9

I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine.

Currently on Mac, I'm using OTOOL on ipa binary files and using the following commands:

  1. otool -L /iOS/binary/path
  2. otool -lv /iOS/binary/path
  3. otool -hv /iOS/binary/path

Now, I've to do the same operation, i.e reverse engineer the iOS applications, but now on the linux machine. AFAIK, OTOOL is not available for linux machine.

  1. I've come across JTOOL which I think is most relevant till now. I can use it on linux, and it does something similar to OTOOL, but not exactly same. E.g. while using the -L command on JTOOL, I also need to specify architecture. However, OTOOL gives the shared libraries for all the available architectures.
  2. I tried ldd, but I'm getting the error - "not a dynamic executable".
  3. I tried objdump, but it asks for the object file.

I'm not sure which tool can I use. I to figure out the alternate tool which can do same as OTOOL. Or, if not same, then what changes do i need to make to use the alternate tool.

Improve this question
4
  • ldd should work. what is the output of file on the executable you tried ? Otherwise use nm / objdump. gitlab.kitware.com/cmake/community/wikis/doc/cmake/…
    – tibar
    Commented Feb 12, 2019 at 13:29
  • @tibar You think this will work for iOS executable binaries on linux? As otools for iOS binaries on Mac?
    – Rohit saraf
    Commented Feb 13, 2019 at 6:57
  • 1
    jtool lets you specify the arch with -arch. On my machine, testing with a fat binary gives different libs depending on the arch I specify.
    – Bill B
    Commented Feb 25, 2019 at 16:28
  • llvm-13 (and up) contains llvm-otool-13 apt install llvm-13
    – user46528
    Commented Jun 5 at 11:10

2 Answers 2

Reset to default
6

I am in a similar position carrying out iOS related work on an Ubuntu host.

The suggestions to use objdump will not work unless it has been compiled specifically with support of Mach-O binaries which is not normally the case on Linux.

jtool2 has by far been found to be the best Linux based equivalent for me and the commands you have listed should be avaialble as is as those flags are listed under OTool Compatible Options. Is it just that you do not want to have to pass the arch as an argument?

A number of tools are available from llvm on Linux and their page does list an otool equivalent. That doesn't seem to be installed on my OS although a number of other llvm tools are such as llvm-nm and llvm-objdump that both support Mach-O binaries.

If you prefer a visual representation you could try XMachOViewer or if you are happy to script something yourself specific to your particular needs you could look at the Python lief library.

Update

Adding two more options I've used since originally answering as this has recently received upvotes and still seems to be helpful. Both are currently maintained and available for Linux:

ipsw from Blacktop

and

ktool from cynder

Update, September 2024

jtool is no longer supported, let alone for Linux. ipsw is the most actively developed cross-platform option and with new functionality being added.

Improve this answer
4
  • Not having enough reputation is not an excuse for using the answer as a comment. It would be better to omit this sentence from your answer.
    – MarianD
    Commented Sep 28, 2021 at 9:54
  • Thank you for the clarification. I have edited my response now, what started out as intending to be only a comment evolved in to an answer anyway as I read more.
    – Jon
    Commented Sep 28, 2021 at 21:11
  • I found ipsw to be about 5 times faster than ktool when printing symbols. I couldn't find the Linux version (nor the source code) of jtool2 or its successor, disarm.
    – ericek111
    Commented Sep 25 at 11:15
  • The last few releases of jtool2 were *OS only no linux and the source code was never released sadly. I wasn't aware of disarm though, thanks.
    – Jon
    Commented Sep 27 at 13:43
1

If you have stripped binaries there's little you can do regardless of the platform you're on.

To view disassembled code on Linux, as you would with Otool on Mac, you can use objDump:

objdump --disassemble-all thebinary
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.