AwesomeREA.org

Learning resource

Reverse Engineering iOS Applications

Ivan Rodriguez's free English course (version 1.1) on reverse engineering iOS applications, aimed at beginners in iOS app security. Five Markdown modules cover setting up a jailbroken test device, decrypting App Store apps for analysis, static analysis of an IPA's files, frameworks, Objective-C classes and ARM binary in Hopper or Ghidra, runtime analysis with Cycript and Frida, and binary patching in Hopper. Exercises use CoinZa, a deliberately insecure Objective-C app the author built from vulnerability classes he reports finding in production App Store apps.

Requirements & limits

  • Reviewed at commit 183873a (2024-04-17). The course was written mainly in 2019; commits since mid-2020 are a few small wording and command fixes. Device instructions cover iOS 10 through 12, and many setup tools are from that period, so they may not work on current devices. The introduction excludes jailbreaking, iOS exploitation, tweak development, backend API testing and in-depth ARM assembly.
  • The prerequisites page lists no mandatory knowledge but recommends a Mac (Xcode has no Windows alternative), basic Objective-C, Swift, JavaScript, HTML, SSH/SCP and man-in-the-middle concepts, and an ARM disassembler such as Ghidra, IDA or Hopper's trial. A jailbroken iPhone/iPad/iPod on iOS 10 or later is needed only for the decryption module and the Cycript and Frida exercises.
  • No third-party app is needed for the exercises: the author ships CoinZa as an already-decrypted IPA, plus an EPUB of the course, in the companion repository RE-iOS-Apps-Extras-Github. The README says its vulnerabilities come from production apps but are reproduced in CoinZa instead of being published against those apps, and the closing page asks readers to report vulnerabilities responsibly.
  • There is no separate license file; the README carries an MIT-style permission notice (Copyright 2019 Ivan Rodriguez) and an at-your-own-risk disclaimer; the closing page asks people who reuse the material to credit the author. This collection read the course pages at the reviewed commit and did not install CoinZa or follow the device steps; the course mentions no AI or REA use.

About this entry

Type
Learning resource
Category
Learning resources
Relationship
Learning resource
Targets
App · Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · ivRodriguezCA/RE-iOS-Apps · Revision 183873a
  2. Prerequisites.md GitHub · ivRodriguezCA/RE-iOS-Apps · Revision 183873a
  3. Introduction.md GitHub · ivRodriguezCA/RE-iOS-Apps · Revision 183873a
  4. Module-1/README.md GitHub · ivRodriguezCA/RE-iOS-Apps · Revision 183873a
  5. Module-3/README.md GitHub · ivRodriguezCA/RE-iOS-Apps · Revision 183873a
  6. Module-4/README.md GitHub · ivRodriguezCA/RE-iOS-Apps · Revision 183873a
  7. Final-Thoughts.md GitHub · ivRodriguezCA/RE-iOS-Apps · Revision 183873a
  8. Files GitHub · ivRodriguezCA/RE-iOS-Apps-Extras-Github · Revision 19ec1d2

More in References and learning

All 43 entries in References and learning