Skip to content

MASTG-DEMO-0149: References to Object Deserialization of a URL Scheme Payload with r2

Download MASTG-DEMO-0149 IPA Open MASTG-DEMO-0149 Folder Build MASTG-DEMO-0149 IPA

Sample

The sample imports a user session that arrives in a custom URL scheme (mastgtest://import?session=<base64 archive>), which an attacker can deliver from Safari, Notes, or another app. Info.plist registers the mastgtest scheme and MASTestAppApp.swift forwards the opened URL to mastgTest(). For example:

mastgtest://import?session=YnBsaXN0MDDUAQIDBAUGBwpYJHZlcnNpb25ZJGFyY2hpdmVyVCR0b3BYJG9iamVjdHMSAAGGoF8QD05TS2V5ZWRBcmNoaXZlctEICVRyb290gAGlCwwTFBVVJG51bGzTDQ4PEBESWGNvbnRlbnRzViRjbGFzc1hmaWxlTmFtZYADgASAAl8QE3B3bmVkX3ZpYV9saW5rLmh0bWxfEG08IWRvY3R5cGUgaHRtbD48aHRtbD48Ym9keT48aDE%2BUHduZWQgdmlhIGRlZXAgbGluazwvaDE%2BPHNjcmlwdD5hbGVydCgicHduZWQgdmlhIGxpbmsiKTwvc2NyaXB0PjwvYm9keT48L2h0bWw%2B0hYXGBlaJGNsYXNzbmFtZVgkY2xhc3Nlc15DYWNoZWREb2N1bWVudKIaG15DYWNoZWREb2N1bWVudFhOU09iamVjdAAIABEAGgAkACkAMgA3AEkATABRAFMAWQBfAGYAbwB2AH8AgQCDAIUAmwELARABGwEkATMBNgFFAAAAAAAAAgEAAAAAAAAAHAAAAAAAAAAAAAAAAAAAAU4%3D

The payload was generated using PayloadGenerator.swift. It builds a CachedDocument archive with an attacker-chosen file name and contents, then base64- and URL-encodes it into a mastgtest://import?session=... link.

PayloadGenerator.swift
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
import Foundation
@objc(CachedDocument) class CachedDocument: NSObject, NSSecureCoding {
    static var supportsSecureCoding: Bool { true }
    let fileName: String; let contents: String
    init(fileName: String, contents: String){self.fileName=fileName;self.contents=contents;super.init()}
    func encode(with c: NSCoder){c.encode(fileName,forKey:"fileName");c.encode(contents,forKey:"contents")}
    required convenience init?(coder c: NSCoder){self.init(fileName:"",contents:"")}
}
let html = #"<!doctype html><html><body><h1>Pwned via deep link</h1><script>alert("pwned via link")</script></body></html>"#
let evil = try! NSKeyedArchiver.archivedData(withRootObject: CachedDocument(fileName: "pwned_via_link.html", contents: html), requiringSecureCoding: false)
let allowed = CharacterSet.urlQueryAllowed.subtracting(CharacterSet(charactersIn: "+/="))
let payload = evil.base64EncodedString().addingPercentEncoding(withAllowedCharacters: allowed)!
print("mastgtest://import?session=\(payload)")

You can regenerate the payload using the following command, which prints the complete link as shown above.

swift PayloadGenerator.swift

To test it with the app running on a device, follow Opening Deep Links. Once you trigger the URL scheme and the app opens, click on Start so the app processes the link.

The payload is deserialized through both an insecure and a secure path:

  • The insecure path defines InsecureUserSession, which conforms to NSCoding instead of NSSecureCoding. The imported archive is decoded with requiresSecureCoding = false and decodeObject(forKey:), so a substituted archive is decoded without type enforcement.

  • The secure path defines SecureUserSession, which conforms to NSSecureCoding, returns true from supportsSecureCoding, decodes nested objects with decodeObject(of:forKey:), and reads the top-level object with unarchivedObject(ofClass:from:), which rejects a substituted archive.

The sample also includes CachedDocument, a plausible offline-cache model whose init(coder:) writes a cached file to disk. Because the insecure path doesn't restrict the decoded class, an attacker who substitutes CachedDocument into the link's payload turns that normal cache restore into an attacker-controlled file write that runs during decoding, while the secure path rejects the class before it is instantiated.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
// SUMMARY: This sample imports a user session that arrives in a custom URL scheme
// (mastgtest://import?session=<base64 archive>), which an attacker can deliver from Safari, Notes,
// or another app. The FAIL path uses NSCoding and disables secure coding, so a substituted archive
// is decoded without type enforcement, which lets an attacker run another class's init(coder:)
// (here CachedDocument, which writes a file) just by getting the victim to open a link.
// The PASS path uses NSSecureCoding and class-restricted unarchiving, which rejects the substituted
// class before it is instantiated.

import Foundation

// MARK: FAIL example

// FAIL: [MASTG-TEST-0386] InsecureUserSession conforms to NSCoding instead of NSSecureCoding,
// so it provides no class restriction when its archives are decoded.
@objc class InsecureUserSession: NSObject, NSCoding {
    let userID: String
    let isAdmin: Bool

    init(userID: String, isAdmin: Bool) {
        self.userID = userID
        self.isAdmin = isAdmin
        super.init()
    }

    func encode(with coder: NSCoder) {
        coder.encode(userID, forKey: "userID")
        coder.encode(isAdmin, forKey: "isAdmin")
    }

    required convenience init?(coder: NSCoder) {
        // FAIL: [MASTG-TEST-0386] decodeObject(forKey:) doesn't restrict the expected class.
        guard let userID = coder.decodeObject(forKey: "userID") as? String else {
            return nil
        }

        let isAdmin = coder.decodeBool(forKey: "isAdmin")
        self.init(userID: userID, isAdmin: isAdmin)
    }
}

// MARK: PASS example

// PASS: SecureUserSession conforms to NSSecureCoding and enforces class restrictions during decoding.
@objc class SecureUserSession: NSObject, NSSecureCoding {
    static var supportsSecureCoding: Bool {
        return true
    }

    let userID: String
    let isAdmin: Bool

    init(userID: String, isAdmin: Bool) {
        self.userID = userID
        self.isAdmin = isAdmin
        super.init()
    }

    func encode(with coder: NSCoder) {
        coder.encode(userID, forKey: "userID")
        coder.encode(isAdmin, forKey: "isAdmin")
    }

    required convenience init?(coder: NSCoder) {
        // PASS: decodeObject(of:forKey:) restricts the decoded value to the expected class.
        guard let userID = coder.decodeObject(of: NSString.self, forKey: "userID") as? String else {
            return nil
        }

        let isAdmin = coder.decodeBool(forKey: "isAdmin")
        self.init(userID: userID, isAdmin: isAdmin)
    }
}

// MARK: Cached document model (deserialization gadget)

