MachOHeaderDumper for iOS (TrollStore)

<p dir="auto"><strong>A native iOS application designed for TrollStore environments to dump Objective-C headers, Swift type information, symbols, and structural details from Mach-O binaries directly on-device.</strong> Inspired by class-dump, but built entirely in Swift for iOS.</p>


Overview

<p dir="auto">MachOHeaderDumper provides developers, security researchers, and tweak developers with a powerful on-device tool to inspect iOS applications, frameworks, and dynamic libraries. By…

<p dir="auto"><strong>A native iOS application designed for TrollStore environments to dump Objective-C headers, Swift type information, symbols, and structural details from Mach-O binaries directly on-device.</strong> Inspired by class-dump, but built entirely in Swift for iOS.</p>


Overview

<p dir="auto">MachOHeaderDumper provides developers, security researchers, and tweak developers with a powerful on-device tool to inspect iOS applications, frameworks, and dynamic libraries. By leveraging TrollStore's ability to bypass standard sandbox restrictions, this app performs deep static analysis of Mach-O files without requiring a jailbreak or desktop tools for basic header dumping and structural analysis.</p>
<p dir="auto"><strong>Core Capabilities:</strong></p>
<ul dir="auto">
<li><strong>Objective-C Header Dumping:</strong> Extracts @interface, @protocol, @property, and @method declarations similar to class-dump.</li>
<li><strong>Swift Type Extraction:</strong> Identifies Swift classes, structs, enums, and protocols present in the binary metadata. Attempts symbol demangling using dlsym.</li>
<li><strong>Mach-O Structure Analysis:</strong> Displays detailed header information, load commands (including segments, sections, dylib dependencies, UUID, code signature location, etc.), symbol tables (local, external, undefined), and dynamic linking information (rebase, bind, export opcodes).</li>
<li><strong>On-Device Operation:</strong> All parsing and analysis happens directly on your iOS device.</li>
<li><strong>File Import:</strong> Import .dylib, .framework, or .app bundle, executable files via the native Files app integration.</li>
<li><strong>TrollStore Optimized:</strong> Assumes TrollStore installation for necessary file system access outside the standard app sandbox.</li>
</ul>
<p dir="auto"></p>

Features

<ul dir="auto">
<li><strong>? Native iOS Interface:</strong> Clean and responsive UI built with SwiftUI.</li>
<li><strong>? Robust Mach-O Parser:</strong>
<ul dir="auto">
<li>Handles 64-bit arm64/arm64e Mach-O files (Thin and Fat).</li>
<li>Parses essential load commands (LC_SEGMENT_64, LC_LOAD_DYLIB, LC_UUID, LC_SYMTAB, LC_DYSYMTAB, LC_DYLD_INFO_ONLY, LC_ENCRYPTION_INFO_64, LC_BUILD_VERSION, etc.).</li>
<li>Displays segment and section details (addresses, offsets, sizes, flags).</li>
</ul>
</li>
<li><strong>? Objective-C Analysis:</strong>
<ul dir="auto">
<li>Reconstructs interfaces from __objc_classlist, __objc_const, __objc_catlist, __objc_protolist.</li>
<li>Resolves method selectors and type encodings.</li>
<li>Parses property attributes (nonatomic, strong, weak, readonly, etc.).</li>
<li>Handles categories and merges them into base class definitions.</li>
<li>Identifies class (+) and instance (-) methods and properties.</li>
<li>Detects instancetype based on common patterns.</li>
</ul>
</li>
<li><strong>? Swift Analysis (Basic):</strong>
<ul dir="auto">
<li>Parses __swift5_types section to find type context descriptors.</li>
<li>Extracts mangled names for Classes, Structs, and Enums.</li>
<li><strong>Attempts demangling</strong> using _swift_demangle via dlsym (requires the function to be available in loaded images or the target binary).</li>
</ul>
</li>
<li><strong>? Dynamic Linker Info:</strong>
<ul dir="auto">
<li>Parses and displays rebase operations (pointer fixups).</li>
<li>Parses and displays bind, weak bind, and lazy bind operations (symbol linking).</li>
<li>Parses and displays the export trie information.</li>
</ul>
</li>
<li><strong>? Symbol Table Viewer:</strong> Lists symbols with their type, scope (external/local), section, and address/value.</li>
<li><strong>? Export Options:</strong>
<ul dir="auto">
<li>Copy generated Objective-C headers to the clipboard.</li>
<li>(Future) Share headers as .h files.</li>
<li>(Future) Export parsed structural info (JSON?).</li>
</ul>
</li>
<li><strong>? File Handling:</strong>
<ul dir="auto">
<li>Import binaries using UIDocumentPickerViewController.</li>
<li>Automatically resolves executables within .app and .framework bundles.</li>
</ul>
</li>
</ul>

