iblessing

Open source

iblessing is an iOS security exploiting toolkit, it mainly includes application information gathering, static analysis and dynamic analysis. It can be used for

684 stars0 likes0 views

Website GitHub

About

iblessing is an iOS security exploiting toolkit, it mainly includes application information gathering, static analysis and dynamic analysis. It can be used for

☠️ ██╗██████╗ ██╗ ███████╗███████╗███████╗██╗███╗ ██╗ ██████╗ ██║██╔══██╗██║ ██╔════╝██╔════╝██╔════╝██║████╗ ██║██╔════╝ ██║██████╔╝██║ █████╗ ███████╗███████╗██║██╔██╗ ██║██║ ███╗ ██║██╔══██╗██║ ██╔══╝ ╚════██║╚════██║██║██║╚██╗██║██║ ██║ ██║██████╔╝███████╗███████╗███████║███████║██║██║ ╚████║╚██████╔╝ ╚═╝╚═════╝ ╚══════╝╚══════╝╚══════╝╚══════╝╚═╝╚═╝ ╚═══╝ ╚═════╝

iblessing

iblessing is an iOS security exploiting toolkit, it mainly includes application information gathering, static analysis and dynamic analysis.
iblessing is based on unicorn engine, capstone engine and keystone engine.

Features

Cross-platform: Tested on macOS and Ubuntu.
iOS App static info extract, including metadata, deeplinks, urls, etc.
Mach-O parser and dyld symbol bind simulator
Objective-C class realizing and parsing
Scanners making dynamic analysis for arm64 assembly code and find key information or attack surface
Scanners using unicorn to partially simulate Mach-O arm64 code execution and find some features
Generators that can provide secondary processing on scanner's report to start a query server, or generate script for IDA
Super objc_msgSend xrefs scanner
- objc methods and subs (such as blocks) emulation to generate xrefs like flare-emu
- objc function wrapper detect and ida usercall generate
- objc_msgSend sub functions analysis
- objc block to objc_msgSend xrefs in args and capture list
- report format including json, etc.
- Swift class and method parsing
- following branches and calls
- SimProcedures for extern symbols
Tests
Android Scanners Suport
Diagnostic logs
More flexible scanner infrastructure for new scanner plugins

Support

In case you need support regarding iblessing or anything associated with it, you can:

create an issue and provide necessary information
contact Sou1gh0st on Twitter
send mail to xiuyutong1994#163.com
send mail to xiuyutong1994#gmail.com

Changelog

2021.06.27 - New arch (Shell Programm + Core Library) and plugin support (beta)
2021.01.23 - Add method signatures for system libraries (Foundation, UIKit), further enhanced analytical capabilities (https://github.com/Soulghost/iblessing/wiki/System-Libraries-(Foundation,-UIKit)-Simple-SimProcedure)
2020.11.30 - Objc reflection info (https://github.com/Soulghost/iblessing/wiki/Objc-Reflection-Info)
2020.10.24 - Objc call snapshots (https://github.com/Soulghost/iblessing/wiki/Objc-Call-Snapshots)
2020.10.04 - Objc category list support
2020.09.28 - Static library and fat mach-o support
2020.09.22 - Basic program state and condition branching
2020.09.04 - Method validation, infering, objc_msgSendSuper support
2020.08.11 - Now iblessing is a cross-platform tool, support both macOS and Linux
2020.08.08 - Improve objc_msgSend xref scanner, add sub xref supoort, including block arguments and capture list
2020.07.30 - Improve symbol-wrapper scanner, and add ida scripts for symbol wrapper rename and prototype modification
2020.07.21 - First release

Get started

⚠️⚠️⚠️ Binary Scanners require 12GB of virtual memory space to loading a mach-o file, but won't consume so much. So you need to ensure that the physical memory of your working machine is greater than 12GB, or ensure that allocatable virtual memory is greater than 12GB through the swap file mechanism.

You can download the pre-released iblessing binary and enjoy it.
run chmod +x for the binary
For more tutorails, please check the Documentation & Help below.