// CachedDocument is a realistic app model: an app that lets users open documents offline might
// keep an index of cached files and rehydrate each one to disk when the index is loaded. Writing
// the file in init(coder:) is a legitimate part of that flow. The problem is that the insecure path
// doesn't restrict the decoded class, so an attacker who substitutes this class into the archive
// turns a normal cache restore into a file write they control (the file name and contents come from
// the archive), running during decoding. The secure path rejects this class before it is
// instantiated, so the write never happens.
@objc(CachedDocument) class CachedDocument: NSObject, NSSecureCoding {
    static var supportsSecureCoding: Bool {
        return true
    }

    let fileName: String
    let contents: String

    init(fileName: String, contents: String) {
        self.fileName = fileName
        self.contents = contents
        super.init()
    }

    func encode(with coder: NSCoder) {
        coder.encode(fileName, forKey: "fileName")
        coder.encode(contents, forKey: "contents")
    }

    required convenience init?(coder: NSCoder) {
        let fileName = coder.decodeObject(forKey: "fileName") as? String ?? "offline_cache.txt"
        let contents = coder.decodeObject(forKey: "contents") as? String ?? ""
        self.init(fileName: fileName, contents: contents)
        restoreToDisk()
    }

    // Rehydrates the cached document so it can be opened offline.
    private func restoreToDisk() {
        guard let documents = FileManager.default.urls(for: .documentDirectory, in: .userDomainMask).first else {
            return
        }
        let url = documents.appendingPathComponent(fileName)
        try? contents.write(to: url, atomically: true, encoding: .utf8)
    }
}

// Holds the most recent URL the app was opened with (set in MASTestAppApp.onOpenURL),
// so mastgTest() can process it when the user taps Start.
enum URLState {
    static var lastURL: URL?
}

struct MastgTest {
    static func mastgTest(completion: @escaping (String) -> Void) {
        guard let url = URLState.lastURL else {
            completion("""
            Waiting for a deep link.
            Open mastgtest://import?session=<base64 archive> from Safari or Notes, then tap Start.
            """)
            return
        }

        URLState.lastURL = nil
        completion(importSharedSession(from: url))
    }

    // FAIL: [MASTG-TEST-0386] The app accepts a session from a deep link and deserializes
    // attacker-controlled data. Anyone can send a mastgtest://import?session=<base64 archive> link
    // (for example in Safari or Notes); opening it runs the insecure decode below, with no app of
    // the attacker's own required.
    static func importSharedSession(from url: URL) -> String {
        guard
            let components = URLComponents(url: url, resolvingAgainstBaseURL: false),
            let encoded = components.queryItems?.first(where: { $0.name == "session" })?.value,
            let data = Data(base64Encoded: encoded)
        else {
            return "No session payload in the URL.\nExpected mastgtest://import?session=<base64 archive>."
        }

        return """
        Imported a session from a deep link (\(url.scheme ?? "")://\(url.host ?? "")).

        INSECURE (NSCoding):
        \(decodeInsecurely(data))

        SECURE (NSSecureCoding):
        \(decodeSecurely(data))
        """
    }

    private static func decodeInsecurely(_ data: Data) -> String {
        do {
            let unarchiver = try NSKeyedUnarchiver(forReadingFrom: data)

            // FAIL: [MASTG-TEST-0386] Secure coding enforcement is explicitly disabled.
            unarchiver.requiresSecureCoding = false

            // FAIL: [MASTG-TEST-0386] The root object is decoded without restricting the expected class.
            // A substituted class is instantiated here, and its init(coder:) runs, before the cast below can reject it.
            let object = unarchiver.decodeObject(forKey: NSKeyedArchiveRootObjectKey)
            unarchiver.finishDecoding()

            if let document = object as? CachedDocument {
                return "Decoding instantiated CachedDocument and ran its initializer, which wrote '\(document.fileName)' into the app sandbox."
            }

            guard let object else {
                return "Decoded no root object."
            }

            guard let session = object as? InsecureUserSession else {
                return "Decoded an unexpected type: \(type(of: object))."
            }

            return accessDecision(userID: session.userID, isAdmin: session.isAdmin)
        } catch {
            return "Decoding failed: \(error.localizedDescription)"
        }
    }

    private static func decodeSecurely(_ data: Data) -> String {
        do {
            // PASS: unarchivedObject(ofClass:from:) requires secure coding and rejects unexpected classes
            // before they are instantiated, so a substituted CachedDocument's init(coder:) never runs.
            guard let session = try NSKeyedUnarchiver.unarchivedObject(ofClass: SecureUserSession.self, from: data) else {
                return "Decoding returned nil."
            }
            return accessDecision(userID: session.userID, isAdmin: session.isAdmin)
        } catch {
            return "Decoding rejected before instantiation: \(error.localizedDescription)"
        }
    }

    // Simulates a security-relevant decision driven by the decoded session.
    private static func accessDecision(userID: String, isAdmin: Bool) -> String {
        let role = isAdmin ? "ADMIN access granted" : "standard user access"
        return "userID: \(userID), isAdmin: \(isAdmin) -> \(role)"
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>CFBundleURLTypes</key>
    <array>
        <dict>
            <key>CFBundleURLName</key>
            <string>org.owasp.mastgtest</string>
            <key>CFBundleURLSchemes</key>
            <array>
                <string>mastgtest</string>
            </array>
        </dict>
    </array>
</dict>
</plist>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
import SwiftUI

@main
struct MASTestAppApp: App {
    var body: some Scene {
        WindowGroup {
            ContentView()
                .onOpenURL { url in
                    // Store the incoming URL so mastgTest() processes it when the user taps Start.
                    URLState.lastURL = url
                }
        }
    }
}

Steps

  1. Unzip the app package and locate the main binary file using Exploring the App Package. In this case, the binary is ./Payload/MASTestApp.app/MASTestApp.
  2. Run run.sh.
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
e scr.color=false
e asm.bytes=false
e bin.relocs.apply=true

?e === Relevant API inventory ===
?e Unsafe keyed unarchiving APIs:
ir~setRequiresSecureCoding
ir~decodeObjectForKey
izz~setRequiresSecureCoding
izz~decodeObjectForKey

?e
?e Secure keyed unarchiving APIs:
is~decodeObject2of6forKey
is~unarchivedObject7ofClass

?e
?e URL payload APIs and strings:
is~URLComponents
is~queryItems
is~URLQueryItem
is~base64Encoded
izz~session
izz~mastgtest

?e
?e Possible consequence APIs:
is~appendingPathComponent
is~write2to10atomically8encoding

?e
?e === Xrefs to decoding APIs ===
?e Functions that set requiresSecureCoding:
axt @ reloc.fixup.setRequiresSecureCoding:

?e
?e Functions that call unrestricted decodeObject(forKey:):
axt @ reloc.fixup.decodeObjectForKey:

?e
?e Secure decoding references for comparison:
axt @@=`is~decodeObject2of6forKey[2]`
axt @@=`is~unarchivedObject7ofClass[2]`

?e
?e === Focused proof snippets ===
?e setRequiresSecureCoding is called with 0, Boolean false:
pd 8 @ 0x70c8

?e
?e The same function calls decodeObjectForKey:
pd 8 @ 0x7130

?e
?e === Reachability from URL payload ===
?e URLComponents and queryItems:
pd 8 @ 0x67b4
pd 8 @ 0x6810

?e
?e Query item value and Base64 decoding:
pd 8 @ 0x6900
pd 8 @ 0x69f4

?e
?e The URL import function calls the insecure decoder:
pd 8 @ 0x6d20

?e
?e The same URL import function calls the secure decoder:
pd 8 @ 0x6dc0

?e
?e === Consequence path ===
?e The substituted class initializer decodes fileName and contents:
pd 8 @ 0x5644
pd 8 @ 0x5818

?e
?e The initializer calls restoreToDisk:
pd 8 @ 0x5a78

?e
?e restoreToDisk builds a path and writes contents:
pd 8 @ 0x5d9c
pd 8 @ 0x5e10

# === Full functions for side review ===
pdf @ 0x6644 > importSharedSession.asm
pdf @ 0x7040 > decodeInsecurely.asm

1
r2 -q -i nscoding.r2 -A MASTestApp > output.txt

Observation

The === Xrefs to decoding APIs === section of output.txt shows that a single function disables secure coding and decodes without a class restriction: MastgTest.decodeInsecurely references both setRequiresSecureCoding: (at 0x000070c8) and the unrestricted decodeObjectForKey: (at 0x00007130).

