iOS Analysis: Platform-Specific Techniques

This skill defines iOS-specific analysis techniques for MobHunt hunter agents. It is loaded by /hunt-ios and /recon commands and used by iOS hunter agent instances.

Binary Format: Mach-O

iOS executables and frameworks use the Mach-O format. Key analysis points:

FAT (Universal) Binaries

Modern App Store binaries are typically arm64-only, but some include multiple architectures:

# Check architecture
lipo -info <binary>

# Extract arm64 slice for analysis
lipo <binary> -thin arm64 -output <binary>_arm64

Rule: Always analyze the arm64 slice. Ignore x86_64 (Simulator) slices; they may have different code paths and debug features.

Mach-O Headers and Load Commands

# View load commands (linked frameworks, RPATHs, encryption info)
otool -l <binary>

# Key load commands:
# LC_ENCRYPTION_INFO_64: cryptid field (0 = decrypted, 1 = encrypted)
# LC_LOAD_DYLIB: linked frameworks
# LC_RPATH: runtime search paths
# LC_CODE_SIGNATURE: code signature info

Symbol Analysis

# List all symbols
nm -gU <binary>

# Objective-C class list
otool -o <binary> | grep "name 0x"

# Swift symbols (mangled)
nm <binary> | grep "_$s"

# Imported symbols (external dependencies)
nm -u <binary>

Entitlements Analysis

Entitlements are the ground truth for iOS app capabilities. Extract with:

codesign -d --entitlements :- <app_bundle>

Dangerous Entitlements

TestFlight vs Production Detection

TestFlight builds have get-task-allow = true and beta-reports-active = true. This is normal for TestFlight; only flag if the build is a production App Store release.

Check embedded.mobileprovision:

security cms -D -i embedded.mobileprovision

Look for ProvisionsAllDevices (enterprise) vs ProvisionedDevices (dev/ad-hoc) vs neither (App Store).

Info.plist Security Analysis

App Transport Security (ATS)

<!-- WORST: All HTTP allowed -->
<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoads</key>
    <true/>
</dict>

<!-- BAD: Specific domain exceptions -->
<key>NSExceptionDomains</key>
<dict>
    <key>api.example.com</key>
    <dict>
        <key>NSExceptionAllowsInsecureHTTPLoads</key>
        <true/>
    </dict>
</dict>

Assessment: ATS bypass alone is informational. Only a finding when chained with evidence that sensitive data (tokens, credentials, PII) is sent over the excepted HTTP connection.

URL Schemes

<key>CFBundleURLTypes</key>
<array>
    <dict>
        <key>CFBundleURLSchemes</key>
        <array>
            <string>myapp</string>
            <string>myapp-auth</string>
        </array>
    </dict>
</array>

Assessment: Check if the scheme is used for OAuth callbacks (oauth, auth, callback, login in scheme name or path). URL scheme hijacking is standalone-reportable if the scheme carries sensitive data.

Queried URL Schemes

<key>LSApplicationQueriesSchemes</key>

These reveal which apps the target communicates with, which is useful for understanding the data flow.

Keychain Analysis

Protection Classes (Weakest to Strongest)

Finding: kSecAttrAccessibleAlways or kSecAttrAccessibleAfterFirstUnlock for authentication tokens, passwords, or encryption keys. Must demonstrate the extraction path (backup, locked device access).

Keychain API Patterns in Binary

Search for these symbols:

• SecItemAdd: storing items
• SecItemCopyMatching: retrieving items
• SecItemUpdate: modifying items
• kSecClass: item class (generic password, internet password, certificate, key)
• kSecAttrAccessible: protection class assignment

WebView Analysis

WKWebView (Modern)

UIWebView (Deprecated, Still Found)

UIWebView is inherently less secure:

• stringByEvaluatingJavaScriptFromString: has no completion handler and runs synchronously
• No content blocker support
• JSContext bridge can expose all ObjC objects

Finding: UIWebView usage in production is itself a finding (Apple deprecated it and rejects new submissions).

Attack Pattern: Deep Link → WebView

1. App registers myapp:// URL scheme
2. URL scheme handler: myapp://webview?url=<URL>
3. Handler loads <URL> in WKWebView
4. If WebView has JS bridge → attacker controls native function calls

Check the URL scheme handler code for URL validation. If it loads arbitrary URLs in a WebView with native bridges, this is HIGH/CRITICAL.

Framework & SDK Analysis

Framework Location

Embedded frameworks live in AppName.app/Frameworks/:

Frameworks/
  FirebaseCore.framework/
  Alamofire.framework/
  CustomSDK.framework/

Version Extraction

SDK versions are typically in:

• Info.plist inside the framework bundle (CFBundleShortVersionString)
• Binary strings (search for version patterns like \d+\.\d+\.\d+)
• Framework header comments

Debug Frameworks (Auto-Flag)

Data Storage Locations

File Protection Levels

NSFileProtectionComplete                              best:    locked device means no access
NSFileProtectionCompleteUnlessOpen                    good:    can write while locked
NSFileProtectionCompleteUntilFirstUserAuthentication  default: accessible after unlock
NSFileProtectionNone                                  worst:   always accessible

Crypto Analysis Patterns

Secure Patterns (Not Findings)

• SecKeyCreateEncryptedData / SecKeyCreateDecryptedData: Apple CryptoKit
• CC_SHA256: SHA-256 hashing
• CCCrypt with kCCAlgorithmAES128 + kCCModeCBC or kCCModeGCM: AES with a secure mode
• SecRandomCopyBytes: secure random

Insecure Patterns (Potential Findings)

Assessment: Weak crypto is only a finding if used for security-critical operations (authentication, token encryption, sensitive data protection). MD5 for cache checksums is not a finding.

Tool Reference