It gives a good overview of the development process as well as my motivations for creating it. The tool will also be on homebrew shortly :)
Figuring out how an API works is one of the most important RE use cases, at least on Mac OS, where private APIs are still somewhat usable.
running out of phone data in the middle of something important, the worst hahahaha
Am I right in looking at Malimite here and reading "Built on top of Ghidra decompilation to offer direct support for Swift, Objective-C, and Apple resources." that this is not a Ghidra extension but rather it is using a piece of Ghidra (the decompilation) like a backend? Malimite here is presented as its own piece of software.
Asking as a Ghidra noob who doesn't know all the ways Ghidra can be used: Would it make sense for something like this to be a Ghidra extension instead? I.e. give Ghidra some tooling/plugin to understand iOS apps or their languages better, instead of a new app that just uses parts of Ghidra. Also the Malimite screenshot in the page looks similar to Ghidra CodeBrowser tool.
Asking because it feels like it could be: from the little I've used Ghidra so far, looks like it is designed to be extendable, scriptable, usable by a team collaborating, etc. And Ghidra seems more holistic than just focusing on decompiling code.
(JADX is a very popular Android decompiler)
Ghidra is quite limiting, and the workflow makes iOS reverse engineering quite cumbersome.
Malimite is intended to have a swappable back-end, so theoretically compilers other than Ghidra can be used in the future.
I'd be happy to focus on the tool, or the content of the channel, rather than how I sound.
Malimite is first and foremost intended to be a tool to help Reverse Engineer iOS/Mac binaries, much like JADX for Android.
As it turns out, LLMs are quite good at “converting” C-Pseudocode into an approximation of the original Swift or Objective-C code. Therefore, you can optionally use the LLM extension to help analysis.
Of course, it’s not 100% accurate, but significantly easier to read, and I find it to save hours of manual research.
https://github.com/opa334/TrollStore/blob/main/README.md
> It works because of an AMFI/CoreTrust bug where iOS does not correctly verify code signatures of binaries in which there are multiple signers.
> Supported versions: 14.0 beta 2 - 16.6.1, 16.7 RC (20H18), 17.0
This seemed to happen because they didn't have time to release 17 with the bug fixed, which is why 16.7 Final is not supported; per https://x.com/MasterMike88/status/1743974453459956209