The === Focused proof snippets === section of output.txt disassembles those two call sites (the full function is in decodeInsecurely.asm):

  • At 0x000070c8 the setRequiresSecureCoding: selector is loaded, the value 0 is prepared at 0x000070cc to 0x000070d0, and objc_msgSend is called at 0x000070d4.
  • The same function calls decodeObjectForKey: at 0x00007130 to 0x00007134.
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
=== Relevant API inventory ===
Unsafe keyed unarchiving APIs:
207  0x0001a36e 0x0001a36e 24  25   3.__TEXT.__objc_methname   ascii setRequiresSecureCoding:
196  0x0001a293 0x0001a293 19  20   3.__TEXT.__objc_methname   ascii decodeObjectForKey:

Secure keyed unarchiving APIs:
1016 0x00019c34 0x00019c34 LOCAL  FUNC 0        imp.$sSo7NSCoderC10FoundationE12decodeObject2of6forKeyxSgxm_SStSo8NSObjectCRbzSo8NSCodingRzlF                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            NSCoder.Foundation.allocator__String(...tSo8NSObjectCRbzSo8NSCodingRzlF)
1015 0x00019c28 0x00019c28 LOCAL  FUNC 0        imp.$sSo17NSKeyedUnarchiverC10FoundationE16unarchivedObject7ofClass4fromxSgxm_AC4DataVtKSo8NSObjectCRbzSo8NSCodingRzlFZ                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  NSKeyedUnarchiver.Foundation.allocator.(...DataVtKSo8NSObjectCRbzSo8NSCodingRzlFZ)

URL payload APIs and strings:
194  0x00009030 0x00009030 LOCAL  FUNC 0        _$s10Foundation13URLComponentsVSgWOh                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     Foundation.URLComponents: GenericAccessorW.bool -> GenericAccessor
522  0x0001aeda 0x0001aeda LOCAL  FUNC 0        _symbolic _____Sg 10Foundation13URLComponentsV                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           symbolic Foundation.URLComponents...V
606  0x0001b9a8 0x0001b9a8 LOCAL  FUNC 0        _$s10Foundation13URLComponentsVSgMR                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Foundation.URLComponents: GenericAccessorM
757  0x000287b8 0x000287b8 LOCAL  FUNC 0        _$s10Foundation13URLComponentsVSgMd                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Foundation.URLComponents: GenericAccessorM
895  0x00019688 0x00019688 LOCAL  FUNC 0        imp.$s10Foundation13URLComponentsV10queryItemsSayAA12URLQueryItemVGSgvg                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Foundation.URLComponents.queryItems.URLQueryItem...VGSgvg
896  0x00019694 0x00019694 LOCAL  FUNC 0        imp.$s10Foundation13URLComponentsV3url23resolvingAgainstBaseURLACSgAA0G0Vh_SbtcfC                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Foundation.URLComponents.url.resolvingAgainstBaseURL...A0G0Vh_SbtcfC
897  0x000196a0 0x000196a0 LOCAL  FUNC 0        imp.$s10Foundation13URLComponentsVMa                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     Foundation.URLComponents...VMa
895  0x00019688 0x00019688 LOCAL  FUNC 0        imp.$s10Foundation13URLComponentsV10queryItemsSayAA12URLQueryItemVGSgvg                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Foundation.URLComponents.queryItems.URLQueryItem...VGSgvg
170  0x00006f7c 0x00006f7c LOCAL  FUNC 0        _$s10MASTestApp9MastgTestV19importSharedSession4fromSS10Foundation3URLV_tFZSbAF12URLQueryItemVXEfU_                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MASTestApp.MastgTest.importSharedSession.from.Foundation.URL.URLQueryItem...VXEfU_
197  0x00009138 0x00009138 LOCAL  FUNC 0        _$sSay10Foundation12URLQueryItemVGSayxGSTsWl                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             ...sSay10Foundation12URLQueryItemVGSayxGSTsWl
198  0x000091ac 0x000091ac LOCAL  FUNC 0        _$sSay10Foundation12URLQueryItemVGWOh                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ...sSay10Foundation12URLQueryItemVGWOh
199  0x000091d4 0x000091d4 LOCAL  FUNC 0        _$s10Foundation12URLQueryItemVSgWOh                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Foundation.URLQueryItem: GenericAccessorW.bool -> GenericAccessor
521  0x0001aed2 0x0001aed2 LOCAL  FUNC 0        _symbolic _____Sg 10Foundation12URLQueryItemV                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            symbolic Foundation.URLQueryItem...V
523  0x0001aee2 0x0001aee2 LOCAL  FUNC 0        _symbolic Say_____G 10Foundation12URLQueryItemV                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          symbolic Foundation.URLQueryItem...V
605  0x0001b9a0 0x0001b9a0 LOCAL  FUNC 0        _$s10Foundation12URLQueryItemVSgMR                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       Foundation.URLQueryItem: GenericAccessorM
607  0x0001b9b0 0x0001b9b0 LOCAL  FUNC 0        _$sSay10Foundation12URLQueryItemVGMR                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     ...sSay10Foundation12URLQueryItemVGMR
756  0x000287b0 0x000287b0 LOCAL  FUNC 0        _$s10Foundation12URLQueryItemVSgMd                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       Foundation.URLQueryItem: GenericAccessorM
758  0x000287c0 0x000287c0 LOCAL  FUNC 0        _$sSay10Foundation12URLQueryItemVGMd                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     ...sSay10Foundation12URLQueryItemVGMd
759  0x000287c8 0x000287c8 LOCAL  FUNC 0        _$sSay10Foundation12URLQueryItemVGSayxGSTsWL                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             ...sSay10Foundation12URLQueryItemVGSayxGSTsWL
892  0x00019664 0x00019664 LOCAL  FUNC 0        imp.$s10Foundation12URLQueryItemV4nameSSvg                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Foundation.URLQueryItem.name(...vg)
893  0x00019670 0x00019670 LOCAL  FUNC 0        imp.$s10Foundation12URLQueryItemV5valueSSSgvg                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Foundation.URLQueryItem.value(...Sgvg)
894  0x0001967c 0x0001967c LOCAL  FUNC 0        imp.$s10Foundation12URLQueryItemVMa                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Foundation.URLQueryItem...VMa
895  0x00019688 0x00019688 LOCAL  FUNC 0        imp.$s10Foundation13URLComponentsV10queryItemsSayAA12URLQueryItemVGSgvg                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Foundation.URLComponents.queryItems.URLQueryItem...VGSgvg
171  0x00007014 0x00007014 LOCAL  FUNC 0        _$s10Foundation4DataV13base64Encoded7optionsACSgSSh_So27NSDataBase64DecodingOptionsVtcfcfA0_                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             Foundation.Data.base64Encoded.options.NSDataBase64DecodingOptions...A0_
913  0x00019760 0x00019760 LOCAL  FUNC 0        imp.$s10Foundation4DataV13base64Encoded7optionsACSgSSh_So27NSDataBase64DecodingOptionsVtcfC                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Foundation.Data.base64Encoded.options.NSDataBase64DecodingOptions...VtcfC
219  0x0001a470 0x0001a470 111 112  4.__TEXT.__cstring         ascii Waiting for a deep link.\nOpen mastgtest://import?session=<base64 archive> from Safari or Notes, then tap Start.
220  0x0001a4e0 0x0001a4e0 84  85   4.__TEXT.__cstring         ascii No session payload in the URL.\nExpected mastgtest://import?session=<base64 archive>.
221  0x0001a540 0x0001a540 37  38   4.__TEXT.__cstring         ascii Imported a session from a deep link (
245  0x0001a7bc 0x0001a7bc 7   8    4.__TEXT.__cstring         ascii session
219  0x0001a470 0x0001a470 111 112  4.__TEXT.__cstring         ascii Waiting for a deep link.\nOpen mastgtest://import?session=<base64 archive> from Safari or Notes, then tap Start.
220  0x0001a4e0 0x0001a4e0 84  85   4.__TEXT.__cstring         ascii No session payload in the URL.\nExpected mastgtest://import?session=<base64 archive>.

