iObfuscate Unraveling iOS Obfuscation Techniques

The talk walks through the protections that stand between a reverse engineer and an iOS app's logic. Apple encrypts App Store binaries with FairPlay, so getting a usable binary normally requires a jailbroken device, and tools that claim to fetch decrypted IPAs often return only the encrypted copy. Beyond that platform layer, malware authors add their own obfuscation. Swift name mangling looks daunting at first, but the demangler built into Swift reverses it, and the speaker shares a Ghidra script that automates renaming across a binary.

Author-applied techniques include identifier renaming, control-flow flattening that routes code through a dispatch variable, and dead code inserted around lifecycle callbacks. The runtime section covers Objective-C swizzling, shown in a case from the Goon spyware family, where hooked session resume and suspend methods were exchanged to run extra code while the original methods still appeared unused. A second Ghidra script flags swizzling-related runtime calls. The talk then covers anti-debugging, jailbreak and simulator checks, and virtual-machine obfuscation, where custom bytecode is translated by an interpreter in native C++ code.

The closing section looks at App Store cases, including InstaAgent, which uploaded Instagram credentials in cleartext and reached around 500,000 downloads, and XcodeGhost, which infected apps during development by tampering with Xcode. The takeaway is that these layers protect legitimate developers but also slow analysts, so analysts should expect them. The speaker also announced an open-source iOS reverse engineering wiki and sample IPAs for practice.