Skip to main content

​
Before You Begin

Successful iOS reverse engineering requires a solid foundation in several technical areas. This guide outlines what you need to know before diving into the tools and techniques.
Don’t worry if you’re not an expert in all these areas. You can learn as you go, but familiarity with these concepts will significantly accelerate your progress.

​
Required Knowledge

​
iOS Development Basics

Understanding how iOS apps are built helps you reverse engineer them more effectively.
What you need to know:
  • How iOS applications are structured
  • Understanding of the app bundle format
  • Knowledge of Info.plist configuration files
  • Familiarity with app entitlements and code signing
Why it matters: You’ll be examining these structures when analyzing IPA files. Knowing what to expect helps you identify anomalies and interesting components.
What you need to know:
  • Objective-C syntax and message passing
  • Understanding of selectors and method signatures
  • Knowledge of runtime features and dynamic dispatch
  • Familiarity with common iOS frameworks (UIKit, Foundation)
Why it matters: Many iOS apps still use Objective-C, and even Swift apps often interact with Objective-C frameworks. Understanding the runtime is crucial for identifying swizzling and other manipulation techniques.
What you need to know:
  • Swift syntax and language features
  • Understanding of name mangling in Swift
  • Knowledge of Swift’s ABI and calling conventions
  • Familiarity with Swift standard library
Why it matters: Modern iOS apps are increasingly written in Swift. Swift uses name mangling extensively, which makes the Swift Name Demangler script essential for analysis.

​
Assembly Language & Binary Analysis

Reverse engineering ultimately comes down to understanding compiled code.

ARM64 Assembly

Required Skills:
  • Reading ARM64 (AArch64) assembly instructions
  • Understanding common ARM64 calling conventions
  • Recognizing function prologues and epilogues
  • Basic knowledge of ARM64 registers and their purposes
All modern iOS devices use ARM64 processors, so this is non-negotiable for serious reverse engineering work.

Binary File Formats

Required Skills:
  • Understanding Mach-O file format structure
  • Knowledge of executable sections (.text, .data, etc.)
  • Familiarity with symbol tables and dynamic linking
  • Understanding of load commands and segments
iOS binaries use the Mach-O format, which differs from ELF (Linux) and PE (Windows) formats.

​
Security Concepts

1

Code Obfuscation Techniques

Understand common obfuscation methods:
  • Control flow flattening
  • String encryption
  • Symbol stripping
  • Dead code insertion
The example IPA files in this repository demonstrate these techniques in practice.
2

Runtime Manipulation

Familiarize yourself with runtime modification techniques:
  • Method swizzling (changing method implementations at runtime)
  • Dynamic library injection
  • Runtime hooks and interception
  • Jailbreak detection mechanisms
3

Code Signing & Entitlements

Understand iOS security model:
  • How code signing works on iOS
  • App entitlements and capabilities
  • App sandboxing and permission model
  • Certificate pinning and network security

​
Required Software

Ensure you have the following installed before proceeding to the setup guide:

​
Essential Tools

Ghidra

Version: Latest stable release recommendedFree and open-source reverse engineering framework developed by the NSA. This is your primary analysis tool.Download Ghidra →

Swift

Version: Swift 5.0 or laterRequired for the Swift Name Demangler script to function. The script uses swift-demangle (or xcrun swift-demangle on macOS).Install Swift →

Python

Version: Python 2.7 (Ghidra’s Jython environment)Ghidra scripts run in Jython, which is based on Python 2.7. No separate installation needed if you have Ghidra.

Java

Version: Java 11 or laterRequired to run Ghidra. OpenJDK or Oracle JDK both work.Download Java →

​
Operating System Requirements

Recommended for iOS reverse engineeringAdvantages:
  • Native Swift tools (xcrun swift-demangle)
  • Can run iOS Simulator for dynamic analysis
  • Access to Xcode and iOS SDKs
  • Better compatibility with iOS tooling
Minimum Version: macOS 10.14 or later
While not strictly required, these skills will enhance your reverse engineering capabilities:

Debugging Experience

Experience with debuggers (lldb, gdb) helps you understand program execution flow and state inspection.

Network Analysis

Understanding HTTP/HTTPS, certificate pinning, and tools like Wireshark or Charles Proxy for traffic inspection.

Cryptography Basics

Familiarity with common encryption algorithms helps identify crypto implementations in binaries.

Scripting Skills

Python scripting ability to customize and extend the provided Ghidra scripts for your specific needs.

​
Skill Assessment

Use this checklist to evaluate your readiness:
  • I can read basic ARM64 assembly code
  • I understand how iOS apps are structured
  • I’m familiar with either Objective-C or Swift
  • I know what method swizzling is
  • I understand the Mach-O file format basics
  • I have used a disassembler or decompiler before
  • I understand what code obfuscation is and why it’s used
  • I have Ghidra, Swift, and Java installed
If you checked fewer than 5 items, consider spending time learning these fundamentals before proceeding. The setup guide assumes you have this baseline knowledge.

​
Learning Resources

If you need to strengthen your foundation:

iOS RE Wiki

The comprehensive wiki contains detailed guides and reference materials

ARM64 Documentation

Official ARM documentation for understanding the instruction set

Swift Internals

Swift open source project to understand language internals

Ghidra Documentation

Official Ghidra courses and documentation

​
Next Steps

Once you’ve confirmed you have the necessary prerequisites:

Proceed to Setup

Continue to the setup guide to configure your iOS reverse engineering environment

Build docs developers (and LLMs) love

Get started for freeTalk to us