Possible consequence APIs:
909  0x00019730 0x00019730 LOCAL  FUNC 0        imp.$s10Foundation3URLV22appendingPathComponentyACSSF                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Foundation.URL.appendingPathComponent(...CSSF)
1026 0x00019cac 0x00019cac LOCAL  FUNC 0        imp.$sSy10FoundationE5write2to10atomically8encodingyAA3URLV_SbSSAAE8EncodingVtKF                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         Foundation(...bSSAAE8EncodingVtKF)

=== Xrefs to decoding APIs ===
Functions that set requiresSecureCoding:
sym.MASTestApp.MastgTest.decodeInsecurely._6E8AB2C58CE173A727EF27CB85DF8CD8.Foundation.Data...VFZ 0x70c8 [DATA:r--] ldr x1, reloc.fixup.setRequiresSecureCoding:

Functions that call unrestricted decodeObject(forKey:):
sym.MASTestApp.InsecureUserSession.coder.allocator.SgSo7NSCoderC_tcfc 0x443c [DATA:r--] ldr x1, reloc.fixup.decodeObjectForKey:
sym.MASTestApp.CachedDocument.coder.allocator.SgSo7NSCoderC_tcfc 0x5678 [DATA:r--] ldr x1, reloc.fixup.decodeObjectForKey:
sym.MASTestApp.CachedDocument.coder.allocator.SgSo7NSCoderC_tcfc 0x5854 [DATA:r--] ldr x1, reloc.fixup.decodeObjectForKey:
sym.MASTestApp.MastgTest.decodeInsecurely._6E8AB2C58CE173A727EF27CB85DF8CD8.Foundation.Data...VFZ 0x7130 [DATA:r--] ldr x1, reloc.fixup.decodeObjectForKey:

Secure decoding references for comparison:
sym.MASTestApp.SecureUserSession.coder.allocator.SgSo7NSCoderC_tcfc 0x4da0 [CALL:--x] bl sym.imp.NSCoder.Foundation.allocator__String_...tSo8NSObjectCRbzSo8NSCodingRzlF_
sym.MASTestApp.MastgTest.decodeSecurely._6E8AB2C58CE173A727EF27CB85DF8CD8.Foundation.Data...VFZ 0x785c [CALL:--x] bl sym.imp.NSKeyedUnarchiver.Foundation.allocator._...DataVtKSo8NSObjectCRbzSo8NSCodingRzlFZ_

=== Focused proof snippets ===
setRequiresSecureCoding is called with 0, Boolean false:
│           0x000070c8      ldr x1, [x8, 0x408]                        ; [0x28408:8]=0x1a36e str.setRequiresSecureCoding: ; "n\xa3\x01" ; char *selector
│           0x000070cc      mov w8, 0
│           0x000070d0      and w2, w8, 1
│           0x000070d4      bl sym.imp.objc_msgSend                    ; void *objc_msgSend(void *instance, char *selector)
│           0x000070d8      adrp x8, segment.__DATA_CONST              ; 0x24000
│           0x000070dc      ldr x8, [x8, 0x170]                        ; [0x24170:8]=0
│                                                                      ; reloc.NSKeyedArchiveRootObjectKey
│           0x000070e0      ldr x0, [x8]
│           0x000070e4      str x0, [var_1d0h]

The same function calls decodeObjectForKey:
│           0x00007130      ldr x1, [x8, 0x3e0]                        ; [0x283e0:8]=0x1a293 str.decodeObjectForKey: ; reloc.fixup.decodeObjectForKey: ; char *selector
│           0x00007134      bl sym.imp.objc_msgSend                    ; void *objc_msgSend(void *instance, char *selector)
│           0x00007138      mov x29, x29
│           0x0000713c      bl sym.imp.objc_retainAutoreleasedReturnValue ; void objc_retainAutoreleasedReturnValue(void *instance)
│           0x00007140      mov x8, x0
│           0x00007144      ldr x0, [var_1e0h]
│           0x00007148      str x8, [var_1e8h]
│           0x0000714c      adrp x8, segment.__DATA_CONST              ; 0x24000

=== Reachability from URL payload ===
URLComponents and queryItems:
│           0x000067b4      bl sym.imp.Foundation.URLComponents.url.resolvingAgainstBaseURL...A0G0Vh_SbtcfC
│           0x000067b8      sub x8, x29, 8
│           0x000067bc      ldur x8, [x8, -0x100]
│           0x000067c0      ldur x0, [x29, -0x100]
│           0x000067c4      ldur w1, [x29, -0xf4]
│           0x000067c8      ldur x2, [x29, -0xf0]
│           0x000067cc      ldr x8, [x8, 0x30]
│           0x000067d0      blr x8
│           0x00006810      bl sym.imp.Foundation.URLComponents.queryItems.URLQueryItem...VGSgvg
│           0x00006814      sub x8, x29, 0x48
│           0x00006818      stur x0, [x8, -0x100]
│       ┌─< 0x0000681c      cbz x0, 0x6838
│      ┌──< 0x00006820      b 0x6824
│      ││   ; CODE XREF from func.00006644 @ 0x6820(x)
│      └──> 0x00006824      sub x8, x29, 0x48
│       │   0x00006828      ldur x8, [x8, -0x100]
│       │   0x0000682c      sub x9, x29, 0x50

Query item value and Base64 decoding:
│           0x00006900      bl sym.imp.Foundation.URLQueryItem.value_...Sgvg_ ; Foundation.URLQueryItem.value(...Sgvg)
│           0x00006904      sub x8, x29, 0x60
│           0x00006908      ldur x8, [x8, -0x100]
│           0x0000690c      mov x2, x0
│           0x00006910      sub x9, x29, 0x30
│           0x00006914      ldur x0, [x9, -0x100]
│           0x00006918      sub x9, x29, 0x88
│           0x0000691c      stur x2, [x9, -0x100]
│           0x000069f4      bl sym.Foundation.Data.base64Encoded.options.NSDataBase64DecodingOptions...A0_ ; func.00007014
│           0x000069f8      sub x8, x29, 0xc8
│           0x000069fc      ldur x1, [x8, -0x100]
│           0x00006a00      mov x2, x0
│           0x00006a04      sub x8, x29, 0xc0
│           0x00006a08      ldur x0, [x8, -0x100]
│           0x00006a0c      bl sym.imp.Foundation.Data.base64Encoded.options.NSDataBase64DecodingOptions...VtcfC
│           0x00006a10      sub x8, x29, 0xb8

