The Pin Puller's Guide: A Hands-On Guide to Reverse Engineering iOS Applications

The talk covers certificate pinning, the check that makes an app reject a proxy's substituted certificate and so blocks tools such as Burp. It explains why developers often dislike the control, since an expired pinned certificate can lock users out until an update ships. The demo target is the Damn Vulnerable iOS App on a jailbroken iPhone, where traffic routed through Burp fails the pin even after the Burp CA is trusted.

A quick Objection hook disables pinning and lets the request through, but the success message never appears, which shows the app skipped its intended code path. In Ghidra, the speaker searches for the error string, follows it to a branch driven by a boolean comparison, and sets aside simply patching that jump. Instead, they hook the NSData isEqual call, where the logged arguments show the app comparing against the server certificate rather than the Burp CA. A broad NSObject hook crashed the app, which is why a narrow hook point matters.

The fix replaces the bundled certificate with the server's leaf certificate, captured with OpenSSL and converted from PEM to DER. After the swap, the HTTPS request goes through and the original success message appears, so the intended code path runs. A source review confirms the app checks the certificate at index zero of the trust chain. For practitioners, a generic pinning disable can silently skip logic, and the same reversing workflow applies to other checks. The speaker argues pinning is usually defeated, so server-side controls deserve more effort.