How to Use

Releases https://github.com/Soulghost/iblessing/releases

All in One Binary

iblessing-darwin-all/iblessing-linux

Shell Program + Dylib

untar iblessing-framework.tar.gz
iblessing-darwin/iblessing-linux + libiblessing-core.dylib/libiblessing-core.so

Develop Your Own Tools based on iblessing Framework

untar iblessing-framework.tar.gz
your binary + libiblessing-core.dylib/libiblessing-core.so + include/iblessing-core
sample code: iblessing-core/otool.cpp

How to Build

CMake

Platform: macOS, Linux

To get started compiling iblessing, please follow the steps below:

bash

git clone --recursive -j4 https://github.com/Soulghost/iblessing
cd iblessing
./compile-cmake.sh

Shortcuts

Basic Concepts
Scanners
- Scan for AppInfos ⚠️ Not currently available on Linux
- Scan for Class XREFs
- Scan for All objc_msgSend XREFs
- Scan for Simple Symbol Wrappers
Generators

If there are any errors, you can manully compile capstone and unicorn, then drag libcapstone.a and libunicorn.a to the Xcode project's vendor/libs.

If all of this run successfully, you can find the binary in build directory:

> ls ./build
iblessing

> file ./build/iblessing
./build/iblessing: Mach-O 64-bit executable x86_64

Documentation & Help

Preview

…

Basic Concepts

Scanner

A scanner is a component used to output analysis report through static and dynamic analysis of binary files, for example, the objc-msg-xref scanner can dynamiclly analyze most objc_msgSend cross references.

[*] Scanner List:
    - app-info: extract app infos
    - objc-class-xref: scan for class xrefs
    - objc-msg-xref: generate objc_msgSend xrefs record
    - predicate: scan for NSPredicate xrefs and sql injection surfaces
    - symbol-wrapper: detect symbol wrappers

Generator

A generator is a component that performs secondary processing on the report generated by the scanner, for example, it can generate IDA scripts based on the the objc-msg-xref scanner's cross references report.

[*] Generator List:
    - ida-objc-msg-xref: generator ida scripts to add objc_msgSend xrefs from objc-msg-xref scanner's report
    - objc-msg-xref-server: server to query objc-msg xrefs
    - objc-msg-xref-statistic: statistics among objc-msg-send reports

Basic Usage

Scan for AppInfos

⚠️ Because some of the dependence on Cocoa has not been lifted (such as bplist parser), it is not currently available on Linux.

> iblessing -m scan -i app-info -f

Let's take WeChat as an example:

…

Scan for Class XREFs

Notice: ARM64 Binaries Only

iblessing -m scan -i objc-class-xref -f  -d 'classes=,,...'

…

Scan for All objc_msgSend XREFs

Notice: ARM64 Binaries Only

Simple Mode

iblessing -m scan -i objc-msg-xref -f

Anti-Wrapper Mode

iblessing -m scan -i objc-msg-xref -f WeChat -d 'antiWrapper=1'

The anti-wrapper mode will detect objc_msgSend wrappers and make transforms, such as:

arm

; __int64 __usercall objc_msgSend_X0_X22_X20@(void *obj@, const char *sel@, id anyObj@, ...)
objc_msgSend_X0_X22_X20:
MOV             X1, X22
MOV             X2, X20
B               objc_msgSend

Usage Example:

…

The report can be used by the generators, now let's go.

Generate objc_msgSend Xrefs Query Server

You can start a server through iblessing's objc-msg-xref-server generator to query all objc_msgSend xrefs.

iblessing -m generator -i objc-msg-xref-server -f

Specify the Listening Host and Port

The default listening address is 127.0.0.1:2345, you can specify it by -d option.

iblessing -m generator -i objc-msg-xref-server -f WeChat_method-xrefs.iblessing.txt -d 'host=0.0.0.0;port=12345'

Usage Example

Notice: the objc-msg-xref is based on unicorn, to speed up the analyze, we do not follow any calls, so the result is partially missing.

