Explore an IPA

This guide is for readers who already have a MachLift development build. Begin with an IPA you are authorized to inspect.

1. Open the package

Use Open IPA and choose your .ipa file. Inspect the package inventory and any diagnostics before selecting an executable.

A package may contain more than one executable. Analysis is scoped to the selected executable; opening the package does not analyze every member.

2. Analyze the selected executable

Select the executable and use Analyze. Observe the reported progress and completion state. Normal analysis aims to finish the work its enabled passes discover; defensive limits and malformed input can prevent completion.

Analysis convergence is not proof of exhaustive source recovery. Read evidence and uncertainty before treating an inferred fact as established.

3. Explore the machine code

Browse function candidates and the image disassembly. Follow resolved control-flow targets and available import references to inspect related code. An unresolved destination remains a limit of the current evidence.

4. Inspect supported recovery

Inspect recovered Swift declarations where metadata supports them. Request Pseudocode for a selected function to view approximate Swift-like output when the current semantics and structuring support that function.

An unsupported function can still be inspected in disassembly. Generated pseudocode is an analysis aid with assumptions and limitations; it is not the original source. Review the scope reference.

5. Return to the evidence

Use Reveal in Disassembly on mapped pseudocode to examine the underlying instructions. Address mappings connect generated output to code; they do not make an inferred name, type, or calling convention certain.