iOS Reverse Engineering Skill
A Claude Code skill that unpacks IPA files, finds API endpoints, secrets and vulnerabilities, and analyzes Mach-O binaries.
- 118 ★ on the repository
- Last commit
Broad access
Why this level
- Analyzing and scanning for secrets in other people's apps is acceptable only with authorization: otherwise expect claims from the rights holder and legal trouble.
- The scripts install programs (`ipsw`, radare2) and run decompilation themselves, and found keys end up in reports on disk.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/ios-reverse-engineering-skillDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Analyzing and scanning for secrets in other people's apps is acceptable only with authorization: otherwise expect claims from the rights holder and legal trouble.
- The scripts install programs (`ipsw`, radare2) and run decompilation themselves, and found keys end up in reports on disk.
This is third-party code. Review the repository files before installing.
What it does
The `ios-reverse-engineering` skill analyzes IPA packages, .app bundles, Mach-O binaries, dynamic libraries and frameworks. The `/extract-ipa` command unpacks the archive, dumps Objective-C and Swift class headers through `ipsw class-dump` and shows the app structure: `Info.plist`, entitlements and embedded frameworks. After extraction the agent runs nine kinds of analysis: structure, call tracing from ViewController to the network layer, HTTP endpoint discovery (URLSession, Alamofire, Moya, GraphQL, WebSocket), security audit, cloud key scanning, decompilation through radare2, rizin or headless Ghidra, third-party SDK fingerprinting with CVE checks, protection detection and a static vulnerability audit across 14 categories. Most scripts write a Markdown report with `--report`.
Who it is for. iOS security researchers and pentesters who need to take an IPA apart quickly during an authorized assessment or a CTF.
Good fit when
- Before disclosing a vulnerability, you check your own app for weakened ATS and weak crypto.
- During a pentest you build an attack surface map from endpoints found in the client's IPA.
- In a CTF you need to crack an iOS challenge fast and find a secret in a binary.
- A security team checks a release for leaked Firebase, AWS and Stripe keys.
- During incident response you assess a suspicious IPA for signs of malicious behavior.
Not a fit when
- You have no right to analyze the package, for example a third-party app without permission.
- You work on Linux with an unextracted IPA: only analysis of already extracted files is supported there.
- The findings would be presented as a confirmed vulnerability list: each carries a confidence level and a false-positive likelihood.
Example request
`/extract-ipa ~/Downloads/MyApp.ipa`, then find all HTTP endpoints and check the app for leaked cloud keys.Limitations
`ipsw` is required (`brew install blacktop/tap/ipsw`), plus Xcode Command Line Tools on macOS. radare2 or rizin are recommended and Ghidra is optional. The `check-deps.sh` and `install-dep.sh` scripts install missing tools through Homebrew or download them to `~/.local/share/`. On Linux only static analysis of already extracted files is supported. Audit findings carry a confidence level and a false-positive likelihood, so verify them by hand. The README install command uses the `iOS-claude-skill` address, while the repository is named iOS-reverse-engineering-claude-skill.
How to disable. Remove the skill folder from the Claude Code project. Installed tools (`ipsw`, radare2, Ghidra) and the analysis output folders are removed separately.
FAQ
How do I start analyzing an IPA?
Call `/extract-ipa /path/to/MyApp.ipa`. The skill checks dependencies, unpacks the archive, dumps class headers and shows a summary. Flags: `-o` for the output folder, `--no-classdump`, `--thin arm64` and `--swift-demangle`.
Which keys does the secret scanner look for?
Keys for Firebase, AWS, GCP, Azure, Stripe, Twilio, SendGrid and more than twenty other cloud services. For each finding the AI rates the service type, client safety, blast radius, false-positive likelihood and validation steps.
Is Ghidra required?
No, it is optional. radare2 or rizin are recommended for deep analysis, and headless Ghidra adds Java scripts such as `FindSecrets.java`.
What does the protection score show?
A number from 0 to 20: from 15 the app is heavily protected, and 0 means no protections. The script looks for obfuscation, anti-debugging, dylib injection prevention, integrity checks, jailbreak detection and FairPlay encryption.
Which kinds of analysis does the skill have?
Nine: structure, call tracing, endpoint discovery, security audit, key scanning, decompilation, SDK fingerprinting, protection detection and a static vulnerability audit across 14 categories. Each runs from a separate phrase or script flag.
Discussion
No questions or reviews yet.
Related
SkillsA Claude Code skill that decompiles APK, XAPK, JAR and AAR files and finds the HTTP endpoints an app calls
122 skills for reverse engineering: malware, firmware, protocols, mobile apps, CTF work and vulnerability research.
A set of reverse engineering skills: symbol and structure recovery, Frida and IDAPython scripting, DEX and IL2CPP dumping, code emulation in Unicorn
A skills router for authorized reverse engineering, pentest, CTF and threat analysis: it picks a methodology for the task and checks available tools
REx@Skill
REx-skill
Claude Code skill that finds and proves defects in compiled binaries using seven subagents and a pinned toolchain.
