Using Type Metadata from Swift Binaries

Gregor Carmesin explains why compiled Swift code from iOS apps is hard to read with generic binary analysis tools. Stripped binaries often lack symbol names, and demangling the symbols that remain only shows part of the picture. He argues that Swift leaves a rich layer of type information in the binary regardless, and the talk maps out where that information lives.

The talk splits this data into two groups. Runtime type metadata is what the Swift runtime uses to handle types, including value witness tables, field offsets and vtables. Type descriptors mirror the declarations in source code and support reflection. Class metadata lines up with Objective-C class layouts, which makes classes easier to locate, while structs and enumerations require scanning memory sections for plausible metadata and checking expected pointers. Vtables and method descriptors reveal which methods exist and which override parent implementations, though method names and signatures are largely absent. Mangled names that embed references to other structures break standard demanglers, so the team wrote its own.

The prototype recovers types, fields including immutable ones, and method lists from binaries that have no symbols, and can link names to implementations when some symbols remain. Carmesin notes that even plain var properties get accessor methods in the vtable. Future work includes a Ghidra plugin and combining the results with data flow analysis to resolve field accesses and dynamic method calls.