BATClassDumper: On-Device iOS Objective-C Class & Method Explorer
Cydia/Sileo mobile substrate tweak that dynamically reflects, filters, and dumps Objective-C classes and methods inside any active iOS application process.
Objective C’s highly dynamic runtime environment is one of the most powerful aspects of iOS app security testing and reverse engineering. Traditional class dumping tools like class dump or dsdump operate statically on decrypted binaries, but they fall short when dealing with dynamically loaded libraries (dlopen), runtime created classes, or obfuscated symbols.
To solve this on device, I created BATClassDumper, a MobileSubstrate injection tweak that hooks into any target iOS application, reflects its entire active Objective C heap and runtime library map, and presents class and method hierarchies inside a sleek, search filterable dynamic sheet overlay.
How the Tweak Works
Rather than analyzing the binary statically on a computer, BATClassDumper operates entirely in memory at the runtime level. When the target application is launched, the jailbreak substrate injects our dynamic library (.dylib) into the application's memory space.
Our runtime engine queries the Objective C runtime system libraries directly, dynamically loading class tables, resolving method selectors, and piping the results to a responsive bottom sheet interface over
Architectural & Injection Flow Diagram
Below is the execution flow from the kernel memory layout up to the live interactive user interface:
+-------------------------------------------------------+
| USER INTERFACE SHEET |
| (Search Sheet & Substring Filter) |
+-------------------------------------------------------+
|
v
+-------------------------------------------------------+
| RUNTIME UTILITY ENGINE |
| (Dynamic Exploration Core) |
+-------------------------------------------------------+
/ \
v v
+---------------------------+ +-------------------------+
| OBJECTIVE-C RUNTIME APIs | | DYNAMIC LINKER SUBSYSTEM|
| (Reflection Mapping) | | (Library Handle Core) |
+---------------------------+ +-------------------------+
\ /
v v
+-------------------------------------------------------+
| TARGET APPLICATION PROCESS |
| (Active Heap / Virtual Memory Address) |
+-------------------------------------------------------+
^
|
+-------------------------------------------------------+
| INJECTION INTERFACE |
| (Substrate / Hooking Layer) |
+-------------------------------------------------------+
|
v
+-------------------------------------------------------+
| iOS KERNEL LEVEL |
| (XNU Core & Memory Management) |
+-------------------------------------------------------+
Tweak Installation
Getting BATClassDumper up and running on your jailbroken iOS device is straightforward.
Add the source repository:
https://Basilabt.github.io/repo/
Navigate inside the repository:
Install the package and restart springboard:
Make sure the tweak is enabled in Settings:
Launch any application to open the exploration sheet:
