Report server status and available capabilities.

Parse an IPA file and extract full metadata (bundle ID, version, entitlements, frameworks, encryption status).

Args: path: Path to the IPA or .app bundle

Extract an IPA file to a directory for further analysis.

Args: path: Path to the IPA file output_dir: Optional output directory (defaults to _unpacked)

Extract entitlements from an IPA file or .app bundle.

Args: path: Path to IPA file or .app bundle

Dump Objective-C classes from a Mach-O binary using static analysis (nm + strings).

Args: path: Path to a Mach-O binary

Deep ObjC class dump using class-dump if available, falls back to nm+strings.

Args: path: Path to a Mach-O binary

Demangle Swift symbols from a Mach-O binary.

Args: path: Path to a Mach-O binary max_symbols: Maximum number of symbols to demangle (default: 500)

Enumerate linked frameworks and libraries from a Mach-O binary.

Args: path: Path to a Mach-O binary

Check if a Mach-O binary is encrypted (FairPlay DRM).

Args: path: Path to a Mach-O binary

List architectures in a Mach-O binary (via lipo).

Args: path: Path to a Mach-O binary

Run full static analysis pipeline on an IPA or Mach-O binary.

Combines IPA parsing, ObjC class dump, Swift symbol demangling, linked framework enumeration, encryption check, and endpoint scanning.

Args: path: Path to IPA file or Mach-O binary

List all available Frida devices (USB, local, remote).

Get detailed info about a Frida device.

Args: device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

List running processes on a Frida device.

Args: device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Find a process by name, PID, or bundle identifier.

Args: target: Process name, PID, or bundle ID device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Spawn an iOS app by bundle ID.

Args: bundle_id: Bundle identifier (e.g. com.example.app) device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Resume a spawned/suspended app.

Args: pid: Process ID device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Kill a process by PID.

Args: pid: Process ID device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Enumerate Objective-C classes at runtime on a running iOS app.

Uses Frida to enumerate all loaded ObjC classes from a running process.

Args: target: Bundle ID or PID of the target app device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Inject IAP (In-App Purchase) hook into a running iOS app.

Hooks StoreKit/SKPaymentQueue methods to log purchase transactions, product requests, and receipt validation attempts.

Args: target: Bundle ID or PID of the target app device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional) duration: Monitoring duration in seconds (default: 30)

Inject network interception hook into a running iOS app.

Hooks NSURLSession, CFNetwork, NSURLConnection, and WebSocket APIs to capture all network requests including URLs, headers, and body data.

Args: target: Bundle ID or PID of the target app device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional) duration: Monitoring duration in seconds (default: 30)

Check encryption status (cryptid) of loaded Mach-O binaries at runtime.

Uses Frida to enumerate all loaded modules and read their cryptid field.

Args: target: Bundle ID of the target app device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Decrypt FairPlay DRM from an iOS app using frida-ios-dump.

Dumps decrypted IPA from a running/installed app on a tethered iOS device. Requires frida-ios-dump to be installed.

Args: bundle_id: Bundle identifier of the target app output_dir: Output directory for decrypted IPA (default: /tmp/ios_decrypted) device_type: Device type: 'usb', 'local', or 'remote' (default: 'usb') device_id: Specific device ID (optional)

Check if an app is encrypted (FairPlay DRM) by reading cryptid at runtime.

Attaches to the running app and reads the cryptid field from Mach-O headers of all loaded modules.

Args: bundle_id: Bundle identifier of the target app

Check signing environment: available tools and code signing identities.

Returns signing method (ldid/codesign/none), available certs, and readiness.

Resign an iOS IPA or .app bundle with new identity and metadata.

Handles the full resigning workflow:

• Extracts IPA or copies .app bundle

• Replaces embedded.mobileprovision (if provided)

• Modifies Info.plist (bundle ID, display name, version)

• Signs all Mach-O binaries with ldid or codesign

• Repackages into IPA

Args: input_path: Path to .ipa or .app bundle to resign output_path: Output path for resigned IPA (default: _resigned.ipa) signing_cert: Code signing identity name/SHA1 (for codesign), or None for ldid provisioning_profile: Path to .mobileprovision file to embed new_bundle_id: New bundle identifier (e.g. com.example.resigned) new_display_name: New display name for the app new_version: New version string (CFBundleShortVersionString) new_build: New build number (CFBundleVersion)

Verify icon references in Info.plist match actual files in .app bundle.

Args: app_dir: Path to .app bundle

Run a comprehensive analysis pipeline on an iOS target.

Supports three levels:

• 'basic': IPA metadata only

• 'static': Full static analysis (IPA + Mach-O + ObjC + Swift + encryption)

• 'dynamic': Static analysis + Frida runtime hooks (requires device)

Args: target: Path to IPA file, Mach-O binary, or bundle ID for dynamic analysis level: Analysis level: 'basic', 'static', or 'dynamic' (default: 'static') output_dir: Output directory for analysis artifacts (default: /tmp/re_ios_analysis)

Get the recommended workflow for combining TrollStore (on-device) with re-ios (desktop).

TrollStore on iPhone handles decryption and installation; re-ios on Mac handles deep static analysis, IAP/network hook templates, and resigning.

Returns the step-by-step workflow reference.

Run the full original SKILL.md static analysis pipeline (bash scripts).

Executes the shell-based analysis pipeline from the ios-reverse-engineering skill: unpack → fingerprint → macho analyze → class scan → api scan → report. All results are written to output_dir.

Args: target: Path to IPA file, .app bundle, or Mach-O binary output_dir: Output directory (default: ios_analysis_out)

Generate a human-readable analysis report from an IPA or analysis directory.

Args: path: Path to IPA file or Mach-O binary analysis_dir: Optional path to analysis directory (for endpoint scanning)

Scan an analysis directory for hardcoded URLs, domains, and API paths.

Recursively scans text files for network endpoint clues.

Args: analysis_dir: Path to the analysis directory