The URL import function calls the insecure decoder:
│           0x00006d20      bl sym.MASTestApp.MastgTest.decodeInsecurely._6E8AB2C58CE173A727EF27CB85DF8CD8.Foundation.Data...VFZ ; func.00007040
│           0x00006d24      sub x8, x29, 0x170
│           0x00006d28      ldur x2, [x8, -0x100]
│           0x00006d2c      sub x8, x29, 0x168
│           0x00006d30      ldur x3, [x8, -0x100]
│           0x00006d34      mov x9, x0
│           0x00006d38      mov x8, x1
│           0x00006d3c      sub x10, x29, 0x160

The same URL import function calls the secure decoder:
│           0x00006dc0      bl sym.MASTestApp.MastgTest.decodeSecurely._6E8AB2C58CE173A727EF27CB85DF8CD8.Foundation.Data...VFZ ; func.000077fc
│           0x00006dc4      sub x8, x29, 0x170
│           0x00006dc8      ldur x2, [x8, -0x100]
│           0x00006dcc      sub x8, x29, 0x168
│           0x00006dd0      ldur x3, [x8, -0x100]
│           0x00006dd4      mov x9, x0
│           0x00006dd8      mov x8, x1
│           0x00006ddc      sub x10, x29, 0x160

=== Consequence path ===
The substituted class initializer decodes fileName and contents:
│           0x00005644      add x0, x0, 0x41d                          ; 0x1a41d ; "fileName"
│           0x00005648      mov w8, 1
│           0x0000564c      and w2, w8, 1
│           0x00005650      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│           0x00005654      str x1, [arg0]
│           0x00005658      bl sym.imp.Foundationbool_...ridgeToObjectiveCSo8NSStringCyF_ ; Foundationbool(...ridgeToObjectiveCSo8NSStringCyF)
│           0x0000565c      mov x1, x0
│           0x00005660      ldr x0, [arg0]                             ; void *arg0
│           0x00005818      add x0, x0, 0x426                          ; 0x1a426 ; "contents"
│           0x0000581c      mov w8, 8
│           0x00005820      mov x1, x8
│           0x00005824      mov w8, 1
│           0x00005828      and w2, w8, 1
│           0x0000582c      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│           0x00005830      str x1, [var_70h]
│           0x00005834      bl sym.imp.Foundationbool_...ridgeToObjectiveCSo8NSStringCyF_ ; Foundationbool(...ridgeToObjectiveCSo8NSStringCyF)

The initializer calls restoreToDisk:
│           0x00005a78      bl sym.MASTestApp.CachedDocument.restoreToDisk.allocator_...E8AB2C58CE173A727EF27CB85DF8CD8LLyyF_ ; func.00005b14
│           0x00005a7c      ldr x0, [var_18h]                          ; void *arg0
│           0x00005a80      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│           0x00005a84      ldr x0, [var_68h]                          ; void *arg0
│           0x00005a88      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│           0x00005a8c      ldr x0, [instance]
│           0x00005a90      adrp x8, segment.__DATA_CONST              ; 0x24000
│           0x00005a94      ldr x8, [x8, 0x198]                        ; [0x24198:8]=0
│                                                                      ; reloc.objc_release

restoreToDisk builds a path and writes contents:
│           0x00005d9c      ldur x8, [x29, -0xa0]
│           0x00005da0      bl sym.imp.Foundation.URL.appendingPathComponent_...CSSF_ ; Foundation.URL.appendingPathComponent(...CSSF)
│           0x00005da4      sub x8, x29, 8
│           0x00005da8      ldur x0, [x8, -0x100]                      ; void *arg0
│           0x00005dac      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│           0x00005db0      ldur x8, [x29, -0xe8]
│           0x00005db4      adrp x9, sym.__PROTOCOLS__TtC10MASTestApp19InsecureUserSession ; 0x28000
│           0x00005db8      ldr x9, [x9, 0x788]                        ; [0x28788:8]=24
│                                                                      ; field.class.CachedDocument.var.contents
│                                                                      MASTestApp.CachedDocument.contents.allocator__Swift.String__String: allocator, contents__String: allocator, S.pWvd
│           0x00005e10      bl sym.imp.Foundation_...bSSAAE8EncodingVtKF_ ; Foundation(...bSSAAE8EncodingVtKF)
│           0x00005e14      mov x8, x21
│           0x00005e18      stur x8, [x29, -0xf0]
│       ┌─< 0x00005e1c      cbnz x21, 0x5eb0
│      ┌──< 0x00005e20      b 0x5e24
│      ││   ; CODE XREF from func.00005b14 @ 0x5e20(x)
│      └──> 0x00005e24      ldur x1, [x29, -0xd8]                      ; int64_t arg_20h
│       │   0x00005e28      ldur x0, [x29, -0xc0]
│       │   0x00005e2c      ldur x8, [x29, -0xd0]

