competition-ios-runtime

What problem does it solve? Analyzing iOS apps in CTF and sandboxed security workflows often stalls because static plist and string inspection cannot reveal how requests are signed, how trust checks gate behavior, or where Keychain state drives accepted server responses. ## Core Features & Use Cases - Static iOS Triage: Maps Info.plist, entitlements, URL schemes, embedded frameworks, Keychain usage, and local storage to locate trust boundaries before hooking. - Runtime Hooking with Frida: Traces Objective-C selectors and Swift methods at request builders, crypto helpers, trust evaluators, and Keychain accessors, with SSL pinning bypass only as needed to expose the real request path. - Accepted-Path Replay: Rebuilds the smallest stateful sequence of token, device identifier, body, signature, and headers that the server accepts. - Use Case: Given a CTF IPA whose login request is rejected when replayed externally, hook the request signer and Keychain read boundary, capture the plaintext and nonce, then reconstruct the accepted signed request. ## Quick Start After the ctf-sandbox-orchestrator is active, ask the agent to inspect the IPA, hook its iOS signer and Keychain logic, bypass pinning, and replay the accepted request.