Swift Obfuscation
iOS platform security & anti-tampering Swift library
Install Swift on local machine
Demangling with swift cli:
>>> swift demangle -compact "s5UIKit17UIApplicationMainys5Int32VAD_SpySpys4Int8VGGSgSSSgAJtF"
UIKit.UIApplicationMain(Swift.Int32, Swift.UnsafeMutablePointer<Swift.UnsafeMutablePointer<Swift.Int8>>?, Swift.String?, Swift.String?) -> Swift.Int32
Demangle all with r2:
>>> radare2 -A -q -c "fs symbols; f~sym.__" <Aplication_Binary> | sed 's/^.* sym.__\([^_]*\).*$/\1/' | xargs swift-demangle
Demangle Swift Function Names in header format:
>>> radare2 -A -q -e bin.demanglecmd=true -e emu.str=true Marcus -c "icc"
@interface Marcus.HomeViewController(Marcus)
{
}
- (void) willTransitionFromVC:toVC:
@end
@interface UIApplication(Marcus)
{
}
- (id) nextResponder
@end
@interface Marcus.ProfileViewController
{
Marcus.ProfileViewController::(ivar)viewModel
Marcus.ProfileViewController::(ivar)headerView
Marcus.ProfileViewController::(ivar)footerView
}
- (id) initWithCoder:
- (void) viewDidLoad
- (id) preferredNavigationBarBackground
- (id) preferredStatusBarBackground
- (id) initWithNibName:bundle:
- (void) .cxx_destruct
@end
[...]
dsdump can be used to dump swift information from a binary
Example:
>>> ./dsdump -sc -a arm64 Payload/iGoat-Swift.app/iGoat-Swift
protocol iGoat_Swift.TransitionAnimatable // 1 requirements
protocol iGoat_Swift.SideMenuControllerDelegate // 2 requirements
class iGoat_Swift.StringAnalysisExerciseVC : UIViewController /System/Library/Frameworks/UIKit.framework/UIKit {
// Properties
var answerTextField : weak UITextField?
// ObjC -> Swift bridged methods
0x1000c9380 @objc StringAnalysisExerciseVC.answerTextField <stripped>
0x1000c93a0 @objc StringAnalysisExerciseVC.setAnswerTextField: <stripped>
0x1000c95e0 @objc StringAnalysisExerciseVC.submit <stripped>
0x1000c960c @objc StringAnalysisExerciseVC.initWithNibName:bundle: <stripped>
0x1000c9718 @objc StringAnalysisExerciseVC.initWithCoder: <stripped>
0x1000c9808 @objc StringAnalysisExerciseVC..cxx_destruct <stripped>
// Swift methods
0x1000c93b4 func <stripped> // method
}