Non-jailbroken iOS, jailbroken iOS and Mac apps. Analyze installed apps, independently rebuild selected behavior, and compare runnable implementations with evidence.
All three routes are on main. The latest tag, v0.2.0, predates standard iPhone mode; use the current checkout.
Join the discussion on Discord
// QUICK START
Choose your target, replace APP NAME and paste the task into Codex or Claude Code. The agent installs the CLI and checks the environment before working on your app.
No provider-specific extension. The agent reads the skills in the source checkout.
A Mac with Xcode, an unlocked USB iPhone with the target App installed, Developer Mode, device trust and development signing.
Standard iPhone setup and evidence ↗ The agent installs and checksPython 3.9+, CLI, exact USB phone/App identity, a development-signed iCTRL XCTest runner and USB installation. Collection needs no original IPA, FairPlay credential, SSH or Frida.
Use https://github.com/everettjf/copyapp to observe and independently rebuild selected behavior of “APP NAME” on my USB-connected non-jailbroken iPhone.
Use the latest main checkout. Read AGENTS.md, skills/copyapp-start/SKILL.md and docs/ios-standard-mode.md first. Prepare the CLI with sh scripts/bootstrap-macos.sh if needed.
Identify the exact USB phone and App. Use --mode standard; check Xcode, Developer Mode, device trust and development signing. Prepare the signed iCTRL XCTest runner and install over USB.
Discover representative UI flows, review screenshots and accessibility evidence, and deliver a reviewed UI behavior report. Standard collection needs no IPA or FairPlay credential. Implement an independent App with its own Bundle ID, sign and install it over USB, then compare the same flows and review every screenshot pair in the current agent session.
Use a unique output/ job with project/ and evidence/. Follow docs/fidelity.md: default grade 80/100, at most three implementation/check cycles including the first. Deliver source, runnable artifacts, verified scope and remaining differences. Keep native function and private sandbox claims outside the UI-only report.Only checking setup? Append: “Stop after a verified standard-mode capability check; list signing or runner setup still needed.”
Output: project/ + evidence/ inside a unique output/ job. Default reviewed grade 80/100, up to three implementation/check cycles. Selected scope and remaining gaps stay explicit.
// 01 — THE WORKFLOW
Go from observed behavior to a reviewed implementation. Each phase leaves inspectable cases behind.
Standard iOS observes UI and accessibility. Jailbroken iOS adds package, sandbox and runtime evidence. macOS collects App-package, AX and UI evidence. Review the corresponding report and specification.
Build a separate iOS or macOS app. Compare the same selected flows, review every screenshot and stop at the reviewed grade target or cycle limit.
A passing screenshot is a data point. A trustworthy rebuild is a chain of observations, decisions, and repeatable checks.
// 02 — SYSTEM DESIGN
Your current coding agent plans and implements. Copy APP records evidence and checks. A named iPhone or ChatComputer virtual Mac supplies observations.
Named device identity, package hashes, bounded actions, screenshots and runtime traces live in local evidence cases.
Standard iOS delivers UI behavior reports. Jailbroken iOS can add Ghidra or Hopper native investigation; Mac uses App-package, AX and UI evidence.
Original and rebuilt flows run separately in the same pinned environment. Deliveries name behavior passes, visible differences and unknowns.
// REVERSE ENGINEERING
Two directly integrated decompilers, plus runtime tracing and bounded assembly. Decompilation is optional; the default provider is none.
Selected-function pseudocode, bounded call relationships, blocks and instruction references.
ghidra-directInstall Ghidra and a matching JDK. Supports function, queue and selected indirect-call investigation.Selected-function pseudocode and candidate queues through the local Python scripting interface.
hopper-directRequires a local Hopper license and a logged-in macOS GUI session. No REA runtime required.Trace named Objective-C methods and selected entries during bounded UI flows.
trace / flow-capture --methodRequires compatible host/device services. A temporal hit alone does not prove UI causality.Bounded assembly windows and unique local direct-call/branch followers with llvm-objdump.
native-disasm / native-queueUses the local Xcode toolchain. Assembly output is separate from decompiler pseudocode.Built-in package & Objective-C indexesInspect Mach-O load commands, classes, selectors and method addresses without a decompiler.
Encrypted-package recoverySupported jailbreak routes recover device code. Mac offline recovery uses a local FairPlay credential matching the IPA account; first retrieval needs a supported jailbroken phone.
Native-function investigation needs matching code and runtime evidence and primarily serves jailbroken iOS. Standard iOS focuses on UI; Mac uses App-package, AX and UI evidence.
REA is not a runtime dependency. IDA Pro, Binary Ninja and radare2 currently have no direct adapters. Pseudocode is generated evidence, not original source.
Tool setup, commands and agent tasks ↗// PLATFORM SUPPORT
Choose by device access and the evidence you need. Continue to independent implementation and flow comparison in each route.
Use signed XCTest, accessibility observations and exact USB screenshots to review behavior, build an independent signed App and compare the same flows. No original IPA, FairPlay credential, SSH or Frida required.
Tested on an inactive-jailbreak iOS 26 sample and an explicit iOS 17 standard regression. A never-jailbroken device has not been separately tested.
Standard setup and agent task ↗Package and sandbox acquisition, UI replay, optional Frida tracing and supported device decryption. Enhanced evidence binds the exact phone, system and App build.
Named phone evidence and limits →Computer use through ChatComputer, exact App and AX evidence, independent .app builds, paired checks and reviewed snapshots in a dedicated virtual Mac.
Owned editor: 9/9 selected comparisons and a named physical-Mac recheck. These results do not establish arbitrary-Mac or whole-App compatibility.
Mac setup and agent task ↗
ACTUAL APP / INDEPENDENT OFFLINE EXAMPLE
Search symbols, switch chart periods and manage local watchlists. This is the independent Stocks example running on macOS, with illustrative offline data.
The named guest passed 9/9 selected behavior comparisons. Prototype grade 81/100; major visual differences remain. This screenshot shows the source example, not whole-App parity or a live market service.
Build this example ↗// VISUAL WALKTHROUGH
The Mac example above shows a running independent app. These earlier iOS illustrations show how observations become reviewed evidence and deliverables.
// 03 — SELECTED EVIDENCE
These selected public examples illustrate the workflow. Complete cases, proprietary binaries and sandbox contents remain local.
// 04 — REAL DEVICE STATUS
Support statements follow device evidence. Coverage is scoped to the documented flows, not every app or every feature.
Dopamine / rootless
Analysis, package recovery, UI and selected rebuild flows verified.Relaxin / RootHide
Analysis, signed install and paired original/rebuild checks verified.Relaxin / RootHide
Selected Calculator and Clock rebuild checks passed; minor visual differences remain.