AloneMonkey/MonkeyDev

What it does

MonkeyDev is an Xcode template suite built on iOSOpenDev. It lets you attach a dylib to an existing iOS app, write Objective-C/CaptainHook or Logos hooks, then re-sign, install, and debug the result from Xcode. It is aimed at iOS reverse engineering and runtime analysis work on Apple Silicon Macs with non-jailbroken iOS 15+ arm64 devices; the README cites verification on Xcode 27.0 with an iPhone 14 Pro running iOS 18.6.2 (README).

Beyond MonkeyApp, the suite includes MonkeyPod for packaging CaptainHook plugins as CocoaPods libraries, and jailbreak-oriented Logos Tweak, CaptainHook Tweak, and Command-line Tool wizards with rootless, rootful, and roothide package layouts.

Install

Prerequisites are a full Xcode installation, a native arm64 shell, and Theos installed for the current user at ~/theos (not /opt/theos). Install Theos first:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/theos/theos/master/bin/install-theos)"

Then install MonkeyDev and run the doctor check:

sudo /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/AloneMonkey/MonkeyDev/master/bin/md-install)"
/opt/MonkeyDev/bin/md-doctor

Later updates use sudo /opt/MonkeyDev/bin/md-update. The installer writes to /opt/MonkeyDev and registers templates in the current user's Xcode template directory without modifying Xcode.app (install section).

First MonkeyApp project

1. Restart Xcode, then choose File → New → Project → MonkeyDev → MonkeyApp.
2. Fill in the project name, development team, and Organization Identifier; leave Target App as Optional.
3. Place one decrypted IPA or unencrypted .app in <App target>/TargetApp/. If you provide no input, the built-in demo is used.
4. Select an iPhone and use a Debug build/run. Signing needs a valid certificate, matching provisioning profile, and device authorization.

Place the input in the TargetApp folder: the Target App text field is a legacy jailbreak Frida/SSH dump entry, not an IPA picker, and MonkeyDev does not decrypt apps for non-jailbroken devices. The creation wizard exposes build settings such as MONKEYDEV_INSERT_DYLIB, MONKEYDEV_DEFAULT_BUNDLEID, MONKEYDEV_RESTORE_SYMBOL, MONKEYDEV_CLASS_DUMP, and MONKEYDEV_UI_INSPECTOR (project creation).

Writing hooks

Objective-C/CaptainHook code goes in <project>Dylib/<project>Dylib.m; Logos code goes in <project>Dylib/Logos/<project>Dylib.xm, and the generated .mm should not be edited by hand. Both entries can run together. For symbol breakpoints, enable symbol restoration first, rebuild, then set a breakpoint in LLDB, for example:

breakpoint set -n '-[YourClass yourMethod:]'

The bundled method trace records call number, thread, nesting depth, arguments, return value, and synchronous duration, but supports only a defined signature subset, not arbitrary ABI hooks (hook section).

Enabling Export OC Headers writes main-program headers to <project>/Headers/<App target name>/; these are useful for analysis but are not guaranteed to compile as a complete SDK. For UI inspection, Reveal reads the user's locally downloaded SDK, while LookinServer 1.2.8 arm64 is bundled. Release builds do not include either inspector (headers and inspection).

Constraints

• Only thin arm64, unencrypted device input is supported. Intel Macs, the simulator, arm64e/PAC, fat binaries, and encrypted input are unsupported. arm64e devices can still run arm64 apps.
• Packaging copies remove app extensions, Watch content, and old Store metadata; extension signing and installation are not covered.
• Cycript and the old Substrate runtime have been removed; Logos internal mode does not support %hookf. Jailbreak tweaks need a MobileSubstrate-compatible loader such as ElleKit, and roothide packages cannot be replaced by normal rootless packages.
• USB installs of tweaks or command-line tools require brew install libusbmuxd libimobiledevice; password authentication also requires sshpass. The host-key check is not disabled, and installing a deb still needs sudo rights or passwordless sudo.
• The macOS template has not been migrated and is out of scope. Existing projects must be migrated separately, and incremental builds must run the signing phase every time (scope and migration).
• The project is distributed under GPL-3.0; the README states the software is for technical exchange and prohibits commercial or illegal use.

HotRepo's take

MonkeyDev has built a substantial following: 6,809 stars and 1,237 forks, with topics spanning CocoaPods, iOS, Theos, Xcode, Objective-C, and reverse engineering. The current README shows the project has moved well past its jailbreak-era origins: Apple Silicon and non-jailbroken arm64 support were reworked and verified against a current Xcode and iOS point release, with rootless jailbreak variants also tested on device. The structure across MonkeyApp, MonkeyPod, and the jailbreak wizards, plus the md-doctor check and explicit unsupported-input list, makes the supported scope readable before installation. HotRepo has no recorded GitHub daily rank, star snapshots, or Hacker News discussion for this repository.