AwesomeREA.org

Tool

iblessing

Toolkit for analyzing iOS apps and arm64 Mach-O binaries, built on Capstone, Unicorn and Keystone. Its scanners extract app-bundle metadata such as URL schemes and transport-security settings, locate Objective-C class references and NSPredicate uses, detect symbol wrappers, and partially emulate arm64 code with Unicorn to recover objc_msgSend cross-references, including those passed through blocks. Generators turn the reports into IDA Pro scripts that add cross-references and rename wrappers, or into a local query server, and a shared core library with a plug-in interface supports custom tools.

Targets
App · Binary
Category
Native analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: v1.0.4-beta, published 2021-11-26 and tagged at the reviewed master commit; every release is marked as a pre-release. Each recent release attaches macOS and Linux command-line and all-in-one binaries, framework archives with the shared core library and headers, and a JSON table of Foundation and UIKit method signatures. The README's feature list leaves Swift class parsing, following branches and calls, and Android scanners unfinished.
  • Users supply an iOS .app bundle for app-info or an arm64 Mach-O binary for the other scanners; README examples analyze commercial third-party apps after restoring symbols with a separate tool, but no app binaries are committed. The class and objc_msgSend cross-reference scanners accept arm64 binaries only, and app-info is unavailable on Linux because it still depends on Cocoa. The README warns that binary scanners reserve 12 GB of virtual memory per Mach-O file, so physical memory or swap must cover that.
  • Builds on macOS or Linux with CMake 3.5+ and a C++17 compiler after a recursive clone; compile-cmake.sh first builds the pinned Capstone, Unicorn (arm, aarch64 and x86) and Keystone submodules as static libraries. An Xcode project is also included. IDA Pro is needed only to apply the generated scripts.
  • GitHub Actions builds on Ubuntu and macOS and, on macOS only, scans the bundled sample-app benchmark and runs the built-in objc_msgSend cross-reference test; Travis CI builds and publishes tagged releases. The README notes that objc-msg-xref follows no calls to save time, so its results are partly missing. This review ran neither the tools nor the tests.
  • GPL-3.0 (LICENSE). The project calls itself an iOS security exploiting toolkit; this record covers its analysis functions only. Analyzed apps and Apple frameworks keep their own terms, and the Capstone, Unicorn and Keystone submodules carry their own licenses.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · Soulghost/iblessing · Revision ff14351
  2. compile-cmake.command GitHub · Soulghost/iblessing · Revision ff14351
  3. .gitmodules GitHub · Soulghost/iblessing · Revision ff14351
  4. iblessing/CMakeLists.txt GitHub · Soulghost/iblessing · Revision ff14351
  5. .github/workflows/c-cpp.yml GitHub · Soulghost/iblessing · Revision ff14351
  6. run-test.command GitHub · Soulghost/iblessing · Revision ff14351
  7. .travis.yml GitHub · Soulghost/iblessing · Revision ff14351
  8. iblessing/iblessing/tests GitHub · Soulghost/iblessing · Revision ff14351
  9. LICENSE GitHub · Soulghost/iblessing · Revision ff14351
  10. https://github.com/Soulghost/iblessing/releases/tag/v1.0.4-beta

More in Native binaries

All 129 entries in Native binaries