ios-app-analysis

iOS app analysis

Investigate a concrete behavior and carry the finding through to a fix when requested. Distinguish the target iOS app, its Mac companion, and Termio: evidence from one does not establish another's implementation.

Establish the running versions

Read the repository's AGENTS.md and check the working tree before editing. Discover the device and installed app instead of reusing an old device ID or application path:

xcrun devicectl list devices --json-output /tmp/ios-analysis-devices.json
xcrun devicectl device info apps --device "$device_id" \
  --json-output /tmp/ios-analysis-apps.json
uv tool run --from pymobiledevice3 pymobiledevice3 apps query "$bundle_id"

Use the JSON results, filtered to the requested app. Record its bundle ID, executable, version, build, signing identity, and bundle location. A builtByDeveloper flag alone does not establish debugger access: Rex's TestFlight build reported that flag, while its signing identity was TestFlight distribution.

When no device is available, ask for connection/trust or work from an existing artifact. Check command help for the installed tool version. Prefer the existing pairing; don't replace it merely to get logs.

Choose an accessible source of evidence

• For a supplied .ipa or .app, inspect the bundle and executable directly. Use file, otool -L, otool -l, nm, swift-demangle, and targeted strings searches. Check Mach-O encryption information before promising useful disassembly. A decompiler reconstructs approximate code, not the original Swift source.
• devicectl device copy from and pymobiledevice3 apps pull expose supported file domains, usually app data. An installed bundle path from metadata does not make its executable accessible through those domains. If an executable pull returns not-found or denied, report the limit rather than repeating it with invented paths. Look for a local build, an accessible companion, or a user-supplied artifact.
• A Mac companion can reveal shared types and wire messages. Label those as Mac-binary findings. Type and field names suggest architecture; they do not prove control flow. Prefer a live API contract or runtime trace to confirm it.
• Use an available REA/decompiler workflow for a relevant accessible binary. Check its installed tools and instructions first. REA does not by itself provide access to an iPhone's app executable. Avoid installing a large tool stack when a protocol query or targeted inspection answers the question.