…

Next you can open http://127.0.0.1:2345 with a browser to query any objc_msgSend xrefs you like:

Generate IDA Scripts for objc_msgSend xrefs

You can add objc_msgSend xrefs generated from objc-msg-xref scanner to make your reverse engineering journey more faster and comfortable.

iblessing -m generator -i ida-objc-msg-xref -f

Usage Example

Notice: the objc-msg-xref is based on unicorn, to speed up the analyze, we do not follow any calls, so the result is partially missing.

…

Next open your IDA -> File -> Script File and load the script, this step may take a long time. And when it is done, you can find many xrefs for objc method:

Scan for symbol wrappers

A Mach-O file may contain multiple wrappers of commonly used dynamic library imported symbols, such as:

arm

__text:00000001003842D8 sub_1003842CC                           ; CODE XREF: -[BDARVLynxTracker eventV3:params:adExtraData:]+168↑p
__text:00000001003842D8                                         ; -[BDARVLynxTracker eventV3:params:adExtraData:]+214↑p ...
__text:00000001003842D8                 MOV             X1, X27
__text:00000001003842DC                 MOV             X2, X19
__text:00000001003842E0                 B               objc_msgSend

We can convert the wrapper by usercall:

arm

__text:00000001003842CC ; id __usercall objc_msgSend_61@(id@, const char *@, ...)
__text:00000001003842CC _objc_msgSend_61                        ; CODE XREF: -[BDARVLynxTracker eventV3:params:adExtraData:]+2CC↑p
__text:00000001003842CC                                         ; -[BDARVLynxTracker eventV3:params:adExtraData:]+320↑p ...
__text:00000001003842CC                 MOV             X0, X23
__text:00000001003842D0                 MOV             X1, X28
__text:00000001003842D4                 B               objc_msgSend

The scanner can generate a report to record all wrappers, then you can use ida-symbol-wrapper-naming generator to generate ida scripts and implement this wrapper rename and prototype change.

How to Use

iblessing -m scan -i symbol-wrapper -f  -d 'symbols=_objc_msgSend,_objc_retain,_objc_release'
iblessing -m scan -i symbol-wrapper -f  -d 'symbols=*'

Usage Example

We will take TikTok China as an example:

…

Next, we can generate ida scripts from this report.

Genereate IDA Script for Objc Runtime Function Rename and Prototype Modification

iblessing -m generator -i ida-symbol-wrapper-naming -f

Usage Example

…

Next open your IDA -> File -> Script File and load the script, this step may take a long time. And when it is done, You can observe some decompiled code changes:

:arrow_down: :arrow_down: :arrow_down:

To be continued

Issues· 0 open

View all issues Open on GitHub

No open issues yet, or sync has not completed.

> Tags

C++exploitiosreverse-engineeringscanner

No comments yet. Be the first to share.

> Details

PublishedAug 1, 2026

UpdatedSep 17, 2026

Category编程语言

PricingOpen source

> Related tools

TypeScript

JavaScript 的超集，为前端与全栈提供静态类型

Python

通用编程语言，广泛用于 Web、数据与 AI

Google 推出的简洁高效系统语言

iblessing

About

iblessing

Features

Support

Changelog

Get started

How to Use

All in One Binary

Shell Program + Dylib

Develop Your Own Tools based on iblessing Framework

How to Build

CMake

Shortcuts

Documentation & Help

Preview

Basic Concepts

Scanner

Generator

Basic Usage

Scan for AppInfos

Scan for Class XREFs

Scan for All objc_msgSend XREFs

Simple Mode

Anti-Wrapper Mode

Usage Example:

Generate objc_msgSend Xrefs Query Server

Specify the Listening Host and Port

Usage Example

Generate IDA Scripts for objc_msgSend xrefs

Usage Example

Scan for symbol wrappers

How to Use

Usage Example

Genereate IDA Script for Objc Runtime Function Rename and Prototype Modification

Usage Example

To be continued

Issues· 0 open

> Tags

> Discussion

> Details

> Related tools