mirror of
https://github.com/qtmleap/revkit.git
synced 2026-09-14 07:11:50 +02:00
198835d3699d5d8cdffd19c45626d06b61103c0c
Adds logic to save data, key, and signature blobs to temporary files when HMAC is invoked with inputs larger than 1KB. Facilitates debugging and inspection of large authentication payloads, such as app boot requests.
revkit
A reverse-engineering toolkit for iOS and Android applications.
- iOS Tweak Development — Build and deploy Substrate tweaks via Theos/Orion (arm64, rootless)
- Frida Hooks — Runtime analysis and dynamic instrumentation for iOS / Android apps
- mitmproxy — Programmable HTTPS traffic capture and protocol decoding
- Binary Analysis — Static analysis of APK / IPA binaries with Ghidra, radare2, jadx, ipsw
Repository Structure
.
├── packages/
│ ├── frida/ # Frida hook scripts (TypeScript → JS)
│ │ └── src/
│ │ ├── ios/ # iOS hooks (ObjC/C++)
│ │ ├── android/ # Android hooks (Java/JNI)
│ │ └── common/ # Shared utilities
│ ├── mitmproxy/ # mitmproxy addons
│ └── tweak/ # iOS Tweaks (Theos/Orion)
│
├── tools/ # Python utilities
│ ├── run.py # Frida hook runner
│ ├── transformers/ # Log transformers (Frida → unified format)
│ └── ...
│
├── handlers/ # Objection handlers (CommonCrypto, Security, etc.)
├── docs/ # Analysis results & specifications
├── assets/ # IPA/APK binaries (.gitignore)
├── raws/ # Raw Frida capture logs (.gitignore)
└── logs/ # Transformed logs (.gitignore)
Development Environment
Everything is pre-configured in a DevContainer. Run Rebuild Container to get all tools ready.
Runtimes
| Tool | Purpose |
|---|---|
| Python 3.12 (uv) | Utilities, log transformation, analysis scripts |
| Node.js 25.x | Frida script build (frida-compile) |
| Bun | Chrome extension build |
| Frida 17.x | Dynamic instrumentation |
| mitmproxy | Programmable HTTPS proxy |
Reverse Engineering Tools
| Tool | Purpose |
|---|---|
| radare2 | ARM64 disassembly & binary analysis |
| Ghidra (headless) | Pseudocode generation & function analysis |
| jadx | Android APK → Java decompilation |
| apktool | Android APK resource extraction & smali |
| ipsw | iOS Mach-O analysis, ObjC/Swift class dump |
| lief (Python) | Mach-O/ELF binary parser |
| capstone (Python) | ARM64 disassembler |
| unicorn (Python) | CPU emulation |
| pywidevine (Python) | Widevine DRM analysis |
iOS Tweak Development
| Tool | Purpose |
|---|---|
| Theos | Tweak build system |
| Orion | Swift tweak framework |
| Swift 5.8 (cross-compile) | Cross-compilation for iOS |
| iOS SDK 15.6 / 16.5 | Build targets |
macOS Host Setup
The DevContainer runs inside Docker Desktop's Linux VM and cannot communicate with iOS devices directly. Use iproxy over USB to avoid issues with Wi-Fi IP changes or network instability.
1. Install iproxy (macOS)
brew install libimobiledevice
2. Start iproxy (macOS)
With the iPhone connected via USB:
iproxy 2222 22 &
iproxy 27042 27042 &
2222 → 22: SSH27042 → 27042: Frida
Connection Diagram
| Purpose | Direction | Route |
|---|---|---|
| SSH | Container → Device | ssh iPhone → host.docker.internal:2222 → iproxy (USB) → device:22 |
| Frida | Container → Device | frida -H host.docker.internal → iproxy (USB) → device:27042 |
| mitmproxy | Device → Container | Set device Wi-Fi proxy to macOS LAN IP:9080 |
Usage
Frida Hooks
# iOS (spawn via objection)
uv run python tools/run.py packages/frida/<script>.js
# Android (spawn mode)
uv run python tools/run.py --android packages/frida/<script>.js
Set device hosts in .env (use host.docker.internal when going through iproxy):
IOS_HOST=host.docker.internal
ANDROID_HOST=192.168.x.x
mitmproxy
Device Setup
- Set the device's Wi-Fi proxy to the macOS LAN IP, port
9080 - Open
http://mitm.iton the device and install the CA certificate- iOS: Settings → General → VPN & Device Management → install mitmproxy → Settings → General → About → Certificate Trust Settings → enable
Launch
uv run mitmdump --listen-port 9080 --set block_global=false \
-s packages/mitmproxy/<addon>.py
Addons are located in packages/mitmproxy/.
iOS Tweaks (Theos)
# Build
make -C packages/tweak/<tweak>
# Package (.deb)
make -C packages/tweak/<tweak> package
# Install to device
make -C packages/tweak/<tweak> package install THEOS_DEVICE_IP=<device-ip>
Binary Analysis
# iOS: ObjC/Swift class dump
ipsw macho info <binary> --class-dump
# Android: APK decompilation
jadx -d /tmp/out <apk>
# Ghidra headless analysis
analyzeHeadless /tmp/project name -import <binary>
Claude Code Skills
Project-specific slash commands available inside Claude Code.
| Command | Description |
|---|---|
/compose |
Assemble an Agent Team as leader and run the plan → approve → execute workflow |
Agents
Specialized agents invoked by /compose.
| Agent | Responsibility |
|---|---|
tweak-engineer |
iOS Tweak development (Orion/Theos, ElleKit C hooks) |
frida-engineer |
Frida hook scripts, runtime analysis |
mitmproxy-engineer |
mitmproxy addons, traffic capture |
python-engineer |
Python utilities, decoders, data processing |
log-monitor |
Frida/mitmproxy/Tweak log monitoring & reporting |
Languages
Python
50.2%
TypeScript
30.1%
JavaScript
11.9%
Objective-C
6.6%
Dockerfile
0.5%
Other
0.5%