📄️ iOS Architecture - Introduction
iOS runs exclusively on Apple's own silicon. Understanding the hardware is not optional for a pentester, nearly every privilege boundary, from the app sandbox to the Secure Enclave, is enforced at the silicon level. A jailbreak, at its core, is an attack that subverts the chain of trust baked into this hardware.
📄️ Core OS Layer
The Core OS layer is the lowest software layer above the hardware. It provides the kernel, drivers, and the fundamental system services that everything else runs on top of. For a pentester this is where sandboxing, codesigning enforcement, and system call filtering actually live.
📄️ Core Services Layer
The Core Services layer sits above Core OS and below the media and UI layers. It provides the foundation frameworks that every app links against, regardless of what it looks like. This is where most app data is created, stored, and transmitted, so for a pentester, this layer is where the juicy bits usually live.
📄️ Media Layer
The Media layer provides the audio, video, graphics, and animation frameworks that apps use to render content. It is also one of the most interesting attack surfaces on iOS, because media data is complex, attacker-controlled, and historically under-hardened: parsing untrusted media files has produced a long line of kernel and userland bugs.
📄️ Cocoa / Cocoa Touch Layer
Cocoa Touch is the topmost layer of iOS: the frameworks your app code actually touches. It provides UI, app structure, and system integrations. When you reverse engineer an app, most of what you look at lives here, the entry points, the view controllers, and the lifecycle callbacks.
📄️ iOS Security Features
These are the platform mechanisms that define what you can and cannot do as a tester. Knowing them tells you what the app should be protected by, and therefore where the weaknesses actually are.
📄️ Application Structure
Every iOS app is a directory bundle. Understanding the bundle layout, the IPA format, and the code signature is the first step in static analysis.
📄️ Inter-Process Communication
Apps on iOS do not share a filesystem, but they still talk to each other and to the system. The mechanisms they use are the seams where cross-app attacks happen. Insecure IPC is a first-class bug class on iOS.
📄️ Application Publishing
How an iOS app gets onto a device shapes what you can do with it as a tester, and explains a lot about iOS malware distribution. Everything hinges on certificates and provisioning profiles.