MASTG-TOOL-0105: ipsw
IPSW calls itself an "iOS/macOS Research Swiss Army Knife". In general, IPSW allows you to obtain iOS specific files (IPSW, OTA, ...) and also statically analyze them. For application analysis, the most interesting features are the Objective-C and Swift class-dumps. Other features are available (kernelcache parser, device-tree parser, disassembler, etc) but are only useful if you're analyzing the security of the OS itself.
Extracting Objective-C Class Information¶
IPSW can extract Objective-C class information from a MachO binary. The desired architecture can be specified using--arch in case of a universal MachO file:
$ipswclass-dump--archarm64UnCrackable\Level\1@protocolNSObject@required...-[UIApplicationDelegateapplicationDidFinishLaunching:];-[UIApplicationDelegateapplication:willFinishLaunchingWithOptions:];-[UIApplicationDelegateapplication:didFinishLaunchingWithOptions:];-[UIApplicationDelegateapplicationDidBecomeActive:];...Full command output
$ipswclass-dump--archarm64UnCrackable\Level\1@protocolNSObject@required@property(TQ,R)hash;@property(T#,R)superclass;@property(T@"NSString",R,C)description;@property(T@"NSString",R,C)debugDescription;/*requiredinstancemethods*/-[NSObjectisEqual:];-[NSObjectclass];-[NSObjectself];-[NSObjectperformSelector:];-[NSObjectperformSelector:withObject:];-[NSObjectperformSelector:withObject:withObject:];-[NSObjectisProxy];-[NSObjectisKindOfClass:];-[NSObjectisMemberOfClass:];-[NSObjectconformsToProtocol:];-[NSObjectrespondsToSelector:];-[NSObjectretain];-[NSObjectrelease];-[NSObjectautorelease];-[NSObjectretainCount];-[NSObjectzone];-[NSObjecthash];-[NSObjectsuperclass];-[NSObjectdescription];@optional/*optionalinstancemethods*/-[NSObjectdebugDescription];@end@protocolUIApplicationDelegate<NSObject>@required@property(T@"UIWindow",&,N)window;@optional/*optionalinstancemethods*/-[UIApplicationDelegateapplicationDidFinishLaunching:];-[UIApplicationDelegateapplication:willFinishLaunchingWithOptions:];-[UIApplicationDelegateapplication:didFinishLaunchingWithOptions:];-[UIApplicationDelegateapplicationDidBecomeActive:];-[UIApplicationDelegateapplicationWillResignActive:];-[UIApplicationDelegateapplication:handleOpenURL:];-[UIApplicationDelegateapplication:openURL:sourceApplication:annotation:];-[UIApplicationDelegateapplication:openURL:options:];-[UIApplicationDelegateapplicationDidReceiveMemoryWarning:];-[UIApplicationDelegateapplicationWillTerminate:];-[UIApplicationDelegateapplicationSignificantTimeChange:];-[UIApplicationDelegateapplication:willChangeStatusBarOrientation:duration:];-[UIApplicationDelegateapplication:didChangeStatusBarOrientation:];-[UIApplicationDelegateapplication:willChangeStatusBarFrame:];-[UIApplicationDelegateapplication:didChangeStatusBarFrame:];-[UIApplicationDelegateapplication:didRegisterUserNotificationSettings:];-[UIApplicationDelegateapplication:didRegisterForRemoteNotificationsWithDeviceToken:];-[UIApplicationDelegateapplication:didFailToRegisterForRemoteNotificationsWithError:];-[UIApplicationDelegateapplication:didReceiveRemoteNotification:];-[UIApplicationDelegateapplication:didReceiveLocalNotification:];-[UIApplicationDelegateapplication:handleActionWithIdentifier:forLocalNotification:completionHandler:];-[UIApplicationDelegateapplication:handleActionWithIdentifier:forRemoteNotification:withResponseInfo:completionHandler:];-[UIApplicationDelegateapplication:handleActionWithIdentifier:forRemoteNotification:completionHandler:];-[UIApplicationDelegateapplication:handleActionWithIdentifier:forLocalNotification:withResponseInfo:completionHandler:];-[UIApplicationDelegateapplication:didReceiveRemoteNotification:fetchCompletionHandler:];-[UIApplicationDelegateapplication:performFetchWithCompletionHandler:];-[UIApplicationDelegateapplication:performActionForShortcutItem:completionHandler:];-[UIApplicationDelegateapplication:handleEventsForBackgroundURLSession:completionHandler:];-[UIApplicationDelegateapplication:handleWatchKitExtensionRequest:reply:];-[UIApplicationDelegateapplicationShouldRequestHealthAuthorization:];-[UIApplicationDelegateapplicationDidEnterBackground:];-[UIApplicationDelegateapplicationWillEnterForeground:];-[UIApplicationDelegateapplicationProtectedDataWillBecomeUnavailable:];-[UIApplicationDelegateapplicationProtectedDataDidBecomeAvailable:];-[UIApplicationDelegateapplication:supportedInterfaceOrientationsForWindow:];-[UIApplicationDelegateapplication:shouldAllowExtensionPointIdentifier:];-[UIApplicationDelegateapplication:viewControllerWithRestorationIdentifierPath:coder:];-[UIApplicationDelegateapplication:shouldSaveApplicationState:];-[UIApplicationDelegateapplication:shouldRestoreApplicationState:];-[UIApplicationDelegateapplication:willEncodeRestorableStateWithCoder:];-[UIApplicationDelegateapplication:didDecodeRestorableStateWithCoder:];-[UIApplicationDelegateapplication:willContinueUserActivityWithType:];-[UIApplicationDelegateapplication:continueUserActivity:restorationHandler:];-[UIApplicationDelegateapplication:didFailToContinueUserActivityWithType:error:];-[UIApplicationDelegateapplication:didUpdateUserActivity:];-[UIApplicationDelegateapplication:userDidAcceptCloudKitShareWithMetadata:];-[UIApplicationDelegatewindow];-[UIApplicationDelegatesetWindow:];@end@protocol__ARCLiteKeyedSubscripting__@required/*requiredinstancemethods*/-[__ARCLiteKeyedSubscripting__objectForKeyedSubscript:];-[__ARCLiteKeyedSubscripting__setObject:forKeyedSubscript:];@optional@end@interfaceAppDelegate:UIResponder<UIApplicationDelegate>{/*instancevariables*/@"UIWindow"_window;}@property(T@"UIWindow",&,N,V_window)window;@property(TQ,R)hash;@property(T#,R)superclass;@property(T@"NSString",R,C)description;@property(T@"NSString",R,C)debugDescription;/*instancemethods*/-[AppDelegateapplication:didFinishLaunchingWithOptions:];-[AppDelegateapplicationWillResignActive:];-[AppDelegateapplicationDidEnterBackground:];-[AppDelegateapplicationWillEnterForeground:];-[AppDelegateapplicationDidBecomeActive:];-[AppDelegateapplicationWillTerminate:];-[AppDelegatewindow];-[AppDelegatesetWindow:];@end@interfaceViewController:UIViewController{/*instancevariables*/@"UILabel"_theLabel;@"UILabel"_Hint;@"UITextField"_theTextField;@"UIButton"_bVerify;}@property(T@"UILabel",W,N,V_theLabel)theLabel;@property(T@"UILabel",W,N,V_Hint)Hint;@property(T@"UITextField",W,N,V_theTextField)theTextField;@property(T@"UIButton",W,N,V_bVerify)bVerify;/*instancemethods*/-[ViewControllerviewDidLoad];-[ViewControllerbuttonClick:];-[ViewControllerdidReceiveMemoryWarning];-[ViewControllertheLabel];-[ViewControllersetTheLabel:];-[ViewControllerHint];-[ViewControllersetHint:];-[ViewControllertheTextField];-[ViewControllersetTheTextField:];-[ViewControllerbVerify];-[ViewControllersetBVerify:];@endExtracting Swift Class Information¶
