How do we reverse engineer iOS frameworks? The secret is actually pretty straightforward once I tell you. The iOS Simulator runtime is bundled with an entire copy of the iOS SDK, and it’s fully accessible on the MacOS file system. There’s a whole lot of interesting stuff we can look through. Stuff that has kept me busy for a long time.

Flawed iOS Security: Client-side obfuscation If you listen uncritically to everything you read on the internet, you might think you’re slick by obfuscating your strings. That’s certainly what I thought in 2019 when I first decided to be the resident security expert and added code like this to protect my Mixpanel API keys. While it’s a little harder to read than raw strings, it’s still straightforward for a sufficiently motivated hacker to steal your keys. If you use an insecure approach such as base-64 encoding or XORing, it’s trivial to reverse engineer. Even with a decent algorithm and salt, attackers can use tools like Frida to extract your API keys from device memory at runtime. Obfuscation provides security by obscurity, but this isn’t an effective approach. No matter how good your obfuscation is, that API key will eventually be decoded and sent across the network. See the full blog post here: