Ios | Security Notes

Swift Mangling vs ObjC methname: Recovering Names After Strip

Lab Swift class LabVault: $s… mangled names, xcrun swift demangle, nm before/after strip, the one @objc method that survives in __objc_methname. class-dump, lldb, ASAN. cryptid=1 stops the lab.

Symbolicating a Lab Crash When UIKit Lives in the dyld Shared Cache

Lab crash on a self-signed LabSession: dwarfdump -u, atos against the dSYM, why UIKit frames are not in nm of the app, crash report with [REDACTED] paths. No DSC extraction. cryptid=1 stops the lab.

Entitlements and the Simulator Sandbox on a Lab iOS App

codesign -d –entitlements on a self-signed LabSession: get-task-allow, redacted application-identifier, container paths on the simulator, sandbox-exec, deny logs when a file read walks outside the container. cryptid=1 stops the lab.

Reversing objc_msgSend on a Self-Signed arm64 Mach-O

otool load commands, class-dump selectors, lldb break on objc_msgSend, recover IMP for -[LabSession startWithToken:], redacted argument log. FairPlay-encrypted App Store bins are out of scope.

Walking Mach-O Load Commands on a Self-Signed arm64 Lab Binary

Full otool -l walk of a self-signed LabSession: mach_header_64, LC_SEGMENT_64 __TEXT/__DATA, LC_LOAD_DYLIB, LC_CODE_SIGNATURE, LC_ENCRYPTION_INFO_64 cryptid=0. size -x, nm, class-dump, lldb. cryptid=1 stops the lab.