iDecompile: Writing a Decompiler for iOS Applications

The talk starts from a gap in tooling: few dedicated resources exist for analyzing iOS apps, and the usual workflow forces analysts to chain separate utilities that run on different operating systems. The speaker splits an IPA bundle into four areas to examine: permissions, resources, the executable, and libraries with frameworks.

Each area gets a cross-platform approach. Binary and XML property lists are decoded with a Java library, and the embedded provisioning profile is stripped of its signature so its entitlements can be read. Localized strings and other resource files are scanned with regular expressions, universal Mach-O binaries are split into architecture slices, and Swift and Objective-C method names are demangled to rebuild class structure. Lifecycle methods serve as entry points, library code is separated from app code by checking documentation, and runtime dispatch calls are resolved from their string arguments. An LLM step then translates decompiled pseudocode into an approximate Swift or Objective-C form.

A demonstration shows the open-source tool, Malimite, loading an IPA with decoded resources and a method view, with translation requested for one function. The takeaway is that a single tool can automate most of the iOS triage workflow across Mac, Linux and Windows, and that the code is released so researchers can extend it.