on ios binary protections
ID: 127304f5-8181-5b4c-a6d3-efd95eaf7b5e
STIX ID: report--127304f5-8181-5b4c-a6d3-efd95eaf7b5e
Feed Name: SensePost Blog
This article explains how to enumerate and interpret iOS binary protection mechanisms—Position Independent Executable (PIE), Automatic Reference Counting (ARC), and stack canaries—using objection (Frida), the Node.js macho parser, and tools like radare2/checksec. It clarifies detection heuristics (e.g., PIE via Mach-O flags, ARC inferred by objc_release import, canaries via __stack_chk_fail), highlights applicability nuances across executables vs libraries and Objective-C vs Swift code, and notes pitfalls (false positives/negatives, Swift canary detection). It concludes with practical guidance for enabling protections in build settings (e.g., -fPIC, ARC settings, -fstack-protector-all) and emphasizes checking all app frameworks.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
