Reverse Engineering iOS App with Frida
When to Use
Use this skill when:
- Analyzing iOS app internals during authorized security assessments without source code
- Extracting encryption keys, API secrets, or proprietary protocol details from running iOS apps
- Understanding obfuscated Swift/Objective-C logic through runtime method tracing
- Bypassing complex security mechanisms (jailbreak detection, anti-tampering, anti-debugging)
Do not use this skill for unauthorized reverse engineering that violates terms of service or intellectual property law.
Prerequisites
- Jailbroken iOS device with Frida server installed via Cydia/Sileo, or non-jailbroken device with Frida Gadget-injected IPA
- Python 3.10+ with
frida-tools (pip install frida-tools)
- USB connection to iOS device
- class-dump or dsdump for Objective-C header extraction
- Hopper Disassembler or Ghidra for static binary analysis (complementary)
- Knowledge of Objective-C runtime and Swift name mangling
Workflow
Step 1: Extract and Analyze the Binary
ssh root@<device_ip>
find /var/containers/Bundle/Application/ -name "TargetApp" -type f
pip install frida-ios-dump
dump.py com.target.app
class-dump -H decrypted_binary -o headers/
ls headers/
Step 2: Enumerate Classes and Methods at Runtime
Java.perform(function() {});
if (ObjC.available) {
var classes = ObjC.classes;
for (var className in classes) {
if (className.indexOf("Target") !== -1 ||
className.indexOf("Auth") !== -1 ||
className.indexOf("Crypto") !== -1) {
console.log("[Class] " + className);
var methods = classes[className].$ownMethods;
for (var i = 0; i < methods.length; i++) {
console.log(" [Method] " + methods[i]);
}
}
}
}
frida -U -n TargetApp -l enumerate_classes.js
Step 3: Trace Method Calls with frida-trace
frida-trace -U -n TargetApp -m "*[TargetAuth *]"
frida-trace -U -n TargetApp -m "*[*Crypto* *]"
frida-trace -U -n TargetApp -m "*[*KeyChain* *]"
frida-trace -U -n TargetApp -m "*[*Token* *]"
frida-trace -U -n TargetApp -m "*[*$s*Auth*]"
Step 4: Hook and Modify Method Behavior
if (ObjC.available) {
var AuthManager = ObjC.classes.AuthManager;
if (AuthManager) {
Interceptor.attach(AuthManager["- validateToken:"].implementation, {
onEnter: function(args) {
var token = new ObjC.Object(args[2]);
console.log("[Auth] validateToken called with: " + token.toString());
},
onLeave: function(retval) {
console.log("[Auth] validateToken returned: " + retval);
}
});
}
var CCCrypt = Module.findExportByName("libcommonCrypto.dylib", "CCCrypt");
() {
.(, {
: () {
. = args[].();
. = args[].();
. = args[].();
. = .(args[], .);
.( + (. === ? : ));
.( + (.));
},
: () {
.( + retval);
}
});
}
}
() {
bytes = (buffer);
hex = [];
( i = ; i < bytes.; i++) {
hex.(( + bytes[i].()).(-));
}
hex.();
}
Step 5: Analyze Swift Code
if (ObjC.available) {
var swiftClasses = Object.keys(ObjC.classes).filter(function(name) {
return name.indexOf("_TtC") === 0 || name.indexOf("TargetApp.") !== -1;
});
swiftClasses.forEach(function(className) {
console.log("[Swift] " + className);
var methods = ObjC.classes[className].$ownMethods;
methods.forEach(function(method) {
console.log(" " + method);
});
});
}
Module.enumerateExports("TargetApp", {
onMatch: function(exp) {
if (exp..() !== - || exp..() !== -) {
.( + exp. + + exp.);
}
},
: () {}
});
Step 6: Extract Secrets and Proprietary Data
if (ObjC.available) {
var NSUserDefaults = ObjC.classes.NSUserDefaults;
Interceptor.attach(NSUserDefaults["- objectForKey:"].implementation, {
onEnter: function(args) {
this.key = new ObjC.Object(args[2]).toString();
},
onLeave: function(retval) {
if (retval.isNull()) return;
var value = new ObjC.Object(retval);
console.log("[NSUserDefaults] " + this.key + " = " + value.toString());
}
});
var SecItemCopyMatching = Module.findExportByName("Security", "SecItemCopyMatching");
Interceptor.(, {
: () {
query = .(args[]);
.( + query.());
},
: () {
.( + retval);
}
});
}
Key Concepts
| Term | Definition |
|---|
| Objective-C Runtime | Dynamic runtime enabling method dispatch, class introspection, and method swizzling at runtime |
| Swift Name Mangling | Compiler-applied encoding of Swift function signatures into linker-compatible symbol names |
| FairPlay DRM | Apple's encryption applied to App Store binaries; must be decrypted before static analysis |
| class-dump | Tool extracting Objective-C class declarations from Mach-O binaries for header-level analysis |
| CommonCrypto | Apple's C-level cryptographic library; primary target for encryption key extraction via Frida hooks |
Tools & Systems
- Frida: Dynamic instrumentation framework for iOS runtime hooking and method interception
- frida-trace: Automated tracing utility that generates handler stubs for matched methods
- frida-ios-dump: Tool for decrypting FairPlay-protected iOS apps via memory dumping
- class-dump / dsdump: Objective-C header extraction from Mach-O binaries
- Ghidra: NSA's reverse engineering framework for static ARM64 binary analysis of iOS apps
Common Pitfalls
- FairPlay encryption: Apps downloaded from the App Store are encrypted. You must decrypt before static analysis. Use frida-ios-dump on a jailbroken device.
- Swift-only classes: Pure Swift classes without
@objc annotation are not visible through ObjC.classes. Use Module.enumerateExports() instead.
- Stripped binaries: Release builds strip debug symbols. Combine frida-trace with class-dump output for effective analysis.
- Anti-Frida measures: Sophisticated apps check for Frida artifacts (frida-server process, Frida agent strings in memory, injected libraries in dyld). Use stealthy Frida builds or Frida Gadget injection.
