<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing iOS Dynamic Analysis

## Frida CLI
```bash
frida-ls-devices                          # List devices
frida-ps -Ua                              # List apps on USB device
frida -U -f com.target.app --no-pause     # Spawn and attach
frida -U -f com.target.app -l script.js   # Spawn with script
frida-trace -U -m '*[KeychainHelper *]' com.target.app  # Trace methods
frida-dump -U -f com.target.app           # Dump decrypted binary
```

## Objection iOS Commands
```bash
# Environment
env                                        # App paths and bundle info
ios info binary                            # Binary info

# Keychain
ios keychain dump                          # Dump all keychain items
ios keychain dump --json                   # JSON output
ios keychain clear                         # Clear app keychain items

# Hooking
ios hooking list classes                   # List all loaded classes
ios hooking list class_methods ClassName   # Methods of a class
ios hooking watch method '-[Class method]' --dump-args --dump-return

# SSL
ios sslpinning disable                     # Bypass pinning

# Pasteboard
ios pasteboard monitor                     # Watch clipboard

# Cookies
ios cookies get                            # Dump cookies

# Filesystem
ios plist cat Info.plist                   # Read plist
ios bundles list_frameworks                # List frameworks
```

## iproxy (USB tunneling)
```bash
iproxy 2222 22                            # SSH over USB
iproxy 27042 27042                        # Frida over USB
ssh -p 2222 root@localhost                # Connect via tunnel
```

## LLDB Remote Debug
```bash
debugserver *:1234 --attach=PID           # On device
lldb -o "process connect connect://DEVICE:1234"  # On host
```
