ida-assisted-ios-analysis

name	ida-assisted-ios-analysis
description	Optional IDA Pro MCP assisted iOS Mach-O analysis for authorized targets. Use after the base ios-reverse-engineering skill when the user wants deeper IDA-backed function, import, export, string, xref, endpoint, caller/callee, Objective-C, Swift, or network evidence analysis. Does not make IDA a hard dependency.
when_to_use	Use when the user asks to use IDA, IDA Pro, ida-pro-mcp, MCP-assisted reverse engineering, IDB analysis, deeper function call flow analysis, xrefs for endpoint strings, or IDAPython export against an authorized iOS Mach-O or IDB.
argument-hint	<authorized Mach-O|IDA IDB|analysis output dir> [output_dir]
disable-model-invocation	false
allowed-tools	["Bash","Read","Write","Glob","Grep","LS","mcp__ida__*"]

IDA Assisted iOS Analysis

This is an optional enhancement for authorized iOS Mach-O analysis. The base ios-reverse-engineering workflow must remain usable without IDA, IDA MCP, or an IDB.

Safety Rules

• Only analyze binaries or IDBs the user is authorized to inspect.
• Keep analysis static unless the user explicitly provides an authorized lab runtime scope.
• Do not bypass FairPlay DRM, steal tokens, bypass certificate pinning, or attack discovered services.
• Treat endpoint strings as evidence, not permission to make network requests.

MCP Availability

The plugin root includes .mcp.json with a default MCP server named ida using:

{
  "command": "ida-pro-mcp"
}

Before using IDA MCP, run:

bin/ida-pro-mcp-check

If ida-pro-mcp is missing, report that IDA-assisted analysis is unavailable and continue with the base static workflow if useful.

Workflow

1. Verify ida-pro-mcp and IDA Pro availability with bin/ida-pro-mcp-check.
2. Ask the user to open the authorized Mach-O or IDB in IDA if the MCP server requires an active IDA session.
3. Verify MCP connectivity with the available IDA MCP status or metadata tool.
4. Confirm the loaded file matches the requested Mach-O or IDB.
5. List functions, imports, exports, and strings.
6. Search for:
   • URLSession
   • NSURLRequest
   • Alamofire
   • AFNetworking
   • Apollo
   • GraphQL
   • WebSocket
   • token
   • authorization
   • signature
   • hmac
   • nonce
   • timestamp
7. For endpoint strings, run xref analysis from each string address.
8. For each referencing function, inspect callers and callees.
9. Decompile or disassemble narrow target functions only when needed for evidence.
10. Write:
    • ida-findings.md
    • ida-call-flow.md
    • ida-network-evidence.json

IDAPython Export Template

If MCP tooling supports running scripts, use:

scripts/ida_export_template.py

Set IDA_IOS_OUT or pass an output directory argument so the script writes the three ida-* files to the desired folder.

Reference

Read references/ida-mcp-workflow.md for detailed MCP and IDAPython guidance.