Reverse engineering can be do on any sofware or application. Attacker can modify your source code to crack the license, inject malicious code, clone the apps and more. But if you are an iOS apps developer you can protect you’re iOS apps with Swift. This tool will protect the apps against reverse engineering attack.
SwiftShield is a tool that generates irreversible, encrypted names for your iOS project’s objects (including your Pods and Storyboards) in order to protect your app from tools that reverse engineer iOS apps, like class-dump and Cycript.
Automatic mode (Swift only)
-automatic tag, SwiftShield will use SourceKit to automatically obfuscate entire projects (including dependencies). Note that the scope of SwiftShield’s automatic mode is directly related to the scope of Xcode’s native refactoring tool, which doesn’t refactor everything yet. While the specific cases on the document won’t be obfuscated, SwiftShield will obfuscate all Swift classes and methods that can be reverse-engineered. Take a look at the Example project to see SwiftShield in action!
Manual mode (Swift/OBJ-C)
If you feel like obfuscating absolutely everything – including typealiases and internal property names, you can also use Manual mode. This is the easiest way of running SwiftShield, but also the most time consuming. When used, SwiftShield will obfuscate properties and classes based on a tag of your choice at the end of it’s name. For example, after running SwiftShield in manual mode and a tag
__s, the following code:
Deobfuscating encrypted Crash logs
After succesfully encrypting your project, SwiftShield will generate an output folder containing a
conversionMap.txt file containing with all the changes it made to your project. allowing you to pinpoint what an encrypted object really is.
You can use this file to automatically deobfuscate any kind of text-based crash file by running:
Note: Xcode 11 changed how arguments are passed to the compiler, so this tool might not work correctly outside of the legacy build mode.
If one or more modules/extensions of your app fail to satify these conditions, you can avoid obfuscating them with the
- No logic based on class/property names, like loading
- No Objective-C classes that call Swift methods (Swift classes that call Objective-C methods are fine, except when interfacing is involved)
- Latest Swift version and Xcode command line tools (works on all versions, but might have different results due to different SourceKit versions)
- Make sure your project doesn’t contain one of SourceKit’s bugs. Although the bugs won’t prevent the project from being obfuscated, some of them might require some manual fixing afterwards.
(App Extensions that use
NSExtensionPrincipalClass or variants in their
Info.plist (like Rich Notifications/Watch apps) will have such references obfuscated as well, but will assume that you haven’t changed them from their default
$(PRODUCT_MODULE_NAME).ClassName value. If you modified these plists to point to classes in different modules, you’ll have to manually change them after running this tool.)
Make sure your tags aren’t used on things that are not supposed to be obfuscated, like hardcoded strings.
Warning: SwiftShield irreversibly overwrites all your source files. Ideally, you should have it run only on your CI server, and on release builds.
-automatic: Enables automatic mode.
-project-root: The root of your project. SwiftShield will use this to search for your project files.
-automatic-project-file: Your app’s main .xcodeproj/.xcworkspace file.
-automatic-project-scheme myScheme: The main scheme to build from your
-ignore-modules: Prevent certain modules from being obfuscated, separated by a comma. Use this if a certain module can’t be properly obfuscated. Note that this should be the exact name of the imported module (not the target name!). Example:
-show-sourcekit-queries: Prints queries sent to SourceKit. Note that they are huge and will absolutely clutter your terminal, so use this only for bug reports and feature development!
-project-root: The root of your project. SwiftShield will use this to search for your project files, storyboards and source files.
-tag: Uses a custom tag. Default is
-verbose: Prints additional information.
-obfuscation-character-count: Set the number of characters that obfuscated names will have. By default, this is
32. Be aware that using a small number will result in slower runs due to the higher possibility of name collisions.
-dry-run: Does not actually overwrite the files. Useful for debugging!