MachLift documentation
MachLift is a native macOS workspace for static analysis of authorized Apple application binaries. The current application workflow begins with an IPA: inspect the package, select an executable, explore its ARM64/ARM64e code, and inspect supported approximate recovery.
MachLift is in active development. Version 0.1.0 is available as a macOS download. This knowledge base describes the implemented workflow and its boundaries; approximate recovery remains limited to the supported cases.
Find your starting point
Section titled “Find your starting point”| Branch | What you will find |
|---|---|
| Getting started | Host requirements, input selection, and availability |
| Guides | The workflow from IPA inventory to function exploration |
| Concepts | Evidence, inferred facts, and honest interpretation |
| Reference | Current capabilities and limitations |
| Troubleshooting | Encrypted inputs, malformed files, and unsupported output |
Read the results in context
Section titled “Read the results in context”Disassembly describes machine instructions. Recovered declarations and pseudocode add interpretation within their supported scope. Neither approximate recovery nor analysis convergence proves that all original functions, types, or indirect destinations have been recovered.
Start with requirements and availability, or inspect the ASM and pseudocode demo with real application captures and selectable code. Return to the product overview for the presentation.