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
            ; CALL XREF from func.00006644 @ 0x6d20(x) ; sym.MASTestApp.MastgTest.importSharedSession.from.Foundation.URL...V_tFZ
┌ 1980: E8AB2C.CE173A727EF27CB85DF8CD8.Foundation.Data...VFZ..partial.apply (int64_t arg1, int64_t arg2, void *arg_10h, int64_t arg_18h, int64_t arg_24h, void *arg_28h, int64_t arg_30h, int64_t arg_38h, int64_t arg_40h, int64_t arg_50h, int64_t arg_58h, int64_t arg_78h, void *arg_90h, int64_t arg_a0h, int64_t arg_a8h, int64_t arg_b0h, int64_t arg_b8h, int64_t arg_c0h, int64_t arg_108h, int64_t arg_110h, int64_t arg_178h, int64_t arg_180h, int64_t arg_198h, int64_t arg_1a8h, int64_t arg_278h, int64_t arg_280h, int64_t arg_2a0h, int64_t arg_2b8h);
│ `- args(x0, x1, sp[0x10..0x2b8]) vars(92:sp[0x8..0x3c8])
; MASTestApp.MastgTest.decodeInsecurely._6E8AB2C58CE173A727EF27CB85DF8
; CD8.Foundation.Data...VFZ
│           0x00007040      stp x22, x21, [var_30h]!
│           0x00007044      stp x20, x19, [var_10h]
│           0x00007048      stp x29, x30, [var_20h]
│           0x0000704c      add x29, sp, 0x20
│           0x00007050      sub sp, sp, 0x3a0
│           0x00007054      str x0, [var_1f0h]                         ; arg1
│           0x00007058      str x1, [var_1f8h]                         ; arg2
│           0x0000705c      stur xzr, [x29, -0x30]
│           0x00007060      stur xzr, [x29, -0x28]
│           0x00007064      mov x21, 0
│           0x00007068      stur xzr, [x29, -0x38]
│           0x0000706c      stur xzr, [x29, -0x80]
│           0x00007070      str xzr, [var_260h]
│           0x00007074      str xzr, [var_258h]
│           0x00007078      stur x0, [x29, -0x30]                      ; arg1
│           0x0000707c      stur x1, [x29, -0x28]                      ; arg2
│           0x00007080      mov x0, 0                                  ; int64_t arg_20h
│           0x00007084      bl sym....sSo17NSKeyedUnarchiverCMa        ; func.0000923c
│           0x00007088      ldr x1, [var_1f8h]                         ; int64_t arg2
│           0x0000708c      mov x20, x0
│           0x00007090      ldr x0, [var_1f0h]                         ; int64_t arg1
│           0x00007094      bl sym.Foundation.Data._Representation_...Oy_ ; func.0000929c
│           0x00007098      ldr x0, [var_1f0h]                         ; int64_t arg1
│           0x0000709c      ldr x1, [var_1f8h]                         ; int64_t arg2
│           0x000070a0      bl sym.__C.NSKeyedUnarchiver               ; func.00007aa8
│           0x000070a4      str x0, [instance]
│           0x000070a8      mov x8, x21
│           0x000070ac      str x8, [var_208h]
│       ┌─< 0x000070b0      cbnz x21, 0x76b0
│      ┌──< 0x000070b4      b 0x70b8
│      ││   ; CODE XREF from func.00007040 @ 0x70b4(x)
│      └──> 0x000070b8      ldr x0, [instance]                         ; void *instance
│       │   0x000070bc      str x0, [var_1d8h]
│       │   0x000070c0      stur x0, [x29, -0x80]
│       │   0x000070c4      adrp x8, sym.__PROTOCOLS__TtC10MASTestApp19InsecureUserSession ; 0x28000
│       │   0x000070c8      ldr x1, [x8, 0x408]                        ; [0x28408:8]=0x1a36e str.setRequiresSecureCoding: ; "n\xa3\x01" ; char *selector
│       │   0x000070cc      mov w8, 0
│       │   0x000070d0      and w2, w8, 1
│       │   0x000070d4      bl sym.imp.objc_msgSend                    ; void *objc_msgSend(void *instance, char *selector)
│       │   0x000070d8      adrp x8, segment.__DATA_CONST              ; 0x24000
│       │   0x000070dc      ldr x8, [x8, 0x170]                        ; [0x24170:8]=0
│       │                                                              ; reloc.NSKeyedArchiveRootObjectKey
│       │   0x000070e0      ldr x0, [x8]
│       │   0x000070e4      str x0, [var_1d0h]
│       │   0x000070e8      adrp x8, segment.__DATA_CONST              ; 0x24000
│       │   0x000070ec      ldr x8, [x8, 0x1a0]                        ; [0x241a0:8]=0
│       │                                                              ; reloc.objc_retain
│       │   0x000070f0      blr x8
│       │   0x000070f4      ldr x0, [var_1d0h]
│       │   0x000070f8      bl sym.imp.Foundation_...nconditionallyBridgeFromObjectiveCySSSo8NSStringCSgFZ_ ; Foundation(...nconditionallyBridgeFromObjectiveCySSSo8NSStringCSgFZ)
│       │   0x000070fc      str x1, [arg0]
│       │   0x00007100      bl sym.imp.Foundationbool_...ridgeToObjectiveCSo8NSStringCyF_ ; Foundationbool(...ridgeToObjectiveCSo8NSStringCyF)
│       │   0x00007104      mov x1, x0
│       │   0x00007108      ldr x0, [arg0]                             ; void *arg0
│       │   0x0000710c      str x1, [var_1e0h]
│       │   0x00007110      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│       │   0x00007114      ldr x0, [var_1d0h]
│       │   0x00007118      adrp x8, segment.__DATA_CONST              ; 0x24000
│       │   0x0000711c      ldr x8, [x8, 0x198]                        ; [0x24198:8]=0
│       │                                                              ; reloc.objc_release
│       │   0x00007120      blr x8
│       │   0x00007124      ldr x0, [var_1d8h]                         ; void *instance
│       │   0x00007128      ldr x2, [var_1e0h]
│       │   0x0000712c      adrp x8, sym.__PROTOCOLS__TtC10MASTestApp19InsecureUserSession ; 0x28000
│       │   0x00007130      ldr x1, [x8, 0x3e0]                        ; [0x283e0:8]=0x1a293 str.decodeObjectForKey: ; reloc.fixup.decodeObjectForKey: ; char *selector
│       │   0x00007134      bl sym.imp.objc_msgSend                    ; void *objc_msgSend(void *instance, char *selector)
│       │   0x00007138      mov x29, x29
│       │   0x0000713c      bl sym.imp.objc_retainAutoreleasedReturnValue ; void objc_retainAutoreleasedReturnValue(void *instance)
│       │   0x00007140      mov x8, x0
│       │   0x00007144      ldr x0, [var_1e0h]
│       │   0x00007148      str x8, [var_1e8h]
│       │   0x0000714c      adrp x8, segment.__DATA_CONST              ; 0x24000
│       │   0x00007150      ldr x8, [x8, 0x198]                        ; [0x24198:8]=0
│       │                                                              ; reloc.objc_release
│       │   0x00007154      blr x8
│       │   0x00007158      ldr x0, [var_1e8h]
│      ┌──< 0x0000715c      cbz x0, 0x719c
│     ┌───< 0x00007160      b 0x7164
│     │││   ; CODE XREF from func.00007040 @ 0x7160(x)
│     └───> 0x00007164      ldr x8, [var_1e8h]
│      ││   0x00007168      str x8, [var_1c0h]
│     ┌───< 0x0000716c      b 0x7170
│     │││   ; CODE XREF from func.00007040 @ 0x716c(x)
