IDA Pro

IDA Pro (Interactive DisAssembler Professional) is the industry-standard commercial reverse engineering platform. With its powerful Hex-Rays decompiler and extensive plugin ecosystem, it’s the tool of choice for professional iOS security researchers.

Overview

IDA Pro offers unmatched capabilities for iOS reverse engineering:

Best-in-class decompiler (Hex-Rays)
Comprehensive ARM64/ARM architecture support
Extensive plugin ecosystem
Powerful scripting with Python and IDC
Team collaboration features (IDA Teams)
Active development and support

IDA Pro is expensive ($1,000+ for a commercial license). Consider whether your needs justify the cost versus free alternatives like Ghidra.

Setting Up IDA for iOS

Acquire IDA Pro

Commercial
Educational
Alternative

Purchase from Hex-Rays website
IDA Pro license ($1,879 USD)
Hex-Rays ARM64 Decompiler add-on required for iOS ($2,999 USD)
Total: ~$4,878 for full iOS capability

Install Essential Plugins

# Create plugins directory if it doesn't exist
mkdir -p ~/.idapro/plugins

# Clone essential iOS plugins
cd ~/.idapro/plugins

# Class-dump for IDA
git clone https://github.com/AloneMonkey/frida-ios-dump

# Keypatch for patching
git clone https://github.com/keystone-engine/keypatch

Configure for iOS Analysis

Edit ida.cfg or use GUI options:

// Increase undo history
UNDO_BUFSIZE = 1000

// Better ARM64 analysis
ARM_DEFAULT_ARCH = 8

// Enable decompiler by default
DECOMPILE_AT_STARTUP = YES

Loading iOS Binaries

Extract the Binary

From IPA
From Device

# Unzip IPA file
unzip YourApp.ipa -d extracted

# Locate binary
cd extracted/Payload/YourApp.app/

# Check if encrypted
otool -l YourApp | grep cryptid
# cryptid 1 = encrypted (need to decrypt first)
# cryptid 0 = ready to analyze

# SSH to jailbroken device
ssh root@<device-ip>

# Find app
find /var/containers/Bundle/Application -name "YourApp.app"

# Decrypt with frida-ios-dump
frida-ios-dump -H <device-ip> -u <bundle-id>

# Download decrypted IPA

Load in IDA Pro

File → Open (or drag and drop binary into IDA)
IDA will detect it as a Mach-O ARM64 binary
Accept default settings or customize:
- Load resources: Enable for app resources
- Create segments: Enable all
- Kernel options: Usually not needed for iOS apps

Initial Analysis

IDA will automatically:

Parse Mach-O headers
Identify entry points
Extract Objective-C runtime information
Build cross-references
Apply FLIRT signatures

Analysis time varies: 5-30 minutes for typical iOS apps

Essential Plugins and Extensions

Must-Have Plugins

Keypatch
Class-Dump
IDA-ObjC
Diaphora

Binary patching directly in IDA

# Install Keypatch
cd ~/.idapro/plugins
git clone https://github.com/keystone-engine/keypatch

# Install Keystone engine
pip install keystone-engine

Usage:

Right-click instruction → Keypatch → Patch
Enter new assembly code
Apply patch
Edit → Patch program → Apply patches to input file

Enhanced Objective-C class extraction

# Automatically extracts:
# - Class hierarchies
# - Method signatures
# - Properties
# - Protocols

# Usage: File → Script file → class-dump.py

Output:

@interface LoginViewController : UIViewController
@property (nonatomic, strong) UITextField *usernameField;
@property (nonatomic, strong) UITextField *passwordField;
- (void)loginButtonTapped:(id)arg1;
- (BOOL)validateInput;
@end

Improved Objective-C support

cd ~/.idapro/plugins
git clone https://github.com/zxgio/ida_objc

Features:

Better method name reconstruction
Automatic type propagation
Enhanced cross-references

Binary diffing for comparing versions

cd ~/.idapro/plugins
git clone https://github.com/joxeankoret/diaphora

Use cases:

Compare app versions to find security patches
Identify changes between iOS versions
Track vulnerability fixes