IPSW can output the available Swift symbols withipsw swift-dump. By default, the location of the identified structures and symbols is not printed, but this can be enabled by using the-V flag:
$ipswswift-dump--archarm64./MASTestApp-VSwiftTOC--------__swift5_builtin=0__swift5_types(2)=3__swift5_protos=0__swift5_proto=2TYPES-----//0x10000a760structMASTestApp.ContentView{//accessor0x1000081e4/*0x10000b064*/var_displayText:_$s7SwiftUI5StateVMn_$sSS}//0x10000a7a4structMASTestApp.MASTestAppApp{}//accessor0x10000a200//0x10000a7f0classMASTestApp.ResourceBundleClass{//accessor0x10000a2c4/*methods*//*0x10000a824*///<stripped>staticfuncinit}...Full command output
$ipswswift-dump--archarm64./MASTestApp-VSwiftTOC--------__swift5_builtin=0__swift5_types(2)=3__swift5_protos=0__swift5_proto=2TYPES-----//0x10000a760structMASTestApp.ContentView{//accessor0x1000081e4/*0x10000b064*/var_displayText:_$s7SwiftUI5StateVMn_$sSS}//0x10000a7a4structMASTestApp.MASTestAppApp{}//accessor0x10000a200//0x10000a7f0classMASTestApp.ResourceBundleClass{//accessor0x10000a2c4/*methods*//*0x10000a824*///<stripped>staticfuncinit}PROTOCOLCONFORMANCES---------------------//0x10000a668protocolconformanceMASTestApp.ContentView:_$s7SwiftUI4ViewMp{/*resilientwitnesses*//*0x10000a83d*/_$s7SwiftUI4ViewP4BodyAC_AaBTn/*0x10000a845*/_$s4Body7SwiftUI4ViewPTl/*0x100009924*/_$s7SwiftUI4ViewP05_makeC04view6inputsAA01_C7OutputsVAA11_GraphValueVyxG_AA01_C6InputsVtFZTq/*0x100009928*/_$s7SwiftUI4ViewP05_makeC4List4view6inputsAA01_cE7OutputsVAA11_GraphValueVyxG_AA01_cE6InputsVtFZTq/*0x10000992c*/_$s7SwiftUI4ViewP14_viewListCount6inputsSiSgAA01_ceF6InputsV_tFZTq/*0x100009944*/_$s7SwiftUI4ViewP4body4BodyQzvgTq}//0x10000a6fcprotocolconformanceMASTestApp.MASTestAppApp:_$s7SwiftUI3AppMp{/*resilientwitnesses*//*0x10000afff*/_$s7SwiftUI3AppP4BodyAC_AA5SceneTn/*0x10000b007*/_$s4Body7SwiftUI3AppPTl/*0x10000a0d4*/_$s7SwiftUI3AppP4body4BodyQzvgTq/*0x10000a184*/_$s7SwiftUI3AppPxycfCTq}ASSOCIATEDTYPES---------------------//0x10000b088extensionMASTestApp.ContentView:_$s7SwiftUI4ViewP{/*0x10000b03f*/typealiasBody=_$s7SwiftUI15ModifiedContentVMn_$s7SwiftUI6VStackVMn_$s7SwiftUI9TupleViewVMn_$syAA->_$s7SwiftUI6HStackVMn_$syAC->_$s7SwiftUI4TextVMn_$s__$s7SwiftUI6SpacerVMn_$sAAyAAyAA->_$s7SwiftUI6ButtonVMn_$syAAyAAyAAyAE_$s7SwiftUI14_PaddingLayoutVMn_$sGAHG_$s7SwiftUI30_EnvironmentKeyWritingModifierVMn_$s7SwiftUI4FontVMn_$sSgGGG->_$s7SwiftUI24_BackgroundStyleModifierVMn_$s7SwiftUI14LinearGradientVMn_$sGG->_$s7SwiftUI11_ClipEffectVMn_$s7SwiftUI16RoundedRectangleVMn_$sGGAHGtGGAHG_AAyAAyAAyAA->_$s7SwiftUI10ScrollViewVMn_$syAAyAAyAE_$s7SwiftUI16_FlexFrameLayoutVMn_$sGAHGGA2_GAQ->_$s7SwiftUI5ColorVMn_$sGGAWGAHGtGGAH}//0x10000b0a0extensionMASTestApp.MASTestAppApp:_$s7SwiftUI3AppP{/*0x10000b044*/typealiasBody=_$s7SwiftUI11WindowGroupVMnMASTestApp.ContentView}