re-swift

Extract symbols with llvm-nm or readelf -s, filter names starting with $s, and pipe them into swift-demangle. On macOS use xcrun swift-demangle; batch output can be scripted back into Ghidra or IDA to rename functions.

Check for $s, $S, or _T0 mangled symbol prefixes, swift_ runtime imports like swift_retain, and __swift5_* reflection sections. Pure Objective-C binaries lack all of these and should be analyzed through the ObjC path instead.

Yes. Stripping removes the symbol table but not the __swift5_* reflection sections, which are data segments. Protocol conformances, field metadata, and type descriptors can be rebuilt from __swift5_proto, __swift5_fieldmd, and __swift5_typeref.

Mangling schemes evolved across Swift versions ($s for 5+, $S for 4.2, _T0 for 4.0). A demangle tool older than the binary's compiler version cannot decode newer symbols, so use a toolchain from the same or a newer Swift release.

Mangled names can embed symbolic references containing control bytes \x01-\x1f followed by pointer bytes, so they are not clean null-terminated strings. Always extract symbols from the symbol table with llvm-nm or readelf -s instead of strings.

Locate conformance records in the __swift5_proto section or find swift_getWitnessTable call sites. The witness table is an array of implementation addresses whose slot order matches the protocol declaration order.