skills.rest
MDSIXONE
MDSIXONECOMMUNITY
Explore all skills by this author →
GitHub

competition-ios-runtime

Hook iOS runtime boundaries to trace signers, Keychain access, and replay accepted requests.

Updated Aug 14, 2026
Search Tags:#ios#ctf#reverse engineering#frida#keychain#ssl pinning#runtime hooking
One-click install
npx skills add https://github.com/MDSIXONE/opencode-config --skill competition-ios-runtime-mdsixone
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: competition-ios-runtime
Source: https://github.com/MDSIXONE/opencode-config/tree/main/skills/reverse-skill/CTF-Sandbox-Orchestrator/competition-ios-runtime
Command: npx skills add https://github.com/MDSIXONE/opencode-config --skill competition-ios-runtime-mdsixone

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Analyzing iOS apps in CTF sandbox environments requires correlating static bundle evidence with live runtime behavior, and ad-hoc Frida hooking often misses the real trust boundary such as request signers or Keychain accessors. ## Core Features & Use Cases - Static iOS Triage: Maps Info.plist, entitlements, URL schemes, embedded frameworks, Keychain usage, and local storage before any hooking. - Targeted Runtime Hooking: Hooks request builders, crypto helpers, trust evaluators, Keychain reads, and Objective-C or Swift methods instead of broad UI handlers, including SSL pinning bypass. - Request Replay: Rebuilds the smallest stateful sequence of token, device identifier, body, signature, and headers to reproduce the accepted request. - Use Case: During a CTF mobile challenge, use this skill after the sandbox orchestrator is active to hook an IPA's signing routine, capture the plaintext and signed headers, and replay the accepted request to recover the flag path. ## Quick Start Ask the agent to inspect this IPA, trace its iOS signer and Keychain logic, bypass the pinning checks, and replay the accepted request path.

Frequently Asked Questions about competition-ios-runtime

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I hook an IPA's request signing logic with Frida?▼

Identify the request builder or crypto helper through static triage of the bundle, then hook that narrow boundary to record plaintext inputs, nonces, and signed headers. Avoid hooking broad UI handlers, which usually miss the real signer.

How to bypass SSL pinning on iOS for traffic analysis?▼

Patch or bypass the trust evaluator or pinning decision point only enough to expose the real request path. The goal is to observe the genuine signed request, not to alter app behavior beyond the trust check.

Can this skill inspect iOS Keychain and local app storage?▼

Yes, it maps Keychain access groups, app groups, plist files, SQLite databases, and cache directories during static triage, then hooks Keychain read or write boundaries at runtime to capture tokens and device-binding state.

When should I use this skill instead of static IPA analysis?▼

Use it when the decisive path runs through live trust boundaries such as signers, trust evaluators, or Keychain accessors rather than static strings or plist values. It also requires the ctf-sandbox-orchestrator to be active first.

Why does my captured signed request fail when replayed?▼

Replays fail when the captured request lacks the plaintext or local state that generated it, such as Keychain items, nonces, or device flags. Keep hook logs, storage artifacts, and session state tied together before replaying.

Related Skills

Explore More Software Engineering Skills→
chengzongcaichengzongcai
21

competition-agent-cloud

Trace prompt-to-tool flows, deployment drift, and artifact provenance in CTF sandbox challenges.

Community
Intermediate
shuvonsecshuvonsec
4.7k

client-reverse

Reverse client-side request signing to replay and fuzz protected APIs.

Community
Advanced
chengzongcaichengzongcai
21

competition-ios-runtime

Hook IPA runtime boundaries to trace iOS signers, Keychain access, and request trust paths.

Community
Advanced
chengzongcaichengzongcai
21

competition-bundle-sourcemap-recovery

Reconstructs runtime structure from served bundles, source maps, and chunk manifests.

Community
Intermediate