Playing With the Limits: Can Your App Run Arbitrary Binary
summary
Explains a working experiment that loads dynamic frameworks on iOS using dylib + dlopen, shows how code signing and the Mach‑O loader block frameworks not embedded in the app bundle, and documents a TestFlight rejection and a crash when Xcode is detached. Demonstrates a workaround by shipping a signed framework inside the bundle, explores hooking Swift symbols, and prototypes running WebAssembly via a small interpreter as a JIT‑free hot‑update path with measurable speed tradeoffs and codesign issues and WebAssembly interpreter.
AI-written summary · about
chapters (13)
- 0:00Introduction and talk goals
- 1:12What is side loading
- 8:56Apple review rules and spirit
- 10:12Compiling and linking basics
- 17:27Static vs dynamic libraries
- 26:04Mach-O files and sections
- 32:09Startup time and dependencies
- 36:56Hooking functions in memory
- 45:22Loading arbitrary binary code
- 53:36iOS framework loading limits
- 57:10W^X memory security principle
- 58:38JavaScript and WebAssembly on iOS
- 1:03:23Live demo in production app
related talks
45mMach-O Fun
24mSecurity : protect the body of your app
37mBring me to life; A tale of dyld, and how iOS launches your app
34mHacking Marzipan, Running iOS apps on Mac
40mIntroduction into Reverse Engineering and iOS Security
36mTesting iOS Apps without Jailbreak in 2018
44mRunning Apps on Your Own iOS Simulator
29miOS Runtime Manipulation (PWND)