| name | ios-reverse-engineering |
| description | Authorized static iOS reverse engineering workflow for IPA, .app, Mach-O, framework, dylib, and dSYM artifacts. Extracts Info.plist, entitlements, Mach-O architecture, load commands, linked libraries, symbols, strings, Objective-C and Swift traces, embedded frameworks, URL schemes, associated domains, hardcoded URLs, domains, REST paths, GraphQL hints, WebSocket hints, and structured reports. |
| when_to_use | Use when the user asks to analyze an authorized iOS app or binary artifact, inventory an IPA/.app/framework/dylib/dSYM, extract iOS metadata, inspect Mach-O structure, identify linked libraries or symbols, or produce a static reverse engineering report without bypassing DRM or attacking services. |
| argument-hint | <authorized IPA|.app|Mach-O|framework|dylib|dSYM> [output_dir] |
| disable-model-invocation | false |
| allowed-tools | ["Bash","Read","Write","Glob","Grep","LS"] |
iOS Reverse Engineering
Use this skill for authorized static analysis of iOS artifacts. Keep the workflow offline and evidence-focused: identify what is present in the artifact, record limitations, and do not interact with real backends.
Safety Rules
- Only analyze artifacts the user is authorized to inspect.
- Do not bypass FairPlay DRM, app-store encryption, account protections, certificate pinning, or legal restrictions.
- Do not extract, exfiltrate, validate, or use account credentials, tokens, cookies, or session material.
- Do not attack, fuzz, replay, or probe real production services discovered in strings.
- If a binary is encrypted or analysis is limited, report the limitation and request an authorized debug, enterprise, decrypted, or source-derived build.
Quick Workflow
Run the bundled scripts from scripts/ in this order. The output directory defaults to ios_analysis_out.
scripts/check_deps.sh
scripts/ios_unpack.sh <target> [output_dir]
scripts/ios_fingerprint.sh <target> [output_dir]
scripts/ios_macho_analyze.sh <target> [output_dir]
scripts/ios_class_scan.sh [output_dir]
scripts/ios_api_scan.py [output_dir]
scripts/ios_report.py [output_dir]
The final report is written to:
<output_dir>/analysis-report.md
The endpoint and API clue inventory is written to:
<output_dir>/endpoints.json
What To Inspect
- App identity:
Info.plist, bundle ID, executable name, version, URL schemes, associated domains.
- Entitlements: app groups, keychain groups, associated domains, push, iCloud, network extension, app sandbox signals.
- Bundle layout: embedded frameworks, dylibs, app extensions, watch apps, resources, dSYM DWARF files.
- Mach-O: architecture slices, encryption load commands, linked libraries, rpaths, symbols, Objective-C metadata, Swift symbols, strings.
- API clues: hardcoded URLs, domains, REST-like paths, GraphQL operations, WebSocket schemes, and client framework names.
References
Load these only when useful:
references/ios-analysis-checklist.md for a phase-by-phase analysis checklist.references/macho-notes.md for Mach-O command and symbol interpretation notes.references/api-extraction-patterns.md for API clue triage patterns.
Reporting Guidance
Reports should distinguish facts from inference. Prefer concise evidence with file paths and generated artifact names. When symbols are stripped, Swift metadata is sparse, or the binary is encrypted, state that clearly instead of guessing.
