{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/Soulghost/iblessing/blob/ff14351de3f3c2155e8df47c26d4367523af7628/compile-cmake.command",
    "https://github.com/Soulghost/iblessing/blob/ff14351de3f3c2155e8df47c26d4367523af7628/.gitmodules",
    "https://github.com/Soulghost/iblessing/blob/ff14351de3f3c2155e8df47c26d4367523af7628/iblessing/CMakeLists.txt",
    "https://github.com/Soulghost/iblessing/blob/ff14351de3f3c2155e8df47c26d4367523af7628/.github/workflows/c-cpp.yml",
    "https://github.com/Soulghost/iblessing/blob/ff14351de3f3c2155e8df47c26d4367523af7628/run-test.command",
    "https://github.com/Soulghost/iblessing/blob/ff14351de3f3c2155e8df47c26d4367523af7628/.travis.yml",
    "https://github.com/Soulghost/iblessing/tree/ff14351de3f3c2155e8df47c26d4367523af7628/iblessing/iblessing/tests",
    "https://github.com/Soulghost/iblessing/blob/ff14351de3f3c2155e8df47c26d4367523af7628/LICENSE",
    "https://github.com/Soulghost/iblessing/releases/tag/v1.0.4-beta"
  ],
  "category": "native-analysis",
  "description_en": "Toolkit for analyzing iOS apps and arm64 Mach-O binaries, built on Capstone, Unicorn and Keystone. Its scanners extract app-bundle metadata such as URL schemes and transport-security settings, locate Objective-C class references and NSPredicate uses, detect symbol wrappers, and partially emulate arm64 code with Unicorn to recover objc_msgSend cross-references, including those passed through blocks. Generators turn the reports into IDA Pro scripts that add cross-references and rename wrappers, or into a local query server, and a shared core library with a plug-in interface supports custom tools.",
  "description_zh": "用于分析 iOS 应用和 arm64 Mach-O 二进制的工具集，基于 Capstone、Unicorn 与 Keystone 构建。其扫描器可提取应用包元数据（如 URL Scheme 和传输安全设置），定位 Objective-C 类引用和 NSPredicate 用法，识别符号包装函数，并借助 Unicorn 部分模拟 arm64 代码以恢复 objc_msgSend 交叉引用，包括经由 block 传递的调用。生成器可把扫描报告转成 IDA Pro 脚本，用于添加交叉引用和重命名包装函数，也可启动本地查询服务；共享核心库及插件接口可用于开发自定义工具。",
  "entry_url": "https://awesomerea.org/resources/iblessing/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/iblessing/",
  "evidence_url": "https://github.com/Soulghost/iblessing/blob/ff14351de3f3c2155e8df47c26d4367523af7628/README.md",
  "group": "tools",
  "id": "iblessing",
  "json_url": "https://awesomerea.org/resources/iblessing/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/iblessing/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/iblessing/index.md",
  "name": "iblessing",
  "name_zh": "iblessing iOS 应用与 Mach-O 分析工具集",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v1.0.4-beta, published 2021-11-26 and tagged at the reviewed master commit; every release is marked as a pre-release. Each recent release attaches macOS and Linux command-line and all-in-one binaries, framework archives with the shared core library and headers, and a JSON table of Foundation and UIKit method signatures. The README's feature list leaves Swift class parsing, following branches and calls, and Android scanners unfinished.",
    "Users supply an iOS .app bundle for app-info or an arm64 Mach-O binary for the other scanners; README examples analyze commercial third-party apps after restoring symbols with a separate tool, but no app binaries are committed. The class and objc_msgSend cross-reference scanners accept arm64 binaries only, and app-info is unavailable on Linux because it still depends on Cocoa. The README warns that binary scanners reserve 12 GB of virtual memory per Mach-O file, so physical memory or swap must cover that.",
    "Builds on macOS or Linux with CMake 3.5+ and a C++17 compiler after a recursive clone; compile-cmake.sh first builds the pinned Capstone, Unicorn (arm, aarch64 and x86) and Keystone submodules as static libraries. An Xcode project is also included. IDA Pro is needed only to apply the generated scripts.",
    "GitHub Actions builds on Ubuntu and macOS and, on macOS only, scans the bundled sample-app benchmark and runs the built-in objc_msgSend cross-reference test; Travis CI builds and publishes tagged releases. The README notes that objc-msg-xref follows no calls to save time, so its results are partly missing.",
    "GPL-3.0 (LICENSE). The project calls itself an iOS security exploiting toolkit. Analyzed apps and Apple frameworks keep their own terms, and the Capstone, Unicorn and Keystone submodules carry their own licenses."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v1.0.4-beta，发布于 2021-11-26，标签正对应所审阅的 master 提交；所有版本均标为预发布。近期各版本附带 macOS 与 Linux 的命令行程序和一体化构建、含共享核心库及头文件的框架压缩包，以及一份 Foundation 与 UIKit 方法签名的 JSON 表。README 功能列表中，Swift 类解析、跟随分支与调用以及 Android 扫描器仍未完成。",
    "app-info 扫描器需要使用者提供 iOS .app 应用包，其他扫描器需要 arm64 Mach-O 二进制；README 示例先用另一个工具恢复符号，再分析商业第三方应用，但仓库未提交任何应用二进制。类引用和 objc_msgSend 交叉引用扫描器只接受 arm64 二进制，app-info 仍依赖 Cocoa，因此无法在 Linux 上使用。README 提醒，二进制扫描器加载每个 Mach-O 文件都会预留 12 GB 虚拟内存，物理内存或交换空间须足以容纳。",
    "递归克隆后可在 macOS 或 Linux 上用 CMake 3.5+ 和 C++17 编译器构建；compile-cmake.sh 会先把固定版本的 Capstone、Unicorn（arm、aarch64 和 x86）和 Keystone 子模块编译为静态库。仓库还附带 Xcode 工程。只有应用生成的脚本时才需要 IDA Pro。",
    "GitHub Actions 在 Ubuntu 和 macOS 上构建，并仅在 macOS 上扫描随附的示例应用基准文件、运行内置的 objc_msgSend 交叉引用测试；Travis CI 负责构建并发布带标签的版本。README 说明 objc-msg-xref 为提高速度不跟随任何调用，因此结果会有部分缺失。",
    "采用 GPL-3.0（LICENSE）。项目自称 iOS 安全漏洞利用工具集。被分析的应用和 Apple 框架适用各自条款，Capstone、Unicorn 与 Keystone 子模块也有各自的许可证。"
  ],
  "targets": [
    "app",
    "binary"
  ],
  "url": "https://github.com/Soulghost/iblessing",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}