Use Malimite

Use Malimite

Overview

Use Malimite for supported Apple app-package navigation, not as a general standalone Mach-O decompiler. Preflight encryption, container shape, universal slices, prerequisites, network exposure, and Ghidra compatibility before analysis.

Read references/malimite-workflow.md for the currently verified capability and limitation baseline, privacy boundaries, and canonical sources.

Workflow

1. Preserve and preflight.

   • Copy and hash the input.
   • Record bundle executable, architecture slices and subtypes, UUID, signing, provisioning, and encryption state.
   • Route encrypted code, unsupported bare Mach-O, or unsupported universal formats before import.

2. Verify the toolchain.

   • Record exact Malimite, Java, and Ghidra versions.
   • Verify the release bundle and its Ghidra bridge remain together and that the configured Ghidra headless analyzer is available.
   • Do not mutate a Ghidra installation or elevate privileges without explaining the exact operation and obtaining approval.

3. Isolate untrusted analysis.

   • Use a dedicated working area and consider offline or firewall-isolated execution.
   • Inspect listener exposure before analyzing hostile input.

4. Import a supported package.

   • Prefer IPA or copied ZIP input.
   • If direct .app selection fails, try drag and drop or a copied ZIP wrapper and record the workaround.
   • Choose a universal slice explicitly and record library-filter and analysis options.

5. Navigate generated results.

   • Inspect bundle and provisioning metadata, resources, classes, functions, strings, entry points, search results, cross-references, and supported nested executables.
   • Attribute C-like pseudocode to Ghidra and reconstructed names or grouping to Malimite.

6. Review interpretation layers.

   • Keep direct metadata, Ghidra output, Malimite heuristics, manual edits, and LLM-generated translations separate.
   • Verify important conclusions in disassembly or a second tool.

7. Preserve generated state.

   • Record adjacent project files, project.json, SQLite database, screenshots, snippets, and any manual edits.
   • Do not promise bulk decompiled-source export.

8. Route failures.

   • Use Cutter, Ghidra, or Hopper for bare Mach-O, richer analyzer control, graphs, symbols, persistent project state, patching, or deep instruction work.

Guardrails

• Do not claim Malimite decrypts App Store executables.
• Do not describe heuristic Swift recovery or LLM output as recovered source.
• Do not claim iOS/macOS 26, beta, arm64e, PAC, or chained-fixup support without artifact-level verification.
• Do not transmit selected decompiled code to a hosted model without explicit destination and data approval.
• Do not store a sensitive long-lived API key in Malimite's built-in storage.

Output

Return artifact preflight, toolchain versions, isolation state, import options, direct metadata, generated analysis layers, preserved project artifacts, failures, and handoffs.