds.

See ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/references/call-flow-analysis.md for detailed techniques and grep commands.

Phase 5: Extract and Document APIs

Find all API endpoints and produce structured documentation.

Action: Run the API search script for a broad sweep.

bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/find-api-calls.sh /

Additional options:

• --context N — Show N lines of context around each match (recommended: --context 3)
• --report FILE — Export results as a structured Markdown report
• --dedup — Deduplicate results by endpoint/URL

Targeted searches:

# Only URLSession patterns
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/find-api-calls.sh / --urlsession

# Only Alamofire/AFNetworking
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/find-api-calls.sh / --alamofire

# Only hardcoded URLs
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/find-api-calls.sh / --urls

# Only auth patterns
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/find-api-calls.sh / --auth

# Only Combine/async-await patterns
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/find-api-calls.sh / --swift-concurrency

# Only GraphQL patterns
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/find-api-calls.sh / --graphql

# Only WebSocket patterns
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/find-api-calls.sh / --websocket

# Only security patterns (ATS, cert pinning, jailbreak detection)
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/find-api-calls.sh / --security

# Full analysis with context and Markdown report
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/find-api-calls.sh / --context 3 --dedup --report report.md

Then, for each discovered endpoint, read the surrounding source/strings to extract:

• HTTP method and path
• Base URL
• Path parameters, query parameters, request body
• Headers (especially authentication)
• Response type
• Where it's called from (the call chain from Phase 4)

Document each endpoint using this format:

### `METHOD /path`

- **Source**: `MyApp.APIService` (class-dump header or strings reference)
- **Base URL**: `https://api.example.com/v1`
- **Path params**: `id` (String)
- **Query params**: `page` (Int), `limit` (Int)
- **Headers**: `Authorization: Bearer `
- **Request body**: `{ "email": "string", "password": "string" }`
- **Response**: `Codable struct User`
- **Called from**: `LoginViewController → LoginViewModel → AuthService → APIClient`

See ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/references/api-extraction-patterns.md for library-specific search patterns and the full documentation template.

Phase 6: Security Analysis

Scan for security-relevant patterns in the extracted app.

Action: Run the security-focused search:

bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/find-api-calls.sh / --security --context 3

Look for and flag:

• App Transport Security (ATS) exceptions — NSAllowsArbitraryLoads, NSExceptionDomains with NSExceptionAllowsInsecureHTTPLoads
• Disabled certificate pinning — custom URLAuthenticationChallenge handling that always trusts, ServerTrustPolicy.disableEvaluation
• Exposed secrets — hardcoded passwords, API keys, encryption keys in strings or class-dump output
• Jailbreak detection bypass — checks for /Applications/Cydia.app, canOpenURL("cydia://"), /bin/bash existence
• Weak crypto — MD5 hashing, ECB mode, hardcoded IVs/keys, CC_MD5 usage
• Keychain misuse — kSecAttrAccessibleAlways, missing access control flags
• Debug flags — #if DEBUG artifacts, staging URLs, verbose logging
• Privacy — clipboard access, pasteboard snooping, tracking without consent

See ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/references/api-extraction-patterns.md for the full list of security patterns.

Phase 7: LLM Deep Secret & Credential Analysis

Perform a comprehensive scan for cloud provider credentials, API keys, and secrets embedded in the binary. The LLM analyzes each finding to classify, assess risk, and provide remediation guidance.

Action: Run the deep secret scanner:

bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/deep-secret-scan.sh / --report secrets-report.md

False-positive minimization (built in): the scanner extracts candidate secrets by value (not grep line) and deduplicates, so a secret in 3 files is 1 finding. Each candidate is then validated against:

• a placeholder allowlist (AKIAIOSFODNN7EXAMPLE, your_key, sk_test/pk_test via a separate lower-severity pattern, `, placeholder`, etc.) → downgraded to INFO,
• a strict format/charset check per provider (AWS AKIA + 16, GCP AIza + 35, Stripe prefix + 24, JWT 3-segment header, etc.) → mismatch raises FP-likelihood,
• Shannon entropy (/ --raw --severity info --report secrets-raw.md

Targeted scans:
```bash
# Firebase / Google only
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/deep-secret-scan.sh / --firebase

# AWS only
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/deep-secret-scan.sh / --aws

# Azure only
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/deep-secret-scan.sh / --azure

# GCP only
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/deep-secret-scan.sh / --gcp

# Payment providers (Stripe, PayPal, RevenueCat)
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/deep-secret-scan.sh / --payments

# Messaging (Twilio, SendGrid, Slack, OneSignal)
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/deep-secret-scan.sh / --messaging

# Analytics (Sentry, Mixpanel, Amplitude, Segment)
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/deep-secret-scan.sh / --analytics

# JWT tokens
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/deep-secret-scan.sh / --jwt

# Developer-platform keys (GitHub, GitLab, Mailgun, Mailchimp, Telegram, Square)
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/deep-secret-scan.sh / --devtools

# Web3 keys (Infura, Alchemy, Ethereum private keys, PEM blocks)
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/deep-secret-scan.sh / --web3

# Critical and high severity only
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/deep-secret-scan.sh / --severity high --report secrets-report.md

LLM Analysis: After the scan completes, read the report and for each finding:

1. Classify — Identify the service and credential type
2. Assess if client-safe — Some keys are intended for client use (Firebase API keys, Stripe publishable keys)
3. Determine blast radius — What can an attacker do with this credential?
4. Check for false positives — Example values, documentation strings, test data
5. Suggest validation — Safe commands to test if the credential is active
6. Recommend remediation — Rotate, restrict API key, move to server-side, use environment config

Document each finding using this format:

### [SEVERITY] Service — Credential Type

- **Value**: `[first 4 chars]...[last 4 chars]` (redacted)
- **Location**: `file:line`
- **Client-safe**: Yes / No
- **Impact**: What an attacker could do
- **False positive likelihood**: Low / Medium / High
- **Validation**: How to test if active
- **Remediation**: Specific steps to fix

See ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/references/cloud-secrets-patterns.md for the full list of cloud provider patterns, key formats, and risk assessments.

Phase 8: Deep Binary Reversing with LLM Analysis

Use CLI reversing tools (radare2/rizin or Ghidra headless) to perform deep binary analysis. The LLM reads the structured output to identify security issues invisible to string/pattern matching alone.

Prerequisites: radare2/rizin or Ghidra must be installed. Install with:

bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/install-dep.sh radare2
# or
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/install-dep.sh ghidra

Action: Run the reversing analysis on the main binary:

# Full analysis (functions, strings, imports, exports, classes, security, network, crypto, auth, entropy)
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/reversing-analyze.sh  -o /reversing

# Qu

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [incogbyte](https://github.com/incogbyte)
- **Source:** [incogbyte/iOS-reverse-engineering-claude-skill](https://github.com/incogbyte/iOS-reverse-engineering-claude-skill)
- **License:** Unlicense

Install and usage instructions live in the source repository linked above.