{"id":"4ba717aa-23be-47c2-9dd6-30e2dfc66bf2","slug":"ios-reverse-engineering-skills","kind":"skill","name":"ios-reverse-engineering-skills","summary":"","owner":"saudgl","repoUrl":"https://github.com/saudgl/ios-reverse-engineering-skills","license":"MIT","licenseTier":"permissive","trust":"community","stars":5,"match":null,"fewStars":false,"format":"skill","createdAt":"2026-08-14T11:35:19.000Z","addedAt":"2026-10-21T23:38:59.882Z","logoUrl":"https://avatars.githubusercontent.com/u/20600858?u=cc543dc5cc1356b6e8bc2d625f06bebfe29ef530&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["writing"],"tags":[],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-26T04:49:20.989Z","sample":false,"url":"https://conduits.dev/tools/ios-reverse-engineering-skills","language":"Shell","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"<div align=\"center\">\n\n**[English](README.md)** · **[العربية](README.ar.md)**\n\n</div>\n\n# iOS Reverse Engineering Toolkit\n\n> 🌐 **This README is also available in Arabic:** [README.ar.md](README.ar.md)\n>\n> 🌐 **هذا الملف متوفر أيضًا باللغة العربية:** [README.ar.md](README.ar.md)\n\nA comprehensive toolkit and skill for extracting, analyzing, and auditing iOS applications — IPAs, `.app` bundles, Mach-O binaries, dynamic libraries, and frameworks. It automates class dumping, API endpoint extraction, call-flow tracing, secret/credential scanning, LLM-assisted binary reversing (Ghidra headless), SDK fingerprinting with CVE cross-referencing, anti-tampering detection, and a static vulnerability audit. Works with both Swift and Objective-C applications on macOS and Linux.\n\n## Features\n\n- **IPA / .app extraction** — Unpacks archives, locates the main Mach-O, runs class dumps, extracts `Info.plist`, entitlements, embedded frameworks, privacy manifests, and Mach-O header flags (PIE / hardened runtime).\n- **API endpoint extraction** — Detects HTTP APIs across URLSession, Alamofire, AFNetworking, Moya, GraphQL, and WebSocket, with deduplication and Markdown report generation.\n- **Call-flow tracing** — Guides analysis from `AppDelegate` / entry points down to the network layer through ViewControllers, ViewModels, repositories, and API clients.\n- **Deep secret & credential scanning** — Validates cloud credentials (Firebase, AWS, GCP, Azure, Stripe, GitHub, GitLab, web3, and more) with false-positive filtering, entropy checks, placeholder allowlists, and `client-safe` tagging.\n- **LLM-assisted binary reversing** — radare2/rizin and Ghidra headless analysis with decompilation, cross-references, call graphs, crypto usage, secret hunting, and string xrefs.\n- **SDK fingerprinting** — Identifies third-party SDKs, detects versions, and cross-references known CVEs.\n- **Anti-tampering detection** — Obfuscation, anti-debugging, dylib injection prevention, integrity checks, jailbreak detection, and FairPlay DRM, with a protection score (0–20).\n- **Static vulnerability audit** — Storage, WebView/JS-bridge, deeplink hijack, weak crypto/RNG, insecure deserialization, XXE / Zip Slip, ATS / cert-pinning misconfig, privacy, and Mach-O hardening checks.\n- **Cross-platform** — Fully functional on macOS and Linux (falls back to `ipsw`, `plistutil`, and Python where Apple's developer tools are unavailable).\n\n## Prerequisites\n\n| Tool | Purpose | Required |\n|------|---------|----------|\n| [ipsw](https://github.com/blacktop/ipsw) | Class dumping, Mach-O analysis, entitlements, thinning | Yes |\n| Xcode Command Line Tools (`otool`, `strings`, `plutil`, `codesign`, `lipo`) | Native analysis on macOS | macOS only |\n| [radare2](https://github.com/radareorg/radare2) / [rizin](https://github.com/rizinorg/rizin) | Deep binary analysis | Recommended |\n| [Ghidra](https://github.com/NationalSecurityAgency/ghidra) | Headless decompilation (Java scripts included) | Optional |\n| [jtool2](https://github.com/blacktop/ipsw) / frida | Deeper dynamic analysis | Optional |\n\n## Installation\n\nClone the repository and run the dependency checker:\n\n```bash\ngit clone https://github.com/saudgl/ios-reverse-engineering-skills.git\ncd ios-reverse-engineering-skills\n\nbash scripts/check-deps.sh\n```\n\nIf required dependencies are missing, install them automatically:\n\n```bash\nbash scripts/install-dep.sh ipsw\n# or manually, e.g. with Homebrew:\n# brew install blacktop/tap/ipsw\n```\n\n## Quick Start\n\n```bash\n# 1. Extract and analyze an IPA\nbash scripts/extract-ipa.sh App.ipa -o App-analysis\n\n# 2. Find API endpoints and generate a report\nbash scripts/find-api-calls.sh App-analysis/ --context 3 --dedup --report api-report.md\n\n# 3. Deep-scan for cloud credentials\nbash scripts/deep-secret-scan.sh App-analysis/ --report secrets-report.md\n\n# 4. Fingerprint embedded SDKs with CVE checks\nbash scripts/detect-sdks.sh App-analysis/ --check-cves --report sdks-report.md\n\n# 5. Detect anti-tampering protections\nbash scripts/detect-protections.sh App-analysis/ --report protections-report.md\n\n# 6. Audit for iOS vulnerability classes\nbash scripts/audit-vulnerabilities.sh App-analysis/ --all --report vuln-report.md\n\n# 7. Deep binary reversing with Ghidra headless (optional)\nbash scripts/reversing-analyze.sh --tool ghidra App-analysis/Payload/App.app/App -o App-analysis/reversing\n```\n\n## Scripts Overview\n\n| Script | Description |\n|--------|-------------|\n| `check-deps.sh` | Verifies required and optional tooling; prints machine-readable install instructions |\n| `install-dep.sh` | Installs a dependency via Homebrew or GitHub releases |\n| `extract-ipa.sh` | Extracts IPA / `.app` / Mach-O / `.dylib` / `.framework` artifacts into an analysis directory |\n| `find-api-calls.sh` | Searches for URLSession, Alamofire, AFNetworking, GraphQL, WebSocket, auth, and security patterns |\n| `deep-secret-scan.sh` | Validates cloud-provider credentials with FP filtering and severity rating |\n| `reversing-analyze.sh` | Runs radare2/rizin or Ghidra headless analysis (secrets, network, crypto, auth, entropy, callgraphs) |\n| `detect-sdks.sh` | Fingerprints third-party SDKs with version detection and CVE cross-referencing |\n| `detect-protections.sh` | Detects obfuscation, anti-debug, injection prevention, integrity checks, jailbreak detection |\n| `audit-vulnerabilities.sh` | Static audit of iOS vulnerability classes with severity / confidence / FP-likelihood |\n| `scripts/ghidra/*.java` | Ghidra headless scripts for decompilation, secrets, API calls, crypto usage, and string xrefs |\n\n## Workflow\n\n1. **Verify dependencies** — `check-deps.sh`, install anything missing.\n2. **Extract & dump classes** — `extract-ipa.sh` produces class dumps, plists, entitlements, frameworks, and Mach-O metadata.\n3. **Analyze structure** — Review `Info.plist`, entitlements, class-dump output, and embedded frameworks to map the architecture (MVC / MVVM / VIPER / Coordinator).\n4. **Trace call flows** — Follow entry points → ViewModels → repositories → API clients.\n5. **Extract & document APIs** — `find-api-calls.sh` plus per-endpoint documentation of method, path, params, headers, and call chain.\n6. **Security analysis** — ATS exceptions, cert pinning, exposed secrets, jailbreak detection, weak crypto, keychain misuse, debug artifacts.\n7. **Deep secret & credential analysis** — `deep-secret-scan.sh` with LLM triage (classify, assess blast radius, validate, remediate).\n8. **Deep binary reversing** — radare2/rizin or Ghidra headless with LLM review of decompiled functions, xrefs, and crypto usage.\n9. **SDK fingerprinting** — detect versions and cross-reference CVEs; assess attack surface and data flows.\n10. **Anti-tampering detection** — obfuscation, anti-debug, injection prevention, integrity, jailbreak; compute protection score.\n11. **Static vulnerability audit** — `audit-vulnerabilities.sh` across storage, WebView, deeplink, crypto, deserialization, parsing, ATS, privacy, and hardening.