iOS binary analysis: Mach-O, Objective-C and Swift
You read an iOS app's binary statically: you take apart the Mach-O structure, load commands and Objective-C and Swift metadata, and find security checks and embedded secrets in the pseudocode.
Level 401 · 18 lessons · 15 practice labs
Lessons
Mach-O
- The Mach-O structure: header, load commands, segments
- Multi-architecture binaries and arm64e
- Linked libraries, frameworks and search paths
- The encryption info command and the signature blob
- The symbol table, stripping and dSYM files
- Short task: extract a binary's architecture, linked frameworks and protection flags
Objective-C and Swift metadata
- Objective-C runtime data: classes and selectors
- Reading a class dump: guessing function from the interface
- Demangling Swift names and type metadata
- Finding the interesting methods: authentication, crypto, environment checks
- String sections: C strings, CFStrings and Swift strings
- Short task: map the classes and methods that handle sessions from a class dump
Reading pseudocode
- ARM64 for iOS: objc_msgSend and the Swift calling convention
- Decompiling a Mach-O with Ghidra
- Crypto use and embedded keys in the binary
- Evaluating environment and integrity checks
- Short task: find the encryption key embedded in a binary and write the recommended fix
Capstone
- Capstone: write the binary review note and developer advice for a ticketing app
Practice labs
- Extract a binary's architecture and linked frameworks: Read the header and load commands with llvm-otool.
- Check the encryption info and protection flags: Verify the encryption command and the PIE and stack canary markers.
- Measure whether symbols were stripped: Compare the symbol tables of two builds and report the debug symbols left in release.
- List the class names from a class dump: Run the dump tool and state the class count.
- Map the classes that handle sessions: Extract the classes and methods related to session, token and storage from the interfaces.
- Demangle Swift names and find the authentication methods: Demangle the names and prepare a list of authentication and environment check methods.
- Extract the URLs and strings in a binary: List the URLs from the string sections.
- Find the encryption key embedded in a binary: Find the key-like constant and show which method uses it.
- Confirm string findings with pseudocode: Decide whether three found constants are really secrets by looking at their use in Ghidra output.
- Find a method in Ghidra and read its pseudocode: Explain the given method's return value.
- Extract the parameters of a crypto call: Determine from pseudocode the mode, key and IV passed to the cipher function.
- Evaluate the environment and integrity checks: Write as a developer note where the checks are called, what they look at and whether they hinge on one point.
- Write a binary finding in language a developer follows: Write the embedded key finding with a source-level fix recommendation.
- Combine binary and package findings: Merge what came out of the IPA review and the binary review into one deduplicated table.
- Write the binary review note for a ticketing app: Deliver structure, metadata, secret and check findings together with developer advice.
About this course
You read an iOS app's binary statically: you take apart the Mach-O structure, load commands and Objective-C and Swift metadata, and find security checks and embedded secrets in the pseudocode.
What you will learn
- Mach-O
- Objective-C and Swift metadata
- Reading pseudocode
- Capstone
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.