Technical Details

<ul dir="auto">
<li><strong>Language:</strong> Primarily Swift, leveraging low-level access via mmap, UnsafeRawBufferPointer, and direct struct memory binding.</li>
<li><strong>Concurrency:</strong> Uses async/await and Task.detached for background parsing to keep the UI responsive. Actor isolation (MainActor) is used for UI updates.</li>
<li><strong>Parsing:</strong> Implements manual parsing of Mach-O structures, Objective-C metadata (class_ro_t, method_t, etc.), Swift type descriptors, and dyld opcodes (ULEB128/SLEB128 decoding, state machines). Avoids external parsing libraries for core Mach-O structure.</li>
<li><strong>Demangling:</strong> Relies on runtime availability of _swift_demangle via dlopen/dlsym. Does <em>not</em> bundle a static demangler library.</li>
<li><strong>TrollStore:</strong> Requires TrollStore installation to grant the app the necessary permissions to:
<ul dir="auto">
<li>Read files outside its sandbox (e.g., system frameworks, other app bundles).</li>
<li>Potentially use dlopen on arbitrary binaries (used for demangling).</li>
</ul>
</li>
</ul>

Installation (Requires TrollStore)


<li>Download the latest .tipa file from the Releases page.</li>
<li>Open the downloaded .tipa file with TrollStore.</li>
<li>Tap "Install".</li>
<li>The MachOHeaderDumper app will appear on your Home Screen.</li>


Usage


<li>Launch the MachOHeaderDumper app.</li>
<li>Tap the "Import File..." button.</li>
<li>Use the Files browser to navigate to and select the desired .dylib, .framework, or .app file/bundle.</li>
<li>The app will parse the binary in the background. Status updates will be shown.</li>
<li>Once parsing and analysis are complete, use the segmented picker at the top to switch between different views:
<ul dir="auto">
<li><strong>ObjC Header:</strong> View the generated Objective-C headers (if any). Use the "Show IVars" toggle if desired.</li>
<li><strong>Swift Types:</strong> View basic information about detected Swift types (mangled/demangled name, kind).</li>
<li><strong>Info:</strong> View Mach-O header details and UUID.</li>
<li><strong>Load Cmds:</strong> View the list of load commands and their parameters.</li>
<li><strong>Symbols:</strong> Browse the symbol table.</li>
<li><strong>DyldInfo:</strong> View rebase and bind operations.</li>
<li><strong>Exports:</strong> View exported symbols.</li>
</ul>
</li>
<li>Text selection is enabled in most detail views.</li>


Limitations & Future Work

<ul dir="auto">
<li><strong>Swift Analysis:</strong> Swift metadata parsing is basic. It doesn't yet extract methods, properties, protocol conformances, or detailed enum cases/struct layouts. Generating full Swift interface files is a future goal.</li>
<li><strong>Demangling Reliability:</strong> Swift demangling depends on finding _swift_demangle at runtime, which may not always succeed. Bundling a static demangler is a potential improvement.</li>
<li><strong>Objective-C Accuracy:</strong> Assumes relatively modern Objective-C runtime structures. Parsing highly obfuscated or unusual binaries might yield incomplete results. Doesn't handle runtime-only features like associated objects.</li>
<li><strong>Encrypted Binaries:</strong> Cannot currently parse encrypted App Store binaries. On-device decryption is a complex future possibility.</li>
<li><strong>Error Handling:</strong> While basic error handling is present, parsing malformed binaries could still lead to unexpected behavior or crashes.</li>
<li><strong>UI/UX:</strong> Further refinements like cross-referencing, search/filtering, graphical visualizers, and improved export options are planned.</li>
<li><strong>Runtime Analysis:</strong> Adding modes for inspecting live processes or loaded libraries is a potential advanced feature.</li>
</ul>

Building from Source


<li>Clone the repository: git clone https://github.com/speedyfriend433/MachOHeaderDumper.git</li>
<li>Open MachOHeaderDumper.xcodeproj in Xcode.</li>
<li>Select your device or simulator. (Note: dlopen/dlsym behavior might differ on simulator vs. device).</li>
<li>Build the project (Cmd+B).</li>
<li>To install on a device via TrollStore, you'll need to export an unsigned IPA:
<ul dir="auto">
<li>Product -> Archive.</li>
<li>In the Organizer window, select the archive.</li>
<li>Click "Distribute App".</li>
<li>Choose "Ad Hoc" or "Development".</li>
<li>Under "App Thinning", select "None".</li>
<li><strong>Crucially</strong>, uncheck "Include manifest for over-the-air installation" and <strong>ensure code signing is set to "Sign to Run Locally" or manually configured for no signing</strong>. (The exact steps depend on Xcode version and project setup. The goal is an unsigned IPA).</li>
<li>Export the IPA file.</li>
<li>Transfer the IPA to your device and install with TrollStore.</li>
</ul>
</li>
<li> </li>