Static Analysis Techniques

Overview

Static analysis involves examining an iOS application without executing it. This technique allows you to understand app structure, identify vulnerabilities, and analyze code logic before runtime.

Static analysis is non-invasive and leaves no traces on the device, making it ideal for initial reconnaissance.

Disassembly and Decompilation

Using Hopper Disassembler

Hopper is a powerful tool for disassembling iOS binaries and generating pseudo-code.

Extract the IPA

Obtain the decrypted IPA file and extract the main binary:

unzip MyApp.ipa
cd Payload/MyApp.app
file MyApp  # Verify it's a Mach-O binary

Load in Hopper

Open the binary in Hopper and wait for analysis to complete. This may take several minutes for large applications.

Generate Pseudo-code

Navigate to interesting methods and press ‘Alt+Enter’ to view decompiled pseudo-code.

; Method: -[LoginViewController validateCredentials:]
_objc_msgSend:
    mov     x0, x19
    adrp    x1, #0x100008000
    ldr     x1, [x1, #0x890]
    bl      _objc_msgSend
    cbz     x0, loc_invalid

Ghidra for iOS Analysis

Ghidra is a free alternative with powerful analysis capabilities.

Setting up Ghidra for iOS

Install Ghidra and the iOS loader plugin
Create a new project and import the Mach-O binary
Run auto-analysis (Analysis > Auto Analyze)
Use the Decompiler window (Window > Decompiler)

Enable the “Objective-C” analyzer for better class and method recognition.

Reading Assembly Code

ARM64 Assembly Basics

Modern iOS devices use ARM64 architecture. Understanding key instructions is essential.

Data Movement

mov - Move data between registers
ldr - Load from memory
str - Store to memory
adrp - Load page address

Branching

b - Unconditional branch
bl - Branch with link (call)
ret - Return from function
cbz/cbnz - Conditional branches

Arithmetic

add/sub - Addition/Subtraction
mul - Multiplication
cmp - Compare values
and/orr - Logical operations

Objective-C Runtime

_objc_msgSend - Method calls
_objc_retain/_objc_release - Memory management
_objc_getClass - Class lookup

Practical Example: Finding Authentication Logic

Scenario
Approach
Assembly Analysis

You need to understand how an app validates premium subscriptions.

; -[SubscriptionManager isPremiumUser]
sub     sp, sp, #0x20
stp     x29, x30, [sp, #0x10]
add     x29, sp, #0x10

; Load receipt data
adrp    x8, #_OBJC_IVAR_$_SubscriptionManager._receipt@PAGE
ldr     x8, [x8, #_OBJC_IVAR_$_SubscriptionManager._receipt@PAGEOFF]
ldr     x0, [x0, x8]

; Check if receipt is nil
cbz     x0, loc_return_false

; Validate expiry date
adrp    x1, #selRef_expiryDate@PAGE
ldr     x1, [x1, #selRef_expiryDate@PAGEOFF]
bl      _objc_msgSend

; Compare with current date
...

Identifying Security Vulnerabilities

Common Vulnerability Patterns

Hardcoded Credentials

Search for suspicious string patterns:

strings MyApp | grep -i "password\|secret\|apikey\|token"

Look for:

API keys in plaintext
Default passwords
Encryption keys
Authentication tokens

Hardcoded credentials are one of the most common vulnerabilities in iOS apps.

Insecure Data Storage

Check for usage of insecure storage mechanisms:

NSUserDefaults for sensitive data
Unencrypted plist files
World-readable files in Documents directory

Search for these patterns in pseudo-code:

[NSUserDefaults standardUserDefaults] setObject:password forKey:@"pwd"
[sensitiveData writeToFile:path atomically:YES]

Weak Cryptography

Identify weak or custom crypto implementations:Red flags:

Custom encryption algorithms
ECB mode encryption
Hardcoded IV values
MD5/SHA1 for password hashing

// Example of weak crypto
CCCrypt(kCCEncrypt, kCCAlgorithmDES, kCCOptionECBMode, ...)

Look for CommonCrypto API calls with weak algorithms.

Jailbreak Detection

Identifying jailbreak detection helps you bypass it:Common detection methods:

File existence checks (/Applications/Cydia.app)
Fork() system call
Symbolic link verification
Sandbox integrity checks

if ([[NSFileManager defaultManager] fileExistsAtPath:@"/Applications/Cydia.app"]) {
    return YES; // Jailbroken
}

String Analysis

Extracting Strings

Strings often reveal critical information about app functionality.

strings MyApp > app_strings.txt

Finding String References

Locate interesting strings

Find strings related to your target functionality:

strings MyApp | grep -i "premium\|purchase\|subscription"

Find cross-references

In Hopper or Ghidra:

Navigate to the Strings section
Find your target string
View cross-references (X-refs) to see where it’s used

Analyze calling functions

Examine the functions that reference these strings to understand the logic.

