Hopper Disassembler

Hopper Disassembler is a macOS and Linux reverse engineering tool that excels at analyzing iOS binaries. Its native macOS integration and intuitive interface make it a popular choice for iOS researchers.

Overview

Hopper is a commercial disassembler that offers:

Native Mach-O binary support
Excellent Objective-C and Swift class extraction
Interactive control flow graphs
Built-in decompiler (pseudo-code generation)
Fast analysis and responsive UI

Hopper is particularly strong for Objective-C analysis and provides a more polished UI experience compared to open-source alternatives.

Features for iOS Analysis

Automatic Class Detection

Hopper automatically detects and organizes Objective-C and Swift classes:

Class Browser

The left sidebar displays all detected classes in a hierarchical tree:

Objective-C classes with full method lists
Swift classes (with mangled names that can be demangled)
Protocols and categories

Method Navigation

Click any method to navigate directly to its implementation:

@interface LoginViewController : UIViewController
- (void)loginButtonTapped:(id)sender;
- (void)validateCredentials:(NSString *)username password:(NSString *)password;
@end

Cross-References

Right-click any method or symbol to see:

All references to this method
All calls from this method
String references

Decompilation

Hopper’s pseudo-code decompiler generates C-like code from assembly:

Assembly View
Pseudo-Code View

_validateCredentials:password:
push    rbp
mov     rbp, rsp
sub     rsp, 0x30
mov     qword [rbp+var_8], rdi
mov     qword [rbp+var_10], rsi
mov     qword [rbp+var_18], rdx
mov     qword [rbp+var_20], rcx

void -[LoginViewController validateCredentials:password:](void *self, void *_cmd, 
                                                           void *username, void *password) {
    if ([username length] == 0x0 || [password length] == 0x0) {
        [self showErrorAlert:@"Please enter both username and password"];
        return;
    }
    
    void *apiClient = [APIClient sharedInstance];
    [apiClient authenticateUser:username password:password completion:^(bool success, void *error) {
        if (success) {
            [self performSegueWithIdentifier:@"LoginSuccess" sender:self];
        } else {
            [self showErrorAlert:[error localizedDescription]];
        }
    }];
}

Control Flow Graphs

Visualize program flow with interactive CFGs:

Generate CFG

Select a function
View → Show Control Flow Graph (or Alt+Shift+G)

Navigate the Graph

Zoom with mouse wheel
Click basic blocks to view disassembly
Follow branches to understand logic flow

Analyze Paths

Identify:

Conditional branches (if/else statements)
Loops (for, while)
Exception handling paths
Return points

String Analysis

String Search

View → Strings to see all strings in the binary:

API endpoints
Encryption keys
Error messages
Debug strings

String References

Right-click any string to see:

Which functions use it
How it’s used (passed to function, compared, etc.)

Workflow Tips

Initial Analysis Workflow

Import the Binary

unzip YourApp.ipa
cd Payload/YourApp.app/
open -a "Hopper Disassembler" YourApp

Configure Analysis Options

When loading the binary:

Select the correct architecture (arm64 for modern iOS)
Enable “Objective-C” analysis
Enable “Swift” if the app uses Swift
Click “OK” to start analysis

Wait for Analysis

Hopper will:

Parse the Mach-O structure
Identify functions and entry points
Extract Objective-C classes and methods
Generate cross-references

Initial analysis typically takes 1-5 minutes depending on binary size.

Begin Investigation

Start with high-value targets:

Interesting class names (Auth, Login, Crypto, etc.)
String references to API endpoints
Entrypoints and initialization methods

Keyboard Shortcuts

Navigation

View Modes

Alt+Shift+A - Assembly view
Alt+Shift+P - Pseudo-code view
Alt+Shift+G - Control flow graph
Alt+Shift+H - Hexadecimal view

Analysis

N - Rename symbol
Shift+Cmd+X - References to this address
; - Add comment
P - Create procedure (function)

Advanced Techniques

Python Scripting
Type Library
Debugging Integration

Automate analysis with Python scripts:

# Get document
doc = Document.getCurrentDocument()

# Find all methods with "login" in name
for seg in doc.getSegmentsList():
    for proc in seg.getProcedureList():
        if "login" in proc.getName().lower():
            print(f"Found: {proc.getName()} at {hex(proc.getEntryPoint())}")

# Find string references
strings = doc.getStrings()
for string in strings:
    if "api.example.com" in string.getString():
        refs = string.getReferences()
        print(f"API endpoint found: {string.getString()}")
        print(f"Referenced at: {[hex(r) for r in refs]}")

Import iOS frameworks for better type information:

File → External Type Libraries
Add iOS SDK headers
Hopper will use these for better decompilation

// Before
void *obj = objc_msgSend(rax, "sharedInstance");

// After (with type library)
UIApplication *app = [UIApplication sharedApplication];

Set up debugging workflow:

Identify interesting functions in Hopper
Note their addresses
Set breakpoints in LLDB:

(lldb) br s -a 0x100004a20
(lldb) c

Return to Hopper to understand what happens at that address

Comparison with Other Tools

vs. Ghidra
vs. IDA Pro
vs. Binary Ninja

Hopper Advantages

Faster, more responsive UI
Better macOS integration
Cleaner pseudo-code output
Easier to learn

Ghidra Advantages

Free and open-source
More powerful scripting (Java/Python)
Better collaboration features (Ghidra Server)
More extensive analyzer options
Cross-platform (Windows/Linux/macOS)

Recommendation: Use Hopper for quick analysis and UI-focused work. Use Ghidra for team projects and complex automation.