A skill for analysing malware samples in IDA Pro: IDAPython, decompilation, imports, strings, C2 addresses and encryption traces.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| iOS Reverse Engineering Skill (this card) | no | 118 | |
| Android Reverse Engineering & API Extraction | no | 8,668 | An Android skill that decompiles APK, XAPK, JAR and AAR; this one analyzes iOS: IPA, Mach-O and Objective-C and Swift class headers |
| Reverse API Engineer | no | 2,718 | reverse-api-engineer records site traffic to HAR; this skill statically analyzes an iOS package without running the app |
README in short
The repository holds a skill with the `/extract-ipa` command, nine analysis scripts, five Ghidra scripts and nine reference files. The Unlicense places the project in the public domain.
README badge
Original SKILL.md
---
name: ios-reverse-engineering
description: Extract and analyze iOS IPA, .app bundles, Mach-O binaries, .dylib, and .framework files using ipsw, otool, strings, radare2/rizin, and Ghidra headless. Reverse engineer iOS apps, extract HTTP API endpoints (URLSession, Alamofire, Moya, AFNetworking, GraphQL, WebSocket), trace call flows from ViewControllers to network layer, analyze security patterns (ATS, cert pinning, keychain, jailbreak detection), audit static iOS vulnerabilities (insecure local storage, WebView/JS-bridge, deeplink/URL-scheme hijack, weak crypto/RNG, biometric-bypass patterns, sensitive-data logging, ATS detail, privacy/tracking, entitlements risk, debug artifacts), deep-scan for cloud & SaaS credentials (Firebase, AWS, GCP, Azure, Stripe, GitHub, GitLab, Twilio, SendGrid, Slack, Telegram, web3) with false-positive minimization (placeholder allowlist, format/entropy validation, client-safe tagging), perform LLM-assisted binary reversing analysis with Ghidra scripts, fingerprint embedded third-party SDKs with CVE checking, and detect anti-tampering protections (obfuscation, anti-debug, dylib injection prevention, integrity checks). Use when the user wants to extract, analyze, or reverse engineer iOS packages, find API endpoints, follow call flows, audit app security or vulnerabilities, scan for leaked secrets, identify third-party SDKs, detect app protections, or perform deep binary analysis.
---
# iOS Reverse Engineering
Extract and analyze iOS IPA files, .app bundles, Mach-O binaries, dynamic libraries, and frameworks using ipsw (blacktop/ipsw), otool, strings, radare2/rizin, and Ghidra headless. Trace call flows through application code, analyze security patterns, deep-scan for cloud provider credentials (Firebase, GCP, AWS, Azure), perform LLM-assisted binary reversing with decompilation and Ghidra headless scripts, fingerprint embedded third-party SDKs with version detection and CVE cross-referencing, and detect anti-tampering protections (obfuscation tools, anti-debugging, dylib injection prevention, integrity checks, jailbreak detection). Produce structured documentation of extracted APIs and security findings. Works with both Swift and Objective-C applications.
## Prerequisites
This skill requires **ipsw** (which includes class-dump functionality and much more) and, on macOS, the standard developer tools (**otool**, **strings**, **plutil**, **codesign**) via Xcode Command Line Tools. For deep binary analysis, **radare2** (or **rizin**) is recommended; **Ghidra headless** is optional for advanced decompilation. **On Linux**, `ipsw` provides cross-platform Mach-O analysis, entitlements, class-dump and thinning; `libplist`/`plistutil` (or `python3` plistlib) provide plist parsing; `binutils` provides `strings`/`nm`. `otool`/`codesign`/`plutil`/`PlistBuddy`/`lipo` are macOS-only and the scripts fall back to `ipsw`/`plistutil`/`python3` automatically — no macOS tools required on Linux. Run the dependency checker to verify:
```bash
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/check-deps.sh
```
If anything is missing, follow the installation instructions in `${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/references/setup-guide.md`.
## Workflow
### Phase 1: Verify and Install Dependencies
Before analyzing, confirm that the required tools are available — and install any that are missing.
**Action**: Run the dependency check script.
```bash
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/check-deps.sh
```
The output contains machine-readable lines:
- `INSTALL_REQUIRED:<dep>` — must be installed before proceeding
- `INSTALL_OPTIONAL:<dep>` — recommended but not blocking
**If required dependencies are missing** (exit code 1), install them automatically:
```bash
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/install-dep.sh <dep>
```
The install script detects the OS and package manager, then:
- Installs via Homebrew when available (`brew install blacktop/tap/ipsw`)
- Falls back to downloading from GitHub releases to `~/.local/share/`, symlinks in `~/.local/bin/`
- If installation fails, it prints the exact manual command and exits with code 2 — show these instructions to the user