> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/ios-appsec/static-analysis.md).

# Static Analysis

Static analysis = examining the app package and its files *without running it*. You’ll inspect metadata, binaries, resources (plists, strings, images), embedded frameworks, and provisioning to find hardcoded secrets, insecure configuration, use of private APIs, weak crypto, insecure network endpoints, improper entitlements, and other issues.

***

## Useful tools (install on macOS / Linux)

* Basic CLI: `unzip`, `plutil`, `otool`, `plistutil`
* Reverse engineering: Ghidra (free), [Hopper](https://www.hopperapp.com/download.html), IDA Pro, Binary Ninja, radare2
* Objective-C header extraction: `class-dump`, `class-dump-z`
* Automated: MobSF (Mobile Security Framework)
* Swift symbol helpers: `swift-demangle`, `swiftfilt`
* Plist viewers: Xcode / PlistBuddy

***