Environment
- Hardware
- Jailbreak
- Tools
  - frida
  - cycript
  - chisel (lldb script)
  - MonkeyDev
  - passionfruit
  - objection
  - theos
  - HookZz
  - AppleTrace
  - dump
  - dump class
    - class-dump/class-dump-z/classdump-dyld
    - swift class dump
  - Hikari
  - Reveal
  - IDA
  - Hopper
  - Flex
  - Others
Books
Resources
PWN
Forums

Haven’t reverse engineered Apps for a long time, recently have some needs to see how other Apps implement things, want to review. Also these two years several commonly used tools have changed, some new tools emerged. This article summarizes basic App reverse engineering methods, tools and some books. Will try to update this article when there are new discoveries.

Environment

Hardware

iPhone or iPad with iOS system
MacBook etc. with macOS system

Jailbreak

Whether phone can be jailbroken can be determined through this website: https://canijailbreak.com/ Jailbreak software also has links to download.

Tools

frida

Official site https://www.frida.re/

Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Inject your own scripts into black box processes. Hook any function, spy on crypto APIs or trace private application code, no source code needed. Edit, hit save, and instantly see the results. All without compilation steps or program restarts.

cycript

http://www.cycript.org/

Cycript allows developers to explore and modify running applications on either iOS or Mac OS X using a hybrid of Objective-C++ and JavaScript syntax through an interactive console that features syntax highlighting and tab completion.

chisel (lldb script)

https://github.com/facebook/chisel

Chisel is a collection of LLDB commands to assist debugging iOS apps.

Most commonly used are pview and pvc commands. All supported commands can reference Wiki: https://github.com/facebook/chisel/wiki .

MonkeyDev

https://github.com/AloneMonkey/MonkeyDev

Upgrade of original iOSOpenDev, non-jailbreak plugin development integration tool!

Can use Xcode to develop CaptainHook Tweak, Logos Tweak and Command-line Tool, develop plugins on jailbroken devices, this is migration and improvement of original iOSOpenDev functionality.

Just drag in a decrypted app, automatically integrate class-dump, restore-symbol, Reveal, Cycript and injected dynamic library and re-sign install to non-jailbroken device.

Support debugging self-written dynamic libraries and third-party Apps

Support integrating SDK and non-jailbreak plugins through CocoaPods for third-party apps, simply put is building a non-jailbreak plugin store through CocoaPods.

New force, born in 2017. Already essential tool for analyzing closed-source apps.

passionfruit

https://github.com/chaitin/passionfruit

Based on frida development, essential for reverse engineering, can easily see various information of third-party apps.

Cross plarform web GUI!
Also supports non-jailbroken device (see Non-jailbroken device).
List all url schemes.
Check signature entitlements.
List human readable app meta info (Info.plist).
Capture screenshot.
Checksec: see if target app is encrypted, and has enabled PIE, ARC and stack canary.
App sandbox file browser. Directly preview images, SQLite databases and plist files on device. You can always download the file for further investigation.
etc.

objection

https://github.com/sensepost/objection

Toolset based on frida.

objection is a runtime mobile exploration toolkit, powered by Frida. It was built with the aim of helping assess mobile applications and their security posture without the need for a jailbroken or rooted mobile device.