Mobile Protect - iOS Static Obfuscation

Prerequisites

An iOS project with the MobileProtect SDK installed.
A copy of the datatheorem-obfuscate tool.

Obfuscation Tool Download

The datatheorem-obfuscate tool can be acquired using the following methods:

Direct download from Data Theorem’s portal: Direct Link Download
By cloning the MobileProtect build repository:
1. git clone https://1:{REPO_API_KEY}@mobile-protect-repos.securetheorem.com/mobileprotect-ios

Move the datatheorem-obfuscate binary to the root of the Xcode project (next to the .xcodeproj or .xcworkspace files).

Add Obfuscation Build Phases to Xcode

For projects using Cocoapods

For projects that use Cocoapods, add the following line to each target that is defined in the Podfile:

script_phase({name: "Data Theorem Static Obfuscation", script: "$PROJECT_DIR/datatheorem-obfuscate", execution_position: :after_compile})

Additionally, add the following to the end of the Podfile:

post_install do |installer|
  installer.pods_project.targets.each do |target|
    target.new_shell_script_build_phase("Data Theorem Static Obfuscation").shell_script = "$PODS_ROOT/../datatheorem-obfuscate"
  end
end

Example Podfile:

For projects not using Cocoapods

For each target in the project (app/framework), add a Run Script build phase named Data Theorem Static Obfuscation to the Xcode project containing the following:

Configuration

In the project's MobileProtect.plist configuration file, perform the following steps:

Add a new key called StaticObfuscation with its type set to Dictionary.
Inside this dictionary, insert a child key named Enabled with the type Boolean and set its value to YES.

After making these changes and performing a “clean” of the project, the installation is complete. The application will be statically obfuscated the next time it is compiled.

Optional Configuration

The following configuration keys are supported:

Enabled: A boolean value. Set to YES to enable static obfuscation.
ClassExcludeList: Specify a path, relative to the project root, pointing to a file that contains a list of class names. Each class name should be on a separate line. The selectors associated with these classes will be excluded from static obfuscation.
SelectorExcludeList: A file path, relative to the project root, pointing to a file that contains a list of selector names. Each selector name should be on a separate line. Selectors in this file will be excluded from static obfuscation.

Excluding Selectors From Obfuscation

Projects that refer to selectors directly will need to exclude these selectors from obfuscation, otherwise the app might crash. Selectors are referred to directly:

When using the @selector(...) syntax.
When using dynamic class lookup (NSClassFromString(), objc_getClass()).
When using key-value observation.

A typical crash caused by obfuscation of directly-referenced selectors will look similar to this:

To resolve such a crash, add the class name (SomeClassName) to the class exclusion list (refer to the ClassExcludeList configuration) or add the selector someSelector to the selector exclusion list (refer to the SelectorExcludeList).

Sometimes, the error will mention the obfuscated selector name, e.g.:

In this case, the corresponding (non-obfuscated) selector can be determined from the mapping file.