iOS Reverse Engineering

Extract and analyze iOS IPA files, .app bundles, Mach-O binaries, dynamic libraries, and frameworks using ipsw (blacktop/ipsw), otool, strings, radare2/rizin, and Ghidra headless. Trace call flows through application code, analyze security patterns, deep-scan for cloud provider credentials (Firebase, GCP, AWS, Azure), perform LLM-assisted binary reversing with decompilation and Ghidra headless scripts, fingerprint embedded third-party SDKs with version detection and CVE cross-referencing, and detect anti-tampering protections (obfuscation tools, anti-debugging, dylib injection prevention, integrity checks, jailbreak detection). Produce structured documentation of extracted APIs and security findings. Works with both Swift and Objective-C applications.

Prerequisites

This skill requires ipsw (which includes class-dump functionality and much more) and, on macOS, the standard developer tools (otool, strings, plutil, codesign) via Xcode Command Line Tools. For deep binary analysis, radare2 (or rizin) is recommended; Ghidra headless is optional for advanced decompilation. On Linux, ipsw provides cross-platform Mach-O analysis, entitlements, class-dump and thinning; libplist/plistutil (or python3 plistlib) provide plist parsing; binutils provides strings/nm. otool/codesign/plutil/PlistBuddy/lipo are macOS-only and the scripts fall back to ipsw/plistutil/python3 automatically — no macOS tools required on Linux. Run the dependency checker to verify:

bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/check-deps.sh

If anything is missing, follow the installation instructions in ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/references/setup-guide.md.

Workflow

Phase 1: Verify and Install Dependencies

Before analyzing, confirm that the required tools are available — and install any that are missing.