arnold117/iOS-NOIR

What it does

iOS-NOIR (inspired by the Android auditor Verlintas/NOIR) connects to a stock, non-jailbroken iPhone over USB and produces an evidence-graded forensic report on what apps can leak. It reads Apple-signed entitlements, Info.plist static whitelists, App Group and Keychain sharing, ATS exception domains, HouseArrest sandbox exposure, AFC database exposure and kernel .ips diagnostic logs (2)(10).

Its organizing concept is a five-layer persistent identity chain: iCloud KVS tokens, shared Keychain, App Group containers, hardcoded carrier phone-number gateways and HotspotHelper/BSSID hooks (13). Findings are graded VERIFIED, CAPABILITY or INFERRED, distinguishing static configuration from kernel capability and from cross-app inference (11). Output is JSON, domain lists and a standalone interactive bilingual HTML report; a radar mode watches TCC, sensor and IDFA requests in real time (21)(23).

It is aimed at privacy researchers, iOS developers and technically comfortable users who want reproducible device evidence rather than opinion.

Quick start

Tested on macOS, where Apple's usbmuxd runs natively; Windows and Linux are untested and may need extra iTunes or usbmuxd driver setup (16).

git clone https://github.com/arnold117/iOS-NOIR.git
cd iOS-NOIR
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

Plug in the iPhone, unlock it and tap Trust This Computer (20). Then run the audit and open the report:

python ios_noir.py scan
python ios_noir.py scan --lang en --redact
open noir-out/ios-noir-report.html

scan writes JSON, domain lists and the HTML report to noir-out/; --redact produces a share-safe version (21). For live permission and sensor probing:

python ios_noir.py radar --duration 30

A synthetic-data sample report can be opened in a browser before running anything.

Countermeasures

The repo ships an Apple DNS-settings mobileconfig that encrypts DNS and blocks trackers at the system level without a persistent VPN, plus an overlay module for Shadowrocket, Surge, Loon or Clash that blocks carrier silent-auth gateways, fingerprinting SDKs and telemetry domains (25)(30).

Constraints

• FairPlay boundary: on stock iOS binaries are FairPlay-encrypted, so the tool does not decompile Mach-O code; function-level analysis requires decrypted IPAs and a separate tool (31).
• Capability is not behavior: holding an entitlement proves the capability is unlocked, not that it is continuously triggered; trigger frequency depends on server-side policy (31).
• Static ATS domains are developer-declared exceptions, not captured traffic, and may be legacy endpoints (31).
• The .ips disk-write findings quoted in the README come from the author's own iPhone and are illustrative, not universal benchmarks.
• Device access requires an unlocked, trusted iPhone; license is MIT (32).

HotRepo's take

On the 2026-11-07 new-project list, iOS-NOIR recorded 123 stars and 28 forks, adding 14 stars in a roughly one-hour window while its earlier sample showed 109 stars. That is a single short burst from a very young repo, too little to call a trend, but it does show fast initial interest. The substance behind it is specific: per-app entitlement and plist forensics on a stock device, plus honest tiering of what is proven versus merely capable. Readers should treat the iOS-version compatibility surface as the main unknown, since the README does not state tested iOS releases.