competition-ios-runtime

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Chinese

Use this skill only as a downstream specialization after

$ctf-sandbox-orchestrator

is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to

$ctf-sandbox-orchestrator

first.

Use this skill when the decisive path runs through live iOS trust boundaries rather than static strings or plist values alone.

Reply in Simplified Chinese unless the user explicitly requests English.

仅可在

$ctf-sandbox-orchestrator

已激活并建立沙箱假设、节点归属和证据优先级后，作为下游专项技能使用本工具。如果还未完成上述前置步骤，请先返回

$ctf-sandbox-orchestrator

执行相关操作。

当问题的解决路径需要突破iOS实时信任边界，而不是仅依靠静态字符串或plist值分析时，使用本技能。

除非用户明确要求英文回复，否则请使用简体中文回复。

Preserve the original IPA, extracted bundle, and any decrypted or re-signed copy as separate artifacts.
Start with
```
Info.plist
```
, entitlements, URL schemes, frameworks, Keychain usage, and local app storage before broad runtime hooks.
Choose the narrowest runtime boundary that proves behavior: signer, trust evaluator, Keychain accessor, Objective-C or Swift method, or network request builder.
Correlate static bundle evidence and live hook output before claiming the trust path is understood.
Reproduce the accepted request, token, or gated branch from the smallest hook set.

将原始IPA、解压后的应用包、所有解密或重签名的副本作为独立产物保存。
在执行大范围的运行时hook之前，先分析
```
Info.plist
```
、权限配置、URL schemes、依赖框架、Keychain使用情况和本地应用存储。
选择能够验证行为的最小范围运行时边界：签名器、信任评估器、Keychain访问器、Objective-C或Swift方法、或者网络请求构造器。
在确认信任路径已理清之前，需关联静态应用包证据和实时hook输出交叉验证。
用最少的hook集合复现可通过验证的请求、令牌或者受限制的分支逻辑。

Map bundle structure,
```
Info.plist
```
, entitlements, URL schemes, universal links, embedded frameworks, and app group paths.
Record likely trust boundaries: request signers, device binding, certificate checks, jailbreak checks, Keychain access, or local cache loading.
Note whether sensitive logic sits in Objective-C, Swift, embedded frameworks, or a bundled web surface.

Prefer hooking request builders, crypto helpers, trust evaluators, Keychain reads, or Objective-C selectors instead of broad UI handlers.
Record plaintext inputs, headers, nonces, signed strings, and outputs at the boundary that changes server acceptance.
Patch or bypass pinning or environment checks only enough to expose the real request path.

Rebuild the smallest stateful sequence: local token, device identifier, request body, signature, headers, and trust checks.
Keep hook logs, bundle paths, plist keys, and local storage artifacts tied to the same session or account state.
If the task becomes mostly about transform recovery instead of iOS runtime, switch back to the broader crypto or mobile skill.

Load
```
references/ios-runtime.md
```
for hook targets, storage checklist, and evidence packaging.

Bundle paths, entitlements, plist keys, selectors, class names, hook points, and header names
Keychain items, local DB or plist paths, URL schemes, and app-group storage locations
The smallest replayable request or branch that proves the iOS trust boundary