iOS-OSX-Static-Analysis.md
July 13, 2015 ยท View on GitHub
iOS/OSX Static Analysis
File Format Parsing
otool
MachOView
http://sourceforge.net/projects/machoview/
https://github.com/gdbinit/MachOView
jtool
http://www.newosxbook.com/files/jtool.tar
optool
Command Line Tool for interacting with MachO binaries on OSX/iOS
https://github.com/alexzielenski/optool
MachOParse
Visual Mach-O binary parser
https://github.com/samdmarshall/MachOParse
php-macho
PHP script for modifying Mach-O executable i386 and x86_64 files.
https://github.com/TheFox/macho
libdmg-hfsplus
Portable libraries and utilities that manipulate HFS+ volumes and Apple's DMG images
https://github.com/planetbeing/libdmg-hfsplus
iOS IPA Validator
checkipa scans an IPA file and parses its Info.plist (in Payload directory) and embedded.mobileprovision files. It performs checks of expected key/value relationships and reports the results.
https://github.com/apperian/iOS-checkIPA
cs
codesignature construct
codeunsign
A Mach-O binary codesign remover.
https://github.com/x43x61x69/codeunsign
iReSign
iReSign allows iDevice app bundles (.ipa) files to be signed or resigned with a digital certificate from Apple for distribution. This tool is aimed at enterprises users, for enterprise deployment, when the person signing the app is different than the person(s) developing it.
https://github.com/maciekish/iReSign
HFSleuth
http://www.newosxbook.com/files/hfsleuth.tar
Disassembly
class-dump
Generate Objective-C headers from Mach-O files.
https://github.com/nygard/class-dump
otx
The Mach-O disassembler. Now 64bit and Xcode 6 compatible.
https://github.com/x43x61x69/otx
class_dump_z
http://code.google.com/p/networkpx/wiki/class_dump_z
IDA Pro
http://www.hex-rays.com/products/ida/index.shtml
IDA-IOS-Toolkit
Collection of idapython scripts for dealing with the iOS kernelcache
https://github.com/stefanesser/IDA-IOS-Toolkit
objc-helper-plugin-ida
Simplifies working with Objective-C binaries in IDA Pro
https://github.com/zynamics/objc-helper-plugin-ida
Hopper
Decompiling
Hex-rays Decompiler
http://www.hex-rays.com/products/ida/index.shtml
Hopper
Others
the-backdoor-factory
Patch PE, ELF, Mach-O binaries with shellcode