│     └───> 0x00007170      ldr x0, [var_1c0h]
│      ││   0x00007174      str x0, [var_1b8h]
│      ││   0x00007178      add x8, sp, 0x210
│      ││   0x0000717c      str x8, [var_1b0h]
│      ││   0x00007180      bl sym.imp._bridgeAnyObjectTo...B0yypyXlSgF
│      ││   0x00007184      ldr x0, [var_1b0h]                         ; int64_t arg1
│      ││   0x00007188      sub x1, x29, 0xc0                          ; int64_t arg2
│      ││   0x0000718c      bl sym....sypWOb                           ; func.000047a0
│      ││   0x00007190      ldr x0, [var_1b8h]
│      ││   0x00007194      bl sym.imp.swift_unknownObjectRelease
│     ┌───< 0x00007198      b 0x71b0
│     │││   ; CODE XREF from func.00007040 @ 0x715c(x)
│     │└──> 0x0000719c      stur xzr, [x29, -0xc0]
│     │ │   0x000071a0      stur xzr, [x29, -0xb8]
│     │ │   0x000071a4      stur xzr, [x29, -0xb0]
│     │ │   0x000071a8      stur xzr, [x29, -0xa8]
│     │┌──< 0x000071ac      b 0x71b0
│     │││   ; CODE XREFS from func.00007040 @ 0x7198(x), 0x71ac(x)
│     └└──> 0x000071b0      ldr x0, [var_1d8h]                         ; void *instance
│       │   0x000071b4      ldur q0, [x29, -0xc0]
│       │   0x000071b8      sub x8, x29, 0xa0
│       │   0x000071bc      str x8, [arg_1a8h]
│       │   0x000071c0      stur q0, [x29, -0xa0]
│       │   0x000071c4      ldur q0, [x29, -0xb0]
│       │   0x000071c8      stur q0, [x29, -0x90]
│       │   0x000071cc      adrp x8, sym.__PROTOCOLS__TtC10MASTestApp19InsecureUserSession ; 0x28000
│       │   0x000071d0      ldr x1, [x8, 0x410]                        ; [0x28410:8]=0x1a2ef str.finishDecoding ; reloc.fixup.finishDecoding ; char *selector
│       │   0x000071d4      bl sym.imp.objc_msgSend                    ; void *objc_msgSend(void *instance, char *selector)
│       │   0x000071d8      ldr x0, [arg_1a8h]                         ; int64_t arg1
│       │   0x000071dc      sub x1, x29, 0xe0                          ; int64_t arg2
│       │   0x000071e0      bl sym....sypSgWOc                         ; func.00009314
│       │   0x000071e4      ldur x8, [x29, -0xc8]
│      ┌──< 0x000071e8      cbz x8, 0x73c8
│     ┌───< 0x000071ec      b 0x71f0
│     │││   ; CODE XREF from func.00007040 @ 0x71ec(x)
│     └───> 0x000071f0      mov x0, 0
│      ││   0x000071f4      bl method.SecureUserSession.allocator_...a_ ; func.00008b18
│      ││   0x000071f8      mov x3, x0
│      ││   0x000071fc      add x0, sp, 0x230
│      ││   0x00007200      sub x1, x29, 0xe0
│      ││   0x00007204      adrp x8, segment.__DATA_CONST              ; 0x24000
│      ││   0x00007208      ldr x8, [x8, 0x8b8]                        ; [0x248b8:8]=0
│      ││                                                              ; reloc....ypN
│      ││   0x0000720c      add x2, x8, 8
│      ││   0x00007210      mov w8, 6
│      ││   0x00007214      mov x4, x8
│      ││   0x00007218      bl sym.imp.swift_dynamicCast
│     ┌───< 0x0000721c      tbz w0, 0, 0x7230
│    ┌────< 0x00007220      b 0x7224
│    ││││   ; CODE XREF from func.00007040 @ 0x7220(x)
│    └────> 0x00007224      ldr x8, [var_230h]
│     │││   0x00007228      str x8, [var_1a0h]
│    ┌────< 0x0000722c      b 0x723c
│    ││││   ; CODE XREF from func.00007040 @ 0x721c(x)
│    │└───> 0x00007230      mov x8, 0
│    │ ││   0x00007234      str x8, [var_1a0h]
│    │┌───< 0x00007238      b 0x723c
│    ││││   ; CODE XREFS from func.00007040 @ 0x722c(x), 0x7238(x)
│    └└───> 0x0000723c      ldr x8, [var_1a0h]
│      ││   0x00007240      str x8, [var_198h]
│     ┌───< 0x00007244      b 0x7248
│     │││   ; CODE XREFS from func.00007040 @ 0x7244(x), 0x73d8(x)
│    ┌└───> 0x00007248      ldr x8, [var_198h]
│    ╎ ││   0x0000724c      str x8, [var_190h]
│    ╎┌───< 0x00007250      cbz x8, 0x73dc
│   ┌─────< 0x00007254      b 0x7258
│   │╎│││   ; CODE XREF from func.00007040 @ 0x7254(x)
│   └─────> 0x00007258      ldr x8, [var_190h]
│    ╎│││   0x0000725c      str x8, [var_188h]
│   ┌─────< 0x00007260      b 0x7264
│   │╎│││   ; CODE XREF from func.00007040 @ 0x7260(x)
│   └─────> 0x00007264      ldr x8, [var_188h]
│    ╎│││   0x00007268      str x8, [var_160h]
│    ╎│││   0x0000726c      str x8, [var_258h]
│    ╎│││   0x00007270      mov w8, 0x62                               ; 'b'
│    ╎│││   0x00007274      mov x0, x8
│    ╎│││   0x00007278      mov w8, 1
│    ╎│││   0x0000727c      mov x1, x8
│    ╎│││   0x00007280      bl sym.imp.DefaultStringInterpolation.literalCapacity.interpolationCount_...itcfC_ ; DefaultStringInterpolation.literalCapacity.interpolationCount(...itcfC)
│    ╎│││   0x00007284      add x20, sp, 0x248                         ; "__const"
│    ╎│││   0x00007288      str x20, [var_148h]
│    ╎│││   0x0000728c      str x0, [var_248h]
│    ╎│││   0x00007290      str x1, [arg_180h]
│    ╎│││   0x00007294      adrp x0, sym.imp.swift_getOpaqueTypeConformance2 ; 0x1a000
│    ╎│││   0x00007298      add x0, x0, 0x610                          ; 0x1a610 ; "Decoding instantiated CachedDocument and ran its initializer, which wrote '"
│    ╎│││   0x0000729c      mov w8, 0x4b                               ; 'K'
│    ╎│││   0x000072a0      mov x1, x8
│    ╎│││   0x000072a4      mov w8, 1
│    ╎│││   0x000072a8      str w8, [var_13ch]
│    ╎│││   0x000072ac      and w2, w8, 1
│    ╎│││   0x000072b0      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│    ╎│││   0x000072b4      str x1, [arg_2b8h]
│    ╎│││   0x000072b8      bl sym.imp.DefaultStringInterpolation.appendLiteral_...SSF_ ; DefaultStringInterpolation.appendLiteral(...SSF)
│    ╎│││   0x000072bc      ldr x20, [var_148h]
│    ╎│││   0x000072c0      ldr x0, [arg_2b8h]                         ; void *arg0
│    ╎│││   0x000072c4      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│    ╎│││   0x000072c8      ldr x8, [var_160h]
│    ╎│││   0x000072cc      adrp x9, sym.__PROTOCOLS__TtC10MASTestApp19InsecureUserSession ; 0x28000
│    ╎│││   0x000072d0      ldr x9, [x9, 0x780]                        ; [0x28780:8]=8
│    ╎│││                                                              ; field.class.CachedDocument.var.fileName
│    ╎│││                                                              MASTestApp.CachedDocument.fileName.allocator__Swift.String__String: allocator, fileName__String: allocator, S.pWvd
│    ╎│││   0x000072d4      add x8, x8, x9
│    ╎│││   0x000072d8      ldr x9, [x8]
│    ╎│││   0x000072dc      str x9, [var_120h]
│    ╎│││   0x000072e0      ldr x0, [x8, 8]                            ; void *arg0
│    ╎│││   0x000072e4      str x0, [var_128h]