Scripting Plugins

import idaapi
import idautils
import idc

# Suspicious strings indicating jailbreak detection
jb_strings = [
    "/Applications/Cydia.app",
    "/bin/bash",
    "/usr/sbin/sshd",
    "/etc/apt",
    "cydia://"
]

print("[*] Searching for jailbreak detection...")
for s in idautils.Strings():
    for jb in jb_strings:
        if jb in str(s):
            print(f"\n[+] Found: {s}")
            print(f"    Address: {hex(s.ea)}")
            
            # Find cross-references
            for xref in idautils.XrefsTo(s.ea):
                func = idaapi.get_func(xref.frm)
                if func:
                    func_name = idc.get_func_name(func.start_ea)
                    print(f"    Used in: {func_name} @ {hex(xref.frm)}")

Workflow and Best Practices

Efficient Analysis Workflow

Initial Reconnaissance

View Imports

View → Open subviews → Imports
Look for suspicious APIs:
- CC_SHA256, CC_MD5 (crypto)
- dlopen, dlsym (dynamic loading)
- ptrace (anti-debugging)
- sysctl (jailbreak detection)

Examine Strings

View → Open subviews → Strings (Shift+F12)
Filter for:
- API endpoints (http, https)
- File paths
- Error messages
- Debug strings

Review Objective-C Classes

View → Open subviews → Class Browser
Explore class hierarchy
Focus on interesting names (Auth, Crypto, Network, etc.)

Deep Dive Analysis

For each target function:

View Assembly: Understand low-level operations
Decompile (F5): Get pseudo-code for high-level understanding
Analyze Data Flow: Track variables through the function
Check Cross-References (X): See where function is called
Add Comments (;): Document your findings
Rename Variables (N): Make decompiled code readable

Documentation

Use IDA’s built-in database to save progress
Add function comments explaining purpose
Create enums and structs for data structures
Use bookmarks (Alt+M) for important locations

Hex-Rays Decompiler Tips

Improving Decompilation
Keyboard Shortcuts
Understanding Output

Set Function Types

// Right-click function → Edit function
// Set correct prototype:

// Before
__int64 __fastcall sub_100004A20(__int64 a1, __int64 a2)

// After
bool __fastcall validateCredentials(NSString *username, NSString *password)

Define Structures

// Structures → Add struct type
struct UserCredentials {
    NSString *username;
    NSString *password;
    bool rememberMe;
};

// Apply to variables for better decompilation

Tab - Switch between assembly and pseudo-code
F5 - Decompile current function
N - Rename variable/function
Y - Change type
\ - Add comment
X - Cross-references
G - Go to address
Esc - Go back

// Decompiler generates C-like code
__int64 __fastcall -[LoginViewController loginButtonTapped:](
    LoginViewController *self, 
    SEL a2, 
    id a3)
{
    NSString *username = objc_msgSend(self->_usernameField, "text");
    NSString *password = objc_msgSend(self->_passwordField, "text");
    
    if ( objc_msgSend(username, "length") 
         && objc_msgSend(password, "length") )
    {
        return objc_msgSend(self, "validateCredentials:password:", 
                           username, password);
    }
    
    return objc_msgSend(self, "showError:", 
                       @"Please enter credentials");
}

Understand how Objective-C maps to C
objc_msgSend = method call
self->_field = property access

Advanced Techniques

Binary Patching

Identify Target

Find the check you want to bypass:

; Jailbreak detection
BL      _access
CMP     W0, #0
B.NE    loc_jailbroken  ; Branch if jailbroken

Apply Patch

Use Keypatch or manual patching:

; Change conditional branch to unconditional
B.NE    loc_jailbroken
; Patch to:
NOP                     ; No operation, always continue

Export Patched Binary

Edit → Patch program → Apply patches to input file
Re-sign the binary
Install on device

Debugging Integration

# 1. Find interesting function in IDA
# Address: 0x100004a20
# Function: -[LoginViewController validateCredentials:password:]

# 2. Set breakpoint in LLDB
(lldb) br s -a 0x100004a20
(lldb) c

# 3. When hit, examine in IDA
# Use IDA to understand what happens at this address

# 4. Step through in LLDB while following in IDA
(lldb) ni  # Next instruction

Collaborative Analysis (IDA Teams)

IDA Teams enables multiple analysts to work on the same binary simultaneously with real-time synchronization.

