iOS application security hardening

Instructions

Before using mPaaS for security hardening, please read the following instructions and ensure that your project meets the relevant requirements; otherwise, hardening may fail or the hardening effect may be compromised.

• Please write the code in C or C++. The iOS hardening feature offers better and more stable support for C and C++, and also partially supports Objective-C, but does not support Swift.

• Hardening can lead to performance degradation and theoretically increased stability risks. It is recommended to harden only the core code that needs protection, extract the C and C++ code that needs protection into a separate framework, and then harden it. Hardening the entire source code of the App is not supported.

• The tool supports X86 and M1 machines. You can view an overview of your Mac, including processor information, by selecting About this Mac from the Apple menu in the corner of the screen. If it shows an Intel processor, it means your Mac uses the x86 architecture.

• Currently, Xcode 14.1/14.2/15.0.1/15.3/15.4 are supported. Because iOS hardening involves compiler modifications, specific Xcode versions need to be adapted. Therefore, using iOS hardening requires a specific version of Xcode.

  Important

  Starting April 29, 2024, Apps uploaded to App Store Connect must be built with Xcode 15 for iOS 17, iPadOS 17, Apple tvOS 17, or watchOS 10.

• Please ensure that the workspace for your App project is set to New Build System. The path to check this is Xcode > File > Project Settings > Build System.

Procedure

1. Configure the environment file. Generate the MSAConfig.json file using the following method and place it in the $HOME directory. On your Mac, open the command prompt and type echo $HOME to get the $HOME directory. Replace the $HOME directory with your actual value when using it. The fields are as follows:

   {
       "appId": "Your app's appId",
       "workspaceId": "Your app's workspaceId",
       "tenantId": "Your app's tenantId",
       "accessKeyId": "Your Alibaba Cloud account's AccessKey ID",
       "accessKeySecret": "Your Alibaba Cloud account's AccessKey secret",
       "license": "Leave this empty for now",
       "domain":"xxx"
   }

   Note

   • Set domain to cn-hangzhou.

   • Obtain the other field values from How to obtain iOS hardening configuration file information.

2. Install the hardening tool.

   1. Download and unzip the hardening tool, and then navigate to the tools > xcode directory.

      Note

      • xcodeplugin-arm64-5.10.0.zip: For Xcode 15.3/15.4 and Mac M1.

      • xcodeplugin-x86_64-5.9.0.zip: For Xcode 15.0.1 and Mac X86.

      • xcodeplugin-arm64-5.9.0.zip: For Xcode 15.0.1 and Mac M1.

      • xcodeplugin-x86_64-5.7.2: For Xcode 14.1/14.2 and Mac X86. The recommended OS is 13.2.1.

      • xcodeplugin-arm64-5.7.2: For Xcode 14.1/14.2 and Mac M1. The recommended OS is 13.2.1.

      

   2. Open the insertdylib file and click Open in the confirmation dialog.

      

   3. Run the following command.

      sh ./tools/xcode/install.sh

      Note

      This command replaces the compiler in /Applications/Xcode.app/. To restore the original, run sh ./tools/xcode/uninstall.sh.

3. Open the Framework or IPA project in Xcode and run the Build/Archive command. Dynamic libraries are not supported.

   Important

   The project path must not contain spaces or Chinese characters, as this causes compilation errors.

4. After hardening completes, run the following command to verify. Successful hardening produces output.

   nm ./BinaryPath | grep obfuscator

Next step