URL and Endpoint Discovery

API Endpoints
URL Schemes
Info.plist Analysis

strings MyApp | grep -E "^https?://" | sort -u

This reveals:

API base URLs
Analytics endpoints
Debug/staging servers
Third-party integrations

strings MyApp | grep "://" | grep -v "http"

Discovers custom URL schemes for deep linking.

Extract and analyze the Info.plist:

plutil -convert xml1 Info.plist -o -

Look for:

URL schemes (CFBundleURLTypes)
App Transport Security exceptions
Required device capabilities

Practical Workflow

Initial Reconnaissance

Extract IPA and identify target binary
Run file, otool, and strings for basic info
Extract Info.plist and analyze configurations

Load in Disassembler

Import binary into Hopper or Ghidra
Wait for auto-analysis to complete
Export class dumps for reference

String Analysis

Search for relevant keywords
Map string references to functionality
Document API endpoints and secrets

Code Analysis

Navigate to target methods
Generate pseudo-code
Document control flow and logic
Identify vulnerabilities

Documentation

Create detailed notes
Screenshot key findings
Map out app architecture
Plan dynamic analysis targets

Static analysis complete when you have:

Understanding of app architecture
List of interesting methods and classes
Identified potential vulnerabilities
API endpoints and authentication mechanisms
Targets for dynamic analysis

Advanced Techniques

Class-dump Analysis

Generate Objective-C headers from the binary:

class-dump -H MyApp -o ./Headers/

Class dumps provide a clean view of all classes, methods, and properties without assembly.

Control Flow Analysis

Use Ghidra’s function graph view to:

Visualize execution paths
Identify error handling
Find unused/dead code
Understand complex conditionals

Binary Diffing

Compare different versions to find changes:

# Using radare2
r2 -A old_binary
# In another terminal
r2 -A new_binary
# Use radiff2 for comparison
radiff2 -g main old_binary new_binary > diff.dot

Binary diffing is invaluable for finding security patches and understanding update changes.

Resources

Hopper

Commercial disassembler for macOS

Ghidra

NSA’s free reverse engineering tool

class-dump

Generate Objective-C headers

ARM64 Reference

Official ARM architecture documentation

Get Started

Fundamentals

Analysis Tools

Analysis Techniques

Swift & Objective-C

Obfuscation

Overview

Disassembly and Decompilation

Using Hopper Disassembler

Ghidra for iOS Analysis

Reading Assembly Code

ARM64 Assembly Basics

Data Movement

Branching

Arithmetic

Objective-C Runtime

Practical Example: Finding Authentication Logic

Identifying Security Vulnerabilities

Common Vulnerability Patterns

String Analysis

Extracting Strings

Finding String References

URL and Endpoint Discovery

Practical Workflow

Advanced Techniques

Class-dump Analysis

Control Flow Analysis

Binary Diffing

Resources

Hopper

Ghidra

class-dump

ARM64 Reference

Build docs developers (and LLMs) love

Get Started

Fundamentals

Analysis Tools

Analysis Techniques

Swift & Objective-C

Obfuscation

​Overview

​Disassembly and Decompilation

​Using Hopper Disassembler

​Ghidra for iOS Analysis

​Reading Assembly Code

​ARM64 Assembly Basics

Data Movement

Branching

Arithmetic

Objective-C Runtime

​Practical Example: Finding Authentication Logic

​Identifying Security Vulnerabilities

​Common Vulnerability Patterns

​String Analysis

​Extracting Strings

​Finding String References

​URL and Endpoint Discovery

​Practical Workflow

​Advanced Techniques

​Class-dump Analysis

​Control Flow Analysis

​Binary Diffing

​Resources

Hopper

Ghidra

class-dump

ARM64 Reference

Build docs developers (and LLMs) love

Overview

Disassembly and Decompilation

Using Hopper Disassembler

Ghidra for iOS Analysis

Reading Assembly Code

ARM64 Assembly Basics

Practical Example: Finding Authentication Logic

Identifying Security Vulnerabilities

Common Vulnerability Patterns

String Analysis

Extracting Strings

Finding String References

URL and Endpoint Discovery

Practical Workflow

Advanced Techniques

Class-dump Analysis

Control Flow Analysis

Binary Diffing

Resources