Save 37% off PRO during our Black Friday Sale! »

Reverse Engineering iOS Apps

Reverse Engineering iOS Apps

Talk given at Swift Language User Group in SF on 20 August 2015

If you've ever needed to know how another piece of code works, or if you've ever been at the mercy of someone else's bugs – you can always look at the source code... unless you don't have it. I'll be giving an introduction to the art of reverse engineering on iOS and OS X, including Swift apps. I'll be cover sniffing network traffic as well as static and dynamic analysis, with tools like Charles, cycript, IDA, Hopper and class-dump.


Conrad Kramer

August 20, 2015


  1. Reverse Engineering iOS Apps with Swi' Conrad Kramer @conradev

  2. Reverse Engineering Analyzing out how something works by examining the

    final product.
  3. Opera&ng the tools Knowing what to look for

  4. Frame the ques,on Why does this bug occur? What component

    do they use in their UI? What does the app's REST API look like?
  5. Test Subject: Ly# (Wri%en en)rely in Swy.)

  6. Ques%ons What does Ly,'s REST API look like? How does

    Ly*'s URL scheme work?
  7. What is in the Ly, app? • Metadata • Assets

    • Executable (Encrypted) • Lots of frameworks (Encrypted)
  8. What can we work with? • When it is running

    • Network traffic • Injec6ng code • When it isn't running • Inspec6ng the binaries
  9. Inspect Network Traffic using Charles

  10. HTTP(S) Proxy Performs SSL man-in-the-middle Pre$y prints JSON, YAML, XML,

    Mul8part, Form encoding, etc.
  11. Inject Code using cycript (jailbreak required for third party apps)
  12. Cycript JavaScript/Objec/ve-C hybrid Interact with the app using the REPL,

    live: var application = [UIApplication sharedApplication]; [application openURL:[NSURL URLWithString:@""]];
  13. Decrypt The Executable with dumpdecrypted (jailbreak required)

  14. Analyze The Executable using IDA Pro

  15. Swi$ vs. Swi$ assembly is more verbose Swi$ class

    informa/on is harder to extract
  16. Looking at -applica.on:openURL: _TZFV4Lyft15DeepLinkManager13handleOpenURLfMS0_FC So5NSURLSb Mangled symbol name

  17. Looking at -applica.on:openURL: _TZFV4Lyft15DeepLinkManager13handleOpenURLfMS0_FC So5NSURLSb • _T -> Swi( symbol

    • F -> Func3on • 4Lyft -> Module name • A lot more informa3on (see Mike Ash's Friday Q&A)
  18. Looking at -applica.on:openURL: var url = NSURL(string: "lyft://") var manager

    : Lyft.DeepLinkManager = ... manager.handleOpenURL(url)
  19. Think like the developer

  20. Looking at Ly+.DeepLinkManager • DeepLinkRequest • DeepLinkable • DeepLinkToRide •

    DeepLinkToHelp • DeepLinkToSe6ngs • DeepLinkToDriveMode • etc.
  21. Looking at Ly+.DeepLinkManager lyft://action?paramter=value

  22. Looking at Ly+.DeepLinkToRide lyft://ridetype ?id=lyft_line &pickup[latitude]=0 &pickup[longitude]=0 &destination[latitude]=0 &destination[longitude]=0

  23. Thanks!