iCDump

iCDump is a modern and cross-platform Objective-C class dump. Compared to existing tools, iCDump can run independently from the Apple ecosystem and it exposes Python bindings.

It relies on LIEF to access the Objective-C metadata and LLVM to output the results.

Swift support is on-going but not public yet.

Python API

iCDump exposes a Python API through nanobind. One can dump Objective-C metadata as follows:

import icdump
metadata = icdump.objc.parse("./RNCryptor.bin")

print(metadata.to_decl())

@interface RNCryptor.RNCryptor.Encryptor{
    NSObject * encryptor;
}
@end
@interface RNCryptor.RNCryptor.Decryptor{
    NSObject * decryptors;
    NSObject * buffer;
    NSObject * decryptor;
    NSObject * password;
}
@end
...

Or inspect Objective-C structures using the different properties:

for cls in metadata.classes:
    print(cls.demangled_name)
    for prop in cls.properties:
        print(prop.name)

Contact

• Romain Thomas: @rh0main - [email protected]

Credits

• LLVM
• rellic by Trail of Bits
• DerekSelander/dsdump

License

iCDump is released under the Apache License, Version 2.0