Skip to content

Swift

Swift

Swift Obfuscation
iOS platform security & anti-tampering Swift library

Swift 5

Install Swift on local machine

Demangling with swift cli:

>>> swift demangle -compact "s5UIKit17UIApplicationMainys5Int32VAD_SpySpys4Int8VGGSgSSSgAJtF"
UIKit.UIApplicationMain(Swift.Int32, Swift.UnsafeMutablePointer<Swift.UnsafeMutablePointer<Swift.Int8>>?, Swift.String?, Swift.String?) -> Swift.Int32

Demangle all with r2:

>>> radare2 -A -q -c "fs symbols; f~sym.__" <Aplication_Binary> | sed 's/^.* sym.__\([^_]*\).*$/\1/' | xargs swift-demangle

Demangle Swift Function Names in header format:

>>> radare2 -A -q -e bin.demanglecmd=true -e emu.str=true Marcus -c "icc"
@interface Marcus.HomeViewController(Marcus)
{
}
- (void) willTransitionFromVC:toVC:
@end
@interface UIApplication(Marcus)
{
}
- (id) nextResponder
@end
@interface Marcus.ProfileViewController
{
   Marcus.ProfileViewController::(ivar)viewModel
   Marcus.ProfileViewController::(ivar)headerView
   Marcus.ProfileViewController::(ivar)footerView
}
- (id) initWithCoder:
- (void) viewDidLoad
- (id) preferredNavigationBarBackground
- (id) preferredStatusBarBackground
- (id) initWithNibName:bundle:
- (void) .cxx_destruct
@end
[...]

Using dsdump

dsdump can be used to dump swift information from a binary

Example:

>>> ./dsdump -sc -a arm64 Payload/iGoat-Swift.app/iGoat-Swift 
protocol iGoat_Swift.TransitionAnimatable // 1 requirements
protocol iGoat_Swift.SideMenuControllerDelegate // 2 requirements
​
class iGoat_Swift.StringAnalysisExerciseVC : UIViewController /System/Library/Frameworks/UIKit.framework/UIKit {
​
	// Properties
	var answerTextField : weak UITextField?
​
	// ObjC -> Swift bridged methods
	0x1000c9380  @objc StringAnalysisExerciseVC.answerTextField <stripped>
	0x1000c93a0  @objc StringAnalysisExerciseVC.setAnswerTextField: <stripped>
	0x1000c95e0  @objc StringAnalysisExerciseVC.submit <stripped>
	0x1000c960c  @objc StringAnalysisExerciseVC.initWithNibName:bundle: <stripped>
	0x1000c9718  @objc StringAnalysisExerciseVC.initWithCoder: <stripped>
	0x1000c9808  @objc StringAnalysisExerciseVC..cxx_destruct <stripped>
​
	// Swift methods
	0x1000c93b4  func <stripped> // method 
}

Swift 4