5

I have a reverse engineering set up on a Mac machine. This set up does some reverse engineering on iOS applications(.ipa files). I'm migrating the setup from Mac to a linux machine.

Currently on Mac, I'm using OTOOL on ipa binary files and using the following commands:

  1. otool -L /iOS/binary/path
  2. otool -lv /iOS/binary/path
  3. otool -hv /iOS/binary/path

Now, I've to do the same operation, i.e reverse engineer the iOS applications, but now on the linux machine. AFAIK, OTOOL is not available for linux machine.

  1. I've come across JTOOL which I think is most relevant till now. I can use it on linux, and it does something similar to OTOOL, but not exactly same. E.g. while using the -L command on JTOOL, I also need to specify architecture. However, OTOOL gives the shared libraries for all the available architectures.
  2. I tried ldd, but I'm getting the error - "not a dynamic executable".
  3. I tried objdump, but it asks for the object file.

I'm not sure which tool can I use. I to figure out the alternate tool which can do same as OTOOL. Or, if not same, then what changes do i need to make to use the alternate tool.

3
  • ldd should work. what is the output of file on the executable you tried ? Otherwise use nm / objdump. gitlab.kitware.com/cmake/community/wikis/doc/cmake/…
    – tibar
    Feb 12 '19 at 13:29
  • @tibar You think this will work for iOS executable binaries on linux? As otools for iOS binaries on Mac? Feb 13 '19 at 6:57
  • jtool lets you specify the arch with -arch. On my machine, testing with a fat binary gives different libs depending on the arch I specify.
    – Bill B
    Feb 25 '19 at 16:28
1

If you have stripped binaries there's little you can do regardless of the platform you're on.

To view disassembled code on Linux, as you would with Otool on Mac, you can use objDump:

objdump --disassemble-all thebinary
1

I am in a similar position carrying out iOS related work on an Ubuntu host.

The suggestions to use objdump will not work unless it has been compiled specifically with support of Mach-O binaries which is not normally the case on Linux.

jtool2 has by far been found to be the best Linux based equivalent for me and the commands you have listed should be avaialble as is as those flags are listed under OTool Compatible Options. Is it just that you do not want to have to pass the arch as an argument?

A number of tools are available from llvm on Linux and their page does list an otool equivalent. That doesn't seem to be installed on my OS although a number of other llvm tools are such as llvm-nm and llvm-objdump that both support Mach-O binaries.

If you prefer a visual representation you could try XMachOViewer or if you are happy to script something yourself specific to your particular needs you could look at the Python lief library.

2
  • Not having enough reputation is not an excuse for using the answer as a comment. It would be better to omit this sentence from your answer.
    – MarianD
    Sep 28 at 9:54
  • Thank you for the clarification. I have edited my response now, what started out as intending to be only a comment evolved in to an answer anyway as I read more.
    – Jon
    Sep 28 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.