reverse-engineering-ios-app-with-frida

# Reverse Engineering iOS App with Frida ## When to Use Use this skill when: - Analyzing iOS app internals during authorized security assessments without source code - Extracting encryption keys, API secrets, or proprietary protocol details from running iOS apps - Understanding obfuscated Swift/Objective-C logic through runtime method tracing - Bypassing complex security mechanisms (jailbreak detection, anti-tampering, anti-debugging) **Do not use** this skill for unauthorized reverse engineering that violates terms of service or intellectual property law. ## Prerequisites - Jailbroken iOS device with Frida server installed via Cydia/Sileo, or non-jailbroken device with Frida Gadget-injected IPA - Python 3.10+ with `frida-tools` (`pip install frida-tools`) - USB connection to iOS device - class-dump or dsdump for Objective-C header extraction - Hopper Disassembler or Ghidra for static binary analysis (complementary) - Knowledge of Objective-C runtime and Swift name mangling ## Workflow ### Step 1: Extract and Analyze the Binary ```bash # On jailbroken device, find app binary ssh root@<device_ip> find /var/containers/Bundle/Application/ -name "TargetApp" -type f # Pull decrypted binary (apps from App Store are encrypted with FairPlay) # Use frida-ios-dump or Clutch for decryption pip install frida-ios-dump dump.py com.target.app # Extract Objective-C class headers class-dump -H decrypted_binary -o headers/ ls headers/ # Lists all class header files ``` ### Step 2: ...