Skip to main content

Cocoa / Cocoa Touch Layer

Cocoa Touch is the topmost layer of iOS: the frameworks your app code actually touches. It provides UI, app structure, and system integrations. When you reverse engineer an app, most of what you look at lives here, the entry points, the view controllers, and the lifecycle callbacks.

UIKit​

  • The classic UI framework (UIViewController, UIView, UIButton, UITableView).
  • Handles touch events, the responder chain, and standard system interactions (keyboard, alerts).
  • Almost all older apps and many current apps are UIKit-based.

SwiftUI​

  • The modern declarative UI framework. Instead of view controllers, you describe views with structs and let the system manage state and updates.
  • Still sits on top of UIKit under the hood in many cases, but the code you reverse is much more compact and structured differently (App structs, @State, @Environment, body).
  • Recognition tips: @main struct XxxApp, ScenePhase, and .sheet/.navigationStack modifiers are SwiftUI signatures.

EventKit​

  • Access to calendars and reminders (authorized through privacy prompts / TCC).
  • A privacy-sensitive resource: apps request NSCalendarsUsageDescription / NSRemindersUsageDescription. Over-permissioned calendar access is a common finding.

MapKit​

  • Map display and location-based services.
  • Uses CoreLocation for position data; location permission and background-location misuse are standard checklist items.

The App Lifecycle​

UIApplicationDelegate​

The classic entry point. AppDelegate receives lifecycle and system events:

  • application(_:didFinishLaunchingWithOptions:): app launched; a natural place to hook during dynamic analysis.
  • applicationDidEnterBackground / applicationWillTerminate: app moves to background or is killed.

Scene lifecycle​

On modern iOS (13+), apps use scenes (UISceneSession, UIWindowScene), supporting multiple windows on iPad and the slide-over behavior on iPhone:

  • scene(_:willConnectTo:): scene becomes active.
  • sceneDidBecomeActive / sceneDidEnterBackground: active vs. background state.

What this means for testing​

  • Hook didFinishLaunchingWithOptions and the scene callbacks in Frida to intercept setup logic and injected data (deep link payloads, user info dictionaries).
  • Data often leaks in applicationDidEnterBackground / snapshot code paths (background snapshots of sensitive screens are a known issue; see UIApplication.shouldTakeSnapshotWithCompletionHandler).
  • Deep-link and notification payloads arrive at these lifecycle entry points, so they are the natural place to begin when testing URL-scheme and push-notification handling.

Pentest relevance​

  • Framework signature detection (UIKit vs. SwiftUI) shapes how you approach static analysis.
  • Lifecycle callbacks are the seams where untrusted data enters; prioritize them in dynamic testing.
  • Check UI-permission usage and background behavior for over-permission and data exposure (keyboard caching, background snapshots, screen recording protection).