from Hacker News

Malimite – iOS and macOS Decompiler

by tW4r on 1/26/25, 11:22 AM with 36 comments

  • by lauriewired on 1/29/25, 2:36 AM

    Hi everyone, I'm the creator of Malimite. I actually released this as part of a conference talk at Objective By the Sea, which you can see here:

    https://youtu.be/vWdKjVCZtTI

    It gives a good overview of the development process as well as my motivations for creating it. The tool will also be on homebrew shortly :)

  • by adeon on 1/29/25, 1:50 AM

    Starting this year I started learning bunch of security topics and Ghidra is something I started learning. I decompiled some games and getting comfortable how to work a project, teach Ghidra structures etc.

    Am I right in looking at Malimite here and reading "Built on top of Ghidra decompilation to offer direct support for Swift, Objective-C, and Apple resources." that this is not a Ghidra extension but rather it is using a piece of Ghidra (the decompilation) like a backend? Malimite here is presented as its own piece of software.

    Asking as a Ghidra noob who doesn't know all the ways Ghidra can be used: Would it make sense for something like this to be a Ghidra extension instead? I.e. give Ghidra some tooling/plugin to understand iOS apps or their languages better, instead of a new app that just uses parts of Ghidra. Also the Malimite screenshot in the page looks similar to Ghidra CodeBrowser tool.

    Asking because it feels like it could be: from the little I've used Ghidra so far, looks like it is designed to be extendable, scriptable, usable by a team collaborating, etc. And Ghidra seems more holistic than just focusing on decompiling code.

  • by evanjrowley on 1/28/25, 10:40 PM

    LaurieWired's YouTube channel is pretty good. It features many quality deep dives on super nerdy topics. https://www.youtube.com/@lauriewired

  • by saagarjha on 1/28/25, 8:23 PM

    (This is LLM-powered and based on Ghidra, fwiw)

  • by commandersaki on 1/29/25, 1:20 AM

    This is all well and good, but at least for iOS my understanding is you cannot decompile unless you have a jailbroken iPhone or security research device. Makes things a bit difficult.

  • by stuckkeys on 1/30/25, 6:51 AM

    This is nice. What is the approach like to extracting ipa files that are already installed on the devices? Is it doable without jail break?

  • by gondo on 1/29/25, 9:04 AM

    but how can one get IPA file to start with?

  • by anxixddjs on 1/29/25, 1:08 AM

    this is pretty cool wonder how long till apple files a complaint to gh