re-ios v0.2.0

MCP server for iOS reverse engineering: static analysis + Frida dynamic instrumentation.

What it does:

• Parse IPA / .app bundles — metadata, entitlements, URL schemes, encryption status
• Statically analyze Mach-O binaries — ObjC class dump, Swift symbol demangling, linked frameworks, archs, FairPlay DRM detection
• Manage Frida devices — list USB/local/remote, enumerate processes, spawn/kill apps
• Inject dynamic hooks — IAP (StoreKit) interception, NSURLSession network capture, runtime ObjC enumeration
• Decrypt FairPlay DRM — orchestrate frida-ios-dump for decrypted IPA extraction
• Full analysis pipeline — combine all of the above into a single comprehensive report

Tools (27 total)

Category	Tools
System	check_ios
IPA	parse_ipa_tool, unpack_ipa_tool, get_ipa_entitlements
Mach-O Static	analyze_macho_objc, analyze_macho_objc_deep, analyze_swift_symbols, analyze_linked_frameworks, check_macho_encryption, analyze_macho_archs, full_static_analysis
Frida Device	frida_list_devices, frida_device_info, frida_list_processes, frida_find_process, frida_spawn_app, frida_resume_app, frida_kill_app
Dynamic Hooks	dynamic_enumerate_classes, dynamic_hook_iap, dynamic_hook_network, dynamic_check_cryptid
Decryption	decrypt_ipa, check_encryption
Pipeline	full_analysis, generate_analysis_report, scan_endpoints

Installation

pip install -e .
re-ios

Register in .mcp.json:

{
  "mcpServers": {
    "re-ios": {
      "command": "re-ios"
    }
  }
}

Requirements

• macOS (for native Mach-O toolchain: otool, nm, lipo, strings, file, codesign)
• Python 3.11+
• Frida (optional, for dynamic analysis): pip install frida
• frida-ios-dump (optional, for FairPlay decryption)
• class-dump (optional, for deeper ObjC analysis)

Quick Start

# Static IPA analysis
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"parse_ipa_tool","arguments":{"path":"./target.ipa"}}}' | re-ios

# Check binary encryption
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check_macho_encryption","arguments":{"path":"./executable"}}}' | re-ios

# Full static pipeline
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"full_static_analysis","arguments":{"path":"./target.ipa"}}}' | re-ios

Project Structure

src/re_ios/
├── server.py              # FastMCP app (27 tools)
├── models.py              # Pydantic models
├── errors.py              # Exception hierarchy
├── logger.py              # Logging
├── macho/parser.py        # Mach-O static analysis
├── frida/
│   ├── device.py          # Device/process management
│   ├── session.py         # Script injection & RPC
│   └── scripts/           # Frida JS injection scripts
│       ├── enumerate_classes.js
│       ├── dump_ipa.js
│       ├── hook_iap.js
│       └── hook_network.js
├── ipa/
│   ├── unpack.py          # IPA parse & extract
│   └── decrypt.py         # FairPlay decryption
└── analysis/
    ├── static.py          # Report generation
    └── dynamic.py         # Dynamic analysis orchestration

Examples

Static analysis of Mach-O

analyze_macho_objc(path="./MyApp")
analyze_swift_symbols(path="./MyApp", max_symbols=100)
analyze_linked_frameworks(path="./MyApp")

Dynamic IAP hook

dynamic_hook_iap(target="com.example.app", device_type="usb", duration=30)

Network traffic capture

dynamic_hook_network(target="com.example.app", device_type="usb")

Full decryption

decrypt_ipa(bundle_id="com.example.app", output_dir="/tmp/decrypted")