\n\n## Reports\n\nThe scripts generate structured Markdown reports automatically via `--report`:\n\n- `api-report.md` — Discovered endpoints with call flows\n- `secrets-report.md` — Validated credentials with FP-likelihood and client-safe tags\n- `sdks-report.md` — SDK inventory with versions and CVE matches\n- `protections-report.md` — Protection mechanisms and protection score\n- `vuln-report.md` — Vulnerability findings with severity / confidence / evidence\n\n## Project Structure\n\n```\nios-reverse-engineering/\n├── SKILL.md                    # Full skill definition and workflow\n├── scripts/                    # Analysis scripts (shell)\n│   ├── check-deps.sh\n│   ├── install-dep.sh\n│   ├── extract-ipa.sh\n│   ├── find-api-calls.sh\n│   ├── deep-secret-scan.sh\n│   ├── reversing-analyze.sh\n│   ├── detect-sdks.sh\n│   ├── detect-protections.sh\n│   ├── audit-vulnerabilities.sh\n│   └── ghidra/                 # Ghidra headless Java scripts\n└── references/                 # Detailed reference guides\n```\n\n## AI Assistant & Model Compatibility\n\nThis project is designed to be loaded as a **skill** by AI coding assistants. The skill itself is **model-agnostic** — it is a set of instructions plus shell/Ghidra scripts, so it runs under any LLM that can execute commands and read files. It has been verified with:\n\n| Assistant | Model | Skill directory |\n|-----------|-------|-----------------|\n| **opencode** | **DeepSeek** (and any model configured) | `~/.config/opencode/skills/` |\n| **Claude Code** | **Claude** (Anthropic) | `~/.claude/skills/` |\n| Any other agent tool | Any LLM | `~/.agents/skills/` or your tool's skill path |\n\nPoint your assistant's skill directory at this repository (or symlink it) so the workflow, phase-by-phase guidance, and helper scripts are available during iOS analysis sessions. The `SKILL.md` frontmatter (`compatibility: opencode`) enables automatic loading in opencode; for Claude Code, place the folder under `~/.claude/skills/`.\n\n## Security & Ethics\n\nThis toolkit is intended for **authorized security assessments** — analyzing apps you own or have explicit permission to test. Always comply with applicable laws and the target application's terms of service. Use responsibly.\n\n## References\n\nDetailed reference guides live in `references/`:\n\n- `setup-guide.md` — Installing ipsw, jtool2, frida, and optional tools\n- `class-dump-usage.md` — ipsw class-dump CLI options and Mach-O analysis\n- `api-extraction-patterns.md` — Library-specific search patterns and documentation template\n- `call-flow-analysis.md` — Techniques for tracing call flows\n- `cloud-secrets-patterns.md` — Cloud credential patterns and FP minimization\n- `reversing-tools-guide.md` — radare2, rizin, and Ghidra headless reference\n- `sdk-fingerprinting.md` — SDK fingerprint database and CVE reference\n- `anti-tampering-patterns.md` — Obfuscation, anti-debug, and injection prevention patterns\n- `vulnerability-patterns.md` — iOS vulnerability classes with FP notes and remediation\n\n## Author & Credits\n\nMaintained by **SaudGL** — [https://github.com/saudgl](https://github.com/saudgl)\n\nThis skill was originally derived from the **iOS Reverse Engineering Claude Skill** by **incogbyte**. We gratefully acknowledge the original author's work:\n\n- **incogbyte/iOS-reverse-engineering-claude-skill** — [https://github.com/incogbyte/iOS-reverse-engineering-claude-skill](https://github.com/incogbyte/iOS-reverse-engineering-claude-skill)\n\nThis fork ports the original Claude Code skill to opencode/DeepSeek while keeping it fully compatible with Claude Code and any other LLM-powered assistant.\n\n## License\n\nThis project is licensed under the **MIT License** — see the [LICENSE](LICENSE) file for details.\n\n```\nMIT License\n\nCopyright (c) 2026 SaudGL\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n```\n"}