# re-ios v0.2.0

MCP server for iOS reverse engineering: static analysis + Frida dynamic instrumentation.

**What it does:**
- Parse IPA / `.app` bundles — metadata, entitlements, URL schemes, encryption status
- Statically analyze Mach-O binaries — ObjC class dump, Swift symbol demangling, linked frameworks, archs, FairPlay DRM detection
- Manage Frida devices — list USB/local/remote, enumerate processes, spawn/kill apps
- Inject dynamic hooks — IAP (StoreKit) interception, NSURLSession network capture, runtime ObjC enumeration
- Decrypt FairPlay DRM — orchestrate frida-ios-dump for decrypted IPA extraction
- Full analysis pipeline — combine all of the above into a single comprehensive report

## Tools (27 total)

| Category | Tools |
|----------|-------|
| System | `check_ios` |
| IPA | `parse_ipa_tool`, `unpack_ipa_tool`, `get_ipa_entitlements` |
| Mach-O Static | `analyze_macho_objc`, `analyze_macho_objc_deep`, `analyze_swift_symbols`, `analyze_linked_frameworks`, `check_macho_encryption`, `analyze_macho_archs`, `full_static_analysis` |
| Frida Device | `frida_list_devices`, `frida_device_info`, `frida_list_processes`, `frida_find_process`, `frida_spawn_app`, `frida_resume_app`, `frida_kill_app` |
| Dynamic Hooks | `dynamic_enumerate_classes`, `dynamic_hook_iap`, `dynamic_hook_network`, `dynamic_check_cryptid` |
| Decryption | `decrypt_ipa`, `check_encryption` |
| Pipeline | `full_analysis`, `generate_analysis_report`, `scan_endpoints` |

## Installation

```bash
pip install -e .
re-ios
```

Register in `.mcp.json`:
```json
{
  "mcpServers": {
    "re-ios": {
      "command": "re-ios"
    }
  }
}
```

## Requirements

- **macOS** (for native Mach-O toolchain: `otool`, `nm`, `lipo`, `strings`, `file`, `codesign`)
- **Python 3.11+**
- **Frida** (optional, for dynamic analysis): `pip install frida`
- **frida-ios-dump** (optional, for FairPlay decryption)
- **class-dump** (optional, for deeper ObjC analysis)

## Quick Start

```bash
# Static IPA analysis
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"parse_ipa_tool","arguments":{"path":"./target.ipa"}}}' | re-ios

# Check binary encryption
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check_macho_encryption","arguments":{"path":"./executable"}}}' | re-ios

# Full static pipeline
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"full_static_analysis","arguments":{"path":"./target.ipa"}}}' | re-ios
```

## Project Structure

```
src/re_ios/
├── server.py              # FastMCP app (27 tools)
├── models.py              # Pydantic models
├── errors.py              # Exception hierarchy
├── logger.py              # Logging
├── macho/parser.py        # Mach-O static analysis
├── frida/
│   ├── device.py          # Device/process management
│   ├── session.py         # Script injection & RPC
│   └── scripts/           # Frida JS injection scripts
│       ├── enumerate_classes.js
│       ├── dump_ipa.js
│       ├── hook_iap.js
│       └── hook_network.js
├── ipa/
│   ├── unpack.py          # IPA parse & extract
│   └── decrypt.py         # FairPlay decryption
└── analysis/
    ├── static.py          # Report generation
    └── dynamic.py         # Dynamic analysis orchestration
```

## Examples

### Static analysis of Mach-O
```python
analyze_macho_objc(path="./MyApp")
analyze_swift_symbols(path="./MyApp", max_symbols=100)
analyze_linked_frameworks(path="./MyApp")
```

### Dynamic IAP hook
```python
dynamic_hook_iap(target="com.example.app", device_type="usb", duration=30)
```

### Network traffic capture
```python
dynamic_hook_network(target="com.example.app", device_type="usb")
```

### Full decryption
```python
decrypt_ipa(bundle_id="com.example.app", output_dir="/tmp/decrypted")
```