iOS Reverse Engineering With Frida

The talk introduces Frida, a dynamic instrumentation toolkit that injects JavaScript into running native processes, and argues that iOS reverse engineering is approachable with a computer and a jailbroken iPhone. The speaker walks through preparing the environment: installing matching Frida versions on the host and the device, choosing a jailbreak based on the phone's chip and iOS version, and adding Frida from a package source on the device.

The core of the talk covers three methodologies. Connect and explore uses the command line to list loaded modules, filter them for libraries of interest, find base addresses, and inspect memory ranges, along with loading scripts from files. Catch and release uses frida-trace to hook Objective-C and plain C functions, and shows why the correct flag matters. The speaker applies this to the Messages process to follow a PDF-rendering path in CoreGraphics tied to a published zero-click exploit, then uses a back trace to display the call chain. The Python bindings are presented as a clearer way to pass and handle data, such as memory dumps, than JavaScript.

The closing tips cover case-insensitive matching to widen hook coverage, a no-pause flag that avoids reconnecting, and spawn gating for short-lived processes that cannot otherwise be attached to. The talk ends by noting that Frida is free and open source, and that bug reports and contributions are welcome.