SwiftRASP

Runtime security for Swift iOS apps. Detect jailbreaks, injected code, debuggers, hooks and tampering through one API.

Working on OWASP MASVS-RESILIENCE or following the OWASP MASTG iOS resilience guidance? SwiftRASP provides ready-to-use iOS controls for jailbreak detection, anti-debugging, reverse-engineering-tool detection, runtime integrity and App Attest. It helps implement a resilience program; it does not by itself certify compliance or guarantee that every attack will be stopped.

• iOS 16+
• Swift Package Manager
• No third-party dependencies
• Open source under the MIT License
• Zero-config core protection; advanced features are opt-in

Want to see every result on screen? Open the included ExampleApp, a deliberately simple pentest application with one-time audits, live monitoring and JSON export.

Protect your app in 5 minutes

1. Add the package

In Xcode select File → Add Package Dependencies, enter your SwiftRASP repository URL and add the SwiftRASP product to your app target.

For Package.swift:

dependencies: [
    .package(url: "https://github.com/morzelowski/SwiftRASP.git", from: "0.1.0")
]

2. Import it

import SwiftRASP

3. Optional: Allow jailbreak app checks

iOS requires queried URL schemes to be declared. Add this block to your app's Info.plist so SwiftRASP can check for common jailbreak and sideloading apps:

<key>LSApplicationQueriesSchemes</key>
<array>
    <string>cydia</string>
    <string>sileo</string>
    <string>zbra</string>
    <string>zebra</string>
    <string>filza</string>
    <string>installer5</string>
    <string>undecimus</string>
    <string>trollstore</string>
    <string>trollstorehelper</string>
    <string>activator</string>
</array>

Without these entries, the rest of SwiftRASP still works, but iOS prevents these URL-scheme checks. SwiftRASP reports missing entries as an informational configuration finding that does not increase the risk score.

4. Choose one protection mode

Recommended: block critical risk automatically

Run this during application startup:

Task { @MainActor in
    await SwiftRASP.protect(
        .enhanced,
        policy: .blockCritical,
        onBlock: { decision in
            showSecurityBlockScreen(reasons: decision.reasons)
        },
        onDetection: { decision in
            sendSecurityReport(decision.report)
        }
    )
}

Critical risk calls onBlock. Lower-risk findings call onDetection. SwiftRASP never terminates the main application process or closes the host app. Your code owns the blocking screen and recovery flow.

Alternative: handle every detection yourself

Task {
    let decision = await SwiftRASP.evaluate(
        .enhanced,
        policy: .developerManaged
    )

    if decision.action == .review {
        handleSecurityFindings(decision.report)
    }
}

.developerManaged never returns .block. It returns detected threats as .review, so the library cannot block anything automatically.

5. Keep watching after launch

The launch audit is a snapshot. Keep a monitor alive to detect threats loaded later:

private var securityMonitor: RASPMonitor?

func startSecurityMonitor() {
    securityMonitor = SwiftRASP.monitor(
        protectionPolicy: .blockCritical
    ) { event, decision in
        if decision.shouldBlockApplication {
            showSecurityBlockScreen(reasons: decision.reasons)
        } else {
            logSecurityEvent(event)
        }
    }
}

Store the monitor in a property. Monitoring stops when it is released or when you call securityMonitor?.stop().

Done. No custom configuration is required. Test the final behavior on a physical device because the simulator skips checks that require the real iOS filesystem and sandbox.

Choose the audit depth

Mode	When to use it
.standard	Fast checks at every launch
.enhanced	Recommended; also scans processes and local attack ports
.maximum	High-risk flows; also probes process creation, fork-result tampering and protected-path writes

Start with .enhanced. Test .maximum carefully because its probes are more aggressive.

Understand the result

Action	Meaning
.allow	Nothing requires action
.review	A threat was detected; your code decides what to do
.block	Your policy says to show the blocking/recovery flow

Every decision includes a complete AuditReport, a 0...100 risk score and the findings that caused it.

What SwiftRASP detects

• Jailbreaks: Dopamine Hide Jailbreak's patched-dyld DOPA marker, rootless and rootful artifacts, /var/jb, /private/preboot, jailbreak URL schemes, suspicious symlinks, writable protected paths, sandbox escape, process-spawn capability, jailbreak processes and ports.
• TrollStore, sideloading and repackaging: unusual code-signing flags, embedded provisioning profiles, unexpected release bundle binaries and dylibs placed in app containers.
• Code injection: MobileSubstrate, ElleKit, Substitute, libhooker, TweakInject, Frida, Cycript, SSL Kill Switch and other known images, plus unknown images loaded outside the active dyld shared cache, sealed system roots (including Cryptex and USD) and application code paths.
• Dynamic-loader manipulation: DYLD_INSERT_LIBRARIES, DYLD_LIBRARY_PATH, DYLD_FRAMEWORK_PATH and injection-related environment variables. Development-build values are reported as configuration signals; the same values remain critical in Release.
• Reverse-engineering tools: Frida/Cycript images, threads, files, processes and listening ports. The live monitor continuously checks for Frida started or injected after launch.
• Debuggers: P_TRACED, CS_DEBUGGED, debug entitlements and suspicious parent processes.
• Runtime hooks: replaced Objective-C implementations in networking, storage, device identity, string/data and location APIs. Implementations in repackaged app frameworks and unresolved executable trampolines are not implicitly trusted.
• Environment manipulation: simulator execution and wall-clock rollback.
• Live threats and privacy events: debugger attachment, late injection, jailbreak artifacts, hooks, screenshots, screen recording, pasteboard changes and clock manipulation.
• Integration mistakes: missing URL-scheme configuration is reported as an informational finding and never increases risk.
• App attestation: optional Apple App Attest registration and per-request assertions with Keychain persistence for server-side verification.

Need more control?

Read Advanced Configuration only when you need to:

• change blocking thresholds or exact blocking rules;
• add custom indicators or allow trusted frameworks;
• inspect or customize risk scoring;
• select live-monitor events;
• enable anti-debugging hardening;
• integrate App Attest;
• review the full technical detection catalog.

Important security limitation

No client-side RASP can guarantee detection of every attack or prevent a determined attacker from reverse engineering an app. Use SwiftRASP as one layer alongside server-side authorization, App Attest, secure architecture, monitoring and incident response.

Need help evaluating the security of your mobile app?

We provide iOS and Android security assessments. Contact us at dev.orzelowski@gmail.com.

License

SwiftRASP is open-source software released under the MIT License.

Credits

The Dopamine detector follows the current Dopamine systemhook patched-dyld marker. RootHide behavior is documented in the RootHide developer guide.