iOS Basic Static Analysis — Advanced Study GuideThis episode moves from the fundamentals of iOS malware analysis into hands-on static binary analysis, demonstrating how command-line utilities and reverse-engineering tools can reveal valuable information without executing the malware.1. otool — Inspecting Mach-O Binariesotool is one of the most useful command-line utilities for examining Apple Mach-O binaries.A particularly important option is:otool -L application This displays the dynamic libraries linked by the executable.Analyzing these libraries can provide early clues about the application's functionality and dependencies.For example, an analyst may investigate whether an application relies on libraries associated with:
- Networking
- Cryptography
- User interfaces
- System services
- Other potentially interesting functionality
2. nm — Examining SymbolsThe nm utility displays symbols contained within a binary.This can help analysts identify:
- Functions
- Global symbols
- External references
- Potentially interesting APIs
Searching symbols for security-sensitive functions can provide useful leads for further investigation.The important principle is:Symbols don't prove malicious behavior, but they can help identify where to investigate.3. Identifying Objective-C vs. SwiftThe language used to develop an iOS application can sometimes be inferred from characteristics of its compiled binary.Objective-CObjective-C applications commonly expose recognizable:
- Class names
- Method names
- Objective-C runtime metadata
- Selector information
SwiftSwift uses name mangling, meaning function and symbol names may appear in encoded or transformed forms.Older Swift binaries can contain recognizable mangling patterns such as _T.However, analysts should avoid relying on a single indicator because modern binaries can contain a mixture of:
- Swift
- Objective-C
- C/C++
- Third-party frameworks
4. Class DumpingClass-dumping tools can help reconstruct information about Objective-C classes from compiled binaries.Conceptually:Mach-O Binary ↓ Objective-C Metadata ↓ Classes / Methods ↓ Potential Application Logic This can give an analyst an initial understanding of the application's internal architecture without immediately performing full reverse engineering.5. Disassembly and Reverse EngineeringFor deeper analysis, tools such as Hopper and IDA Pro can be used to examine the binary at the assembly level.A typical workflow is:IPA ↓ Mach-O Executable ↓ Disassembly ↓ Functions ↓ Control-Flow Analysis ↓ Decompilation ↓ Behavioral Understanding These tools can help researchers:
- Locate functions
- Search strings
- Follow cross-references
- Visualize control flow
- Examine assembly instructions
- Generate higher-level pseudocode
The goal isn't simply to read assembly—it is to reconstruct the program's logic.6. Initial Malware TriageBefore performing extensive analysis, the episode demonstrates basic malware triage.A useful first step is generating a cryptographic hash of the sample.For example:md5 malware.ipa The resulting hash can be used as a sample identifier when checking authorized malware-intelligence resources.The general workflow is:Sample ↓ Hash ↓ Threat Intelligence Lookup ↓ Existing Detections / Reputation ↓ Initial Context A hash lookup can provide useful context, but a lack of detections does not mean that the file is safe.7. Extracting the IPAAn IPA can be extracted to expose its internal application structure.Conceptually:malware.ipa ↓ Payload/ ↓ malware.app/ ├── executable ├── Info.plist ├── Frameworks/ └── Resources/ The executable and Info.plist are particularly valuable during initial triage.8. Analyzing Info.plistThe episode uses plutil to inspect the application's property-list information.For example:plutil -p Info.plist The analyst can use this information to investigate:
- Bundle identifier
- Application metadata
- Executable name
- Application configuration
- Supported capabilities
- Potentially suspicious settings
9. Hidden Application BehaviorOne particularly interesting discovery in the lab is the discrepancy between the executable's internal identity and how the application presents itself to the user.The executable is associated with "no icon", while the application presents itself as "passbook" and contains configuration indicating a hidden icon.This type of inconsistency is valuable during malware triage because it raises questions about the application's intended behavior.An analyst should ask:
- Why is the application attempting to hide?
- Why does its internal naming differ from its apparent identity?
- What functionality is being concealed?
- Does the application attempt to maintain persistence?
- What happens when it executes?
These questions form the basis of the behavioral hypothesis.10. String AnalysisExtracting strings from a binary is another useful early-stage technique.Conceptually:Binary ↓ Strings ↓ URLs IPs File Paths Commands Configuration Identifiers ↓ Behavioral Hypothesis Strings can reveal:
- Domains
- URLs
- IP addresses
- File paths
- Error messages
- Configuration values
- API endpoints
- Debug information
However, strings must be treated carefully because they can be:
- Obfuscated
- Encoded
- Unused
- Dynamically constructed
Therefore, discovering a suspicious domain is an indicator, not automatically proof of malicious communication.11. HTTP Artifact DiscoveryThe episode searches the binary for HTTP-related artifacts and discovers numerous suspicious domains.This provides an important investigative lead.For example:Application │ ├── Domain A ├── Domain B ├── Domain C └── Domain D The analyst can then investigate how those domains are referenced by the application.Possible hypotheses include:
- Downloading additional components
- Command-and-control communication
- Retrieving configuration
- Sending collected information
- Connecting to remote services
The next step would be determining which functions reference those strings.12. From Indicators to HypothesesThe episode emphasizes an important malware-analysis principle:Static artifacts should be used to construct hypotheses rather than immediately declaring conclusions.For example:Hidden Application + Suspicious Domains + HTTP References + Interesting Functions ↓ Potential Network-Based Malware ↓ Dynamic Analysis Required Static analysis might suggest that an application communicates with external infrastructure, but dynamic analysis can help establish whether those connections actually occur.13. Recommended Investigation FlowThe techniques from this episode fit into a broader iOS malware-analysis workflow:1. Preserve Sample ↓ 2. Calculate Hash ↓ 3. Threat Intelligence Lookup ↓ 4. Extract IPA ↓ 5. Analyze Info.plist ↓ 6. Identify Executable ↓ 7. Determine Language / Architecture ↓ 8. Inspect Linked Libraries ↓ 9. Examine Symbols ↓ 10. Extract Strings ↓ 11. Identify URLs / Domains / IPs ↓ 12. Disassemble Interesting Functions ↓ 13. Build Behavioral Hypothesis ↓ 14. Perform Controlled Dynamic Analysis Key Takeaways
- otool is valuable for inspecting Mach-O binaries and linked libraries.
- nm provides insight into available symbols and function references.
- Objective-C and Swift can often be distinguished through binary metadata and naming conventions.
- Hopper and IDA Pro provide deeper disassembly and reverse-engineering capabilities.
- Hashing is an important first step in malware triage and sample identification.
- Info.plist can expose important application metadata and suspicious configuration.
- String analysis can reveal domains, URLs, paths, and other behavioral indicators.
- Suspicious network artifacts can help formulate hypotheses about C2 or remote-resource activity.
- Static analysis should establish hypotheses that can later be validated through controlled dynamic analysis.
Golden ConceptThe objective of basic static analysis isn't to completely understand the malware immediately. It is to rapidly collect enough reliable evidence to build a behavioral hypothesis and determine where deeper reverse engineering should focus.
You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy
