Frida runtime hooks fail when the code you want to bypass runs before Frida can attach, or when the app implements pinning entirely in C++ with no ObjC or Swift symbols to intercept. Some apps use ...

CCCrypt is the one-shot CommonCrypto function that the majority of iOS apps reach for when they want AES or DES. Static analysis tells you the algorithm constant. It does not tell you the runtime k...

iOS entitlements are a signed plist embedded in the binary. They gate every sensitive OS capability an app can use - associated domains, push notification environments, iCloud containers, and Keych...

iOS backups are a frequently overlooked data exposure vector. When a user backs up their iPhone to a Mac or to iCloud, the backup includes every app’s Documents/, Library/Preferences/, and Library/...

Static analysis finds secrets that are in the binary. It misses secrets that are assembled at runtime - a token decrypted from CoreData at launch, a JWT built from a stored key and a fresh timestam...

Logout in iOS apps is often a UI event, not a storage cleanup. The app sets a boolean flag like isLoggedIn = false in UserDefaults and navigates to the login screen. It does not delete the session ...

NSURLCredentialStorage is the OS-level credential cache for HTTP authentication challenges - Basic, Digest, NTLM. When an app stores credentials there with .permanent persistence, iOS writes them t...

App Store binaries ship with FairPlay DRM. otool on the on-disk binary shows cryptid=1, which means every attempt at static analysis, class-dump, Ghidra, Hopper, strings, hits encrypted bytes. frid...

iOS ships CommonCrypto as the native symmetric cipher library. Every algorithm it supports is accessible, including the broken ones. DES, 3DES, RC4, MD5, SHA-1 - all compile, link, and run without ...

UIActivityViewController is the iOS share sheet - the tray that lets users copy, AirDrop, save to Files, print, or send data to third-party apps. When the app presents the share sheet with sensitiv...