OWASP Mobile Application Security Testing Guide: MASTG TOOL 0105

---
title: ipsw
platform: ios
source: https://github.com/blacktop/ipsw
hosts: [windows, linux, macOS]
---

IPSW calls itself an "iOS/macOS Research Swiss Army Knife". In general, IPSW allows you to obtain iOS specific files (IPSW, OTA, ...) and also statically analyze them. For application analysis, the most interesting features are the Objective-C and Swift class-dumps. Other features are available (kernelcache parser, device-tree parser, disassembler, etc) but are only useful if you're analyzing the security of the OS itself.

## Extracting Objective-C Class Information

IPSW can extract Objective-C class information from a MachO binary. The desired architecture can be specified using `--arch` in case of a universal MachO file:

```bash
$ ipsw class-dump --arch arm64 UnCrackable\ Level\ 1

@protocol NSObject

@required

...

-[UIApplicationDelegate applicationDidFinishLaunching:];
-[UIApplicationDelegate application:willFinishLaunchingWithOptions:];
-[UIApplicationDelegate application:didFinishLaunchingWithOptions:];
-[UIApplicationDelegate applicationDidBecomeActive:];

...
```

??? "Full command output"

    ```bash
    $ ipsw class-dump --arch arm64 UnCrackable\ Level\ 1

    @protocol NSObject

    @required

    @property (TQ,R) hash;
    @property (T#,R) superclass;
    @property (T@"NSString",R,C) description;
    @property (T@"NSString",R,C) debugDescription;

    /* required instance methods */
    -[NSObject isEqual:];
    -[NSObject class];
    -[NSObject self];
    -[NSObject performSelector:];
    -[NSObject performSelector:withObject:];
    -[NSObject performSelector:withObject:withObject:];
    -[NSObject isProxy];
    -[NSObject isKindOfClass:];
    -[NSObject isMemberOfClass:];
    -[NSObject conformsToProtocol:];
    -[NSObject respondsToSelector:];
    -[NSObject retain];
    -[NSObject release];
    -[NSObject autorelease];
    -[NSObject retainCount];
    -[NSObject zone];
    -[NSObject hash];
    -[NSObject superclass];
    -[NSObject description];

    @optional

    /* optional instance methods */
    -[NSObject debugDescription];

    @end

    @protocol UIApplicationDelegate <NSObject>

    @required

    @property (T@"UIWindow",&,N) window;

    @optional

    /* optional instance methods */
    -[UIApplicationDelegate applicationDidFinishLaunching:];
    -[UIApplicationDelegate application:willFinishLaunchingWithOptions:];
    -[UIApplicationDelegate application:didFinishLaunchingWithOptions:];
    -[UIApplicationDelegate applicationDidBecomeActive:];
    -[UIApplicationDelegate applicationWillResignActive:];
    -[UIApplicationDelegate application:handleOpenURL:];
    -[UIApplicationDelegate application:openURL:sourceApplication:annotation:];
    -[UIApplicationDelegate application:openURL:options:];
    -[UIApplicationDelegate applicationDidReceiveMemoryWarning:];
    -[UIApplicationDelegate applicationWillTerminate:];
    -[UIApplicationDelegate applicationSignificantTimeChange:];
    -[UIApplicationDelegate application:willChangeStatusBarOrientation:duration:];
    -[UIApplicationDelegate application:didChangeStatusBarOrientation:];
    -[UIApplicationDelegate application:willChangeStatusBarFrame:];
    -[UIApplicationDelegate application:didChangeStatusBarFrame:];
    -[UIApplicationDelegate application:didRegisterUserNotificationSettings:];
    -[UIApplicationDelegate application:didRegisterForRemoteNotificationsWithDeviceToken:];
    -[UIApplicationDelegate application:didFailToRegisterForRemoteNotificationsWithError:];
    -[UIApplicationDelegate application:didReceiveRemoteNotification:];
    -[UIApplicationDelegate application:didReceiveLocalNotification:];
    -[UIApplicationDelegate application:handleActionWithIdentifier:forLocalNotification:completionHandler:];
    -[UIApplicationDelegate application:handleActionWithIdentifier:forRemoteNotification:withResponseInfo:completionHandler:];
    -[UIApplicationDelegate application:handleActionWithIdentifier:forRemoteNotification:completionHandler:];
    -[UIApplicationDelegate application:handleActionWithIdentifier:forLocalNotification:withResponseInfo:completionHandler:];
    -[UIApplicationDelegate application:didReceiveRemoteNotification:fetchCompletionHandler:];
    -[UIApplicationDelegate application:performFetchWithCompletionHandler:];
    -[UIApplicationDelegate application:performActionForShortcutItem:completionHandler:];
    -[UIApplicationDelegate application:handleEventsForBackgroundURLSession:completionHandler:];
    -[UIApplicationDelegate application:handleWatchKitExtensionRequest:reply:];
    -[UIApplicationDelegate applicationShouldRequestHealthAuthorization:];
    -[UIApplicationDelegate applicationDidEnterBackground:];
    -[UIApplicationDelegate applicationWillEnterForeground:];
    -[UIApplicationDelegate applicationProtectedDataWillBecomeUnavailable:];
    -[UIApplicationDelegate applicationProtectedDataDidBecomeAvailable:];
    -[UIApplicationDelegate application:supportedInterfaceOrientationsForWindow:];
    -[UIApplicationDelegate application:shouldAllowExtensionPointIdentifier:];
    -[UIApplicationDelegate application:viewControllerWithRestorationIdentifierPath:coder:];
    -[UIApplicationDelegate application:shouldSaveApplicationState:];
    -[UIApplicationDelegate application:shouldRestoreApplicationState:];
    -[UIApplicationDelegate application:willEncodeRestorableStateWithCoder:];
    -[UIApplicationDelegate application:didDecodeRestorableStateWithCoder:];
    -[UIApplicationDelegate application:willContinueUserActivityWithType:];
    -[UIApplicationDelegate application:continueUserActivity:restorationHandler:];
    -[UIApplicationDelegate application:didFailToContinueUserActivityWithType:error:];
    -[UIApplicationDelegate application:didUpdateUserActivity:];
    -[UIApplicationDelegate application:userDidAcceptCloudKitShareWithMetadata:];
    -[UIApplicationDelegate window];
    -[UIApplicationDelegate setWindow:];

    @end

    @protocol __ARCLiteKeyedSubscripting__

    @required

    /* required instance methods */
    -[__ARCLiteKeyedSubscripting__ objectForKeyedSubscript:];
    -[__ARCLiteKeyedSubscripting__ setObject:forKeyedSubscript:];

    @optional

    @end

    @interface AppDelegate : UIResponder <UIApplicationDelegate> {
        /* instance variables */
        @"UIWindow" _window;
    }

    @property (T@"UIWindow",&,N,V_window) window;
    @property (TQ,R) hash;
    @property (T#,R) superclass;
    @property (T@"NSString",R,C) description;
    @property (T@"NSString",R,C) debugDescription;

    /* instance methods */
    -[AppDelegate application:didFinishLaunchingWithOptions:];
    -[AppDelegate applicationWillResignActive:];
    -[AppDelegate applicationDidEnterBackground:];
    -[AppDelegate applicationWillEnterForeground:];
    -[AppDelegate applicationDidBecomeActive:];
    -[AppDelegate applicationWillTerminate:];
    -[AppDelegate window];
    -[AppDelegate setWindow:];

    @end

    @interface ViewController : UIViewCont