Practical Use Cases

Finding Jailbreak Detection

Search for Common Checks

# In Hopper's string search
/Applications/Cydia.app
/bin/bash
/etc/apt
cydia://

Locate Detection Functions

Right-click strings to find functions using them

Analyze and Bypass

Understand the logic and:

Note function addresses for hooking with Frida
Identify return value checks
Plan patches or hooks

Extracting API Endpoints

doc = Document.getCurrentDocument()
strings = doc.getStrings()

api_endpoints = []
for string in strings:
    s = string.getString()
    if "http://" in s or "https://" in s:
        api_endpoints.append(s)
        print(f"Found endpoint: {s}")

print(f"\nTotal endpoints found: {len(api_endpoints)}")

Analyzing Encryption

Find Crypto Imports

Look for:

CommonCrypto functions (CCCrypt, CCKeyDerivationPBKDF)
OpenSSL functions
Security.framework methods

Trace Data Flow

Identify where sensitive data originates
Follow through encryption functions
See where encrypted data goes

Extract Parameters

Look for:

Key generation methods
IV (initialization vector) values
Algorithm selection

Best Practices

Save Your Work

File → Save to preserve your analysis
Saved files (.hop) contain all comments, labels, and custom types
Regular backups recommended for large projects

Use Labels Effectively

Rename functions immediately when you understand them (N key)
Use descriptive names: checkJailbreak not sub_1000048a0
Add comments for complex logic (; key)

Organize Your Analysis

Use bookmarks for important locations
Create meaningful function names
Document assumptions in comments

Combine with Dynamic Analysis

Use Hopper for static understanding
Use Frida/LLDB to confirm behavior at runtime
Iterate between static and dynamic analysis

Limitations

Obfuscation: Heavily obfuscated code is difficult to analyze
Swift: Swift demangling is less robust than Objective-C
Updates: Development is slower compared to IDA or Ghidra
Scripting: Python API is less extensive than alternatives
Platform: macOS/Linux only (no Windows version)

Ghidra

Free alternative with powerful scripting

IDA Pro

Industry-standard professional tool

Frida

Dynamic instrumentation companion

LLDB

Debugging companion for runtime analysis

Get Started

Fundamentals

Analysis Tools

Analysis Techniques

Swift & Objective-C

Obfuscation

Overview

Features for iOS Analysis

Automatic Class Detection

Decompilation

Control Flow Graphs

String Analysis

String Search

String References

Workflow Tips

Initial Analysis Workflow

Keyboard Shortcuts

Advanced Techniques

Comparison with Other Tools

Hopper Advantages

Ghidra Advantages

Hopper Advantages

IDA Pro Advantages

Hopper Advantages

Binary Ninja Advantages

Practical Use Cases

Finding Jailbreak Detection

Extracting API Endpoints

Analyzing Encryption

Best Practices

Limitations

Ghidra

IDA Pro

Frida

LLDB

Resources

Build docs developers (and LLMs) love

Get Started

Fundamentals

Analysis Tools

Analysis Techniques

Swift & Objective-C

Obfuscation

​Overview

​Features for iOS Analysis

​Automatic Class Detection

​Decompilation

​Control Flow Graphs

​String Analysis

String Search

String References

​Workflow Tips

​Initial Analysis Workflow

​Keyboard Shortcuts

​Advanced Techniques

​Comparison with Other Tools

​Hopper Advantages

​Ghidra Advantages

​Hopper Advantages

​IDA Pro Advantages

​Hopper Advantages

​Binary Ninja Advantages

​Practical Use Cases

​Finding Jailbreak Detection

​Extracting API Endpoints

​Analyzing Encryption

​Best Practices

​Limitations

​Related Tools

Ghidra

IDA Pro

Frida

LLDB

​Resources

Build docs developers (and LLMs) love

Overview

Features for iOS Analysis

Automatic Class Detection

Decompilation

Control Flow Graphs

String Analysis

Workflow Tips

Initial Analysis Workflow

Keyboard Shortcuts

Advanced Techniques

Comparison with Other Tools

Hopper Advantages

Ghidra Advantages

Hopper Advantages

IDA Pro Advantages

Hopper Advantages

Binary Ninja Advantages

Practical Use Cases

Finding Jailbreak Detection

Extracting API Endpoints

Analyzing Encryption

Best Practices

Limitations

Related Tools

Resources