Set Up IDA Teams Server

# Install IDA Teams
# Follow Hex-Rays documentation for server setup

Connect to Server

File → Open from IDA Teams
Enter server credentials
Choose or create project

Collaborate

Changes sync automatically
See other analysts’ cursors in real-time
Chat and comment features
Version control for analysis

Common Use Cases

Finding Hardcoded Secrets

# Search for base64 strings
import base64
import idautils

for s in idautils.Strings():
    try:
        decoded = base64.b64decode(str(s))
        if decoded.isprintable():
            print(f"Potential secret: {str(s)}")
            print(f"Decoded: {decoded}")
    except:
        pass

Analyzing SSL Pinning

Look for:

SecTrustEvaluate calls
Certificate data in __data section
Custom NSURLSessionDelegate implementations

Patch to bypass:

Force SecTrustEvaluate to return success
NOP out certificate validation checks

Understanding Anti-Debugging

Search for:

ptrace(PT_DENY_ATTACH, 0, 0, 0)
sysctl calls checking for debugger
Exception port manipulation
Time-based detection

Bypass by patching or Frida hooking

Extracting Encryption Keys

Find crypto function calls (CCCrypt, etc.)
Trace back to key derivation
Look for hardcoded keys or weak derivation
Set breakpoints to extract at runtime

Best Practices

Save Frequently

IDA databases can corrupt. Save often and backup important work.

Use Meaningful Names

Rename functions, variables, and structures as you understand them.

Document Everything

Add comments explaining complex logic and your assumptions.

Leverage Scripts

Automate repetitive tasks with IDAPython scripts.

Version Control

Keep IDA databases in version control for large projects.

Combine Approaches

Use static analysis (IDA) + dynamic analysis (Frida/LLDB) together.

Limitations and Considerations

Cost: Extremely expensive for full iOS capability
Learning Curve: Complex interface with many features
Obfuscation: Heavily obfuscated code remains difficult
Swift: Swift analysis is improving but still challenging
License: Per-user licensing can be restrictive for teams

Ghidra

Free open-source alternative to IDA

Hopper

Affordable macOS-native alternative

Frida

Dynamic instrumentation companion

LLDB

Apple’s debugger for runtime analysis

Get Started

Fundamentals

Analysis Tools

Analysis Techniques

Swift & Objective-C

Obfuscation

Overview

Setting Up IDA for iOS

Loading iOS Binaries

Essential Plugins and Extensions

Must-Have Plugins

Scripting Plugins

Workflow and Best Practices

Efficient Analysis Workflow

Hex-Rays Decompiler Tips

Advanced Techniques

Binary Patching

Debugging Integration

Collaborative Analysis (IDA Teams)

Common Use Cases

Best Practices

Save Frequently

Use Meaningful Names

Document Everything

Leverage Scripts

Version Control

Combine Approaches

Limitations and Considerations

Ghidra

Hopper

Frida

LLDB

Resources

Build docs developers (and LLMs) love

Get Started

Fundamentals

Analysis Tools

Analysis Techniques

Swift & Objective-C

Obfuscation

​Overview

​Setting Up IDA for iOS

​Loading iOS Binaries

​Essential Plugins and Extensions

​Must-Have Plugins

​Scripting Plugins

​Workflow and Best Practices

​Efficient Analysis Workflow

​Hex-Rays Decompiler Tips

​Advanced Techniques

​Binary Patching

​Debugging Integration

​Collaborative Analysis (IDA Teams)

​Common Use Cases

​Best Practices

Save Frequently

Use Meaningful Names

Document Everything

Leverage Scripts

Version Control

Combine Approaches

​Limitations and Considerations

​Related Tools

Ghidra

Hopper

Frida

LLDB

​Resources

Build docs developers (and LLMs) love

Overview

Setting Up IDA for iOS

Loading iOS Binaries

Essential Plugins and Extensions

Must-Have Plugins

Scripting Plugins

Workflow and Best Practices

Efficient Analysis Workflow

Hex-Rays Decompiler Tips

Advanced Techniques

Binary Patching

Debugging Integration

Collaborative Analysis (IDA Teams)

Common Use Cases

Best Practices

Limitations and Considerations

Related Tools

Resources