│    ╎│││   0x000072e8      bl sym.imp.swift_bridgeObjectRetain        ; void *swift_bridgeObjectRetain(void *arg0)
│    ╎│││   0x000072ec      ldr x9, [var_120h]
│    ╎│││   ; DATA XREF from func.00014528 @ 0x14830(r)
│    ╎│││   0x000072f0      ldr x8, [var_128h]
│    ╎│││   0x000072f4      add x0, sp, 0x238
│    ╎│││   0x000072f8      str x0, [arg_2a0h]
│    ╎│││   0x000072fc      str x9, [arg_198h]
│    ╎│││   0x00007300      str x8, [var_240h]
│    ╎│││   0x00007304      adrp x1, segment.__DATA_CONST              ; 0x24000
│    ╎│││   0x00007308      ldr x1, [x1, 0x690]                        ; [0x24690:8]=0
│    ╎│││                                                              ; reloc....SSN
│    ╎│││   0x0000730c      adrp x2, segment.__DATA_CONST              ; 0x24000
│    ╎│││   0x00007310      ldr x2, [x2, 0x6b8]
│    ╎│││   0x00007314      adrp x3, segment.__DATA_CONST              ; 0x24000
│    ╎│││   0x00007318      ldr x3, [x3, 0x6b0]                        ; [0x246b0:8]=0
│    ╎│││                                                              ; reloc.TextOutputStreamable.setter_...P_
│    ╎│││   0x0000731c      bl sym.imp.DefaultStringInterpolation.append...C0yyxs06CustomB11ConvertibleRzs20TextOutputStreamableRzlF
│    ╎│││   0x00007320      ldr x20, [var_148h]
│    ╎│││   0x00007324      ldr x0, [arg_2a0h]                         ; int64_t arg1
│    ╎│││   0x00007328      bl sym....sSSWOh                           ; func.00008a08
│    ╎│││   0x0000732c      ldr w8, [var_13ch]
│    ╎│││   0x00007330      adrp x0, sym.imp.swift_getOpaqueTypeConformance2 ; 0x1a000
│    ╎│││   0x00007334      add x0, x0, 0x660                          ; 0x1a660 ; "' into the app sandbox."
│    ╎│││   0x00007338      mov w9, 0x17
│    ╎│││   0x0000733c      mov x1, x9
│    ╎│││   0x00007340      and w2, w8, 1
│    ╎│││   0x00007344      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│    ╎│││   0x00007348      str x1, [var_140h]
│    ╎│││   0x0000734c      bl sym.imp.DefaultStringInterpolation.appendLiteral_...SSF_ ; DefaultStringInterpolation.appendLiteral(...SSF)
│    ╎│││   0x00007350      ldr x0, [var_140h]                         ; void *arg0
│    ╎│││   0x00007354      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│    ╎│││   0x00007358      ldr x8, [var_248h]                         ; [0x248:8]=0x74736e6f635f5f ; "__const"
│    ╎│││   0x0000735c      str x8, [arg_278h]
│    ╎│││   0x00007360      ldr x0, [arg_180h]                         ; void *arg0
│    ╎│││   0x00007364      str x0, [arg_280h]
│    ╎│││   0x00007368      bl sym.imp.swift_bridgeObjectRetain        ; void *swift_bridgeObjectRetain(void *arg0)
│    ╎│││   0x0000736c      ldr x0, [var_148h]                         ; void *arg1
│    ╎│││   0x00007370      bl sym....ss26DefaultStringInterpolationVWOh ; func.00009098
│    ╎│││   0x00007374      ldr x1, [arg_280h]
│    ╎│││   0x00007378      ldr x0, [arg_278h]
│    ╎│││   0x0000737c      bl sym.imp.stringInterpolation__String_...cfC_ ; stringInterpolation__String(...cfC)
│    ╎│││   0x00007380      mov x2, x0
│    ╎│││   0x00007384      ldr x0, [var_160h]
│    ╎│││   0x00007388      str x2, [var_168h]
│    ╎│││   0x0000738c      str x1, [var_170h]
│    ╎│││   0x00007390      adrp x8, segment.__DATA_CONST              ; 0x24000
│    ╎│││   0x00007394      ldr x8, [x8, 0x198]                        ; [0x24198:8]=0
│    ╎│││                                                              ; reloc.objc_release
│    ╎│││   0x00007398      blr x8
│    ╎│││   0x0000739c      sub x0, x29, 0xa0                          ; int64_t arg1
│    ╎│││   0x000073a0      bl sym....sypSgWOh                         ; func.00004708
│    ╎│││   0x000073a4      ldr x0, [var_1d8h]
│    ╎│││   0x000073a8      adrp x8, segment.__DATA_CONST              ; 0x24000
│    ╎│││   0x000073ac      ldr x8, [x8, 0x198]                        ; [0x24198:8]=0
│    ╎│││                                                              ; reloc.objc_release
│    ╎│││   0x000073b0      blr x8
│    ╎│││   0x000073b4      ldr x0, [var_168h]
│    ╎│││   0x000073b8      ldr x1, [var_170h]
│    ╎│││   0x000073bc      str x0, [arg_178h]
│    ╎│││   0x000073c0      str x1, [arg_180h]
│   ┌─────< 0x000073c4      b 0x7694
│   │╎│││   ; CODE XREF from func.00007040 @ 0x71e8(x)
│   │╎│└──> 0x000073c8      sub x0, x29, 0xe0                          ; int64_t arg1
│   │╎│ │   0x000073cc      bl sym....sypSgWOh                         ; func.00004708
│   │╎│ │   0x000073d0      mov x8, 0
│   │╎│ │   0x000073d4      str x8, [arg_198h]
│   │└────< 0x000073d8      b 0x7248
│   │ │ │   ; CODE XREF from func.00007040 @ 0x7250(x)
│   │ └───> 0x000073dc      sub x0, x29, 0xa0                          ; int64_t arg1
│   │   │   0x000073e0      add x1, sp, 0x2a0                          ; int64_t arg2
│   │   │   0x000073e4      bl sym....sypSgWOc                         ; func.00009314
│   │   │   0x000073e8      ldr x8, [arg_2b8h]
│   │  ┌──< 0x000073ec      cbz x8, 0x763c
│   │ ┌───< 0x000073f0      b 0x73f4
│   │ │││   ; CODE XREF from func.00007040 @ 0x73f0(x)
│   │ └───> 0x000073f4      add x0, sp, 0x2a0                          ; int64_t arg1
│   │  ││   0x000073f8      sub x1, x29, 0x100                         ; int64_t arg2
│   │  ││   0x000073fc      str x1, [arg_108h]
│   │  ││   0x00007400      bl sym....sypWOb                           ; func.000047a0
│   │  ││   0x00007404      ldr x0, [arg_108h]                         ; int64_t arg1
│   │  ││   0x00007408      add x1, sp, 0x280                          ; int64_t arg2
│   │  ││   0x0000740c      str x1, [arg_110h]
│   │  ││   0x00007410      bl sym....sypWOc                           ; func.00009384
│   │  ││   0x00007414      mov x0, 0
│   │  ││   0x00007418      bl sym.MASTestApp.InsecureUserSession.allocator_...a_ ; func.000041bc
│   │  ││   0x0000741c      ldr x1, [arg_110h]
│   │  ││   0x00007420      mov x3, x0
│   │  ││   0x00007424      add x0, sp, 0x278
│   │  ││   0x00007428      adrp x8, segment.__DATA_CONST              ; 0x24000
│   │  ││   0x0000742c      ldr x8, [x8, 0x8b8]                        ; [0x248b8:8]=0
│   │  ││                                                              ; reloc....ypN
│   │  ││   0x00007430      add x2, x8, 8
│   │  ││   0x00007434      mov w8, 6
│   │  ││   0x00007438      mov x4, x8
│   │  ││   0x0000743c      bl sym.imp.swift_dynamicCast
│   │ ┌───< 0x00007440      tbz w0, 0, 0x7454
│   │┌────< 0x00007444      b 0x7448
│   │││││   ; CODE XREF from func.00007040 @ 0x7444(x)
│   │└────> 0x00007448      ldr x8, [var_278h]
│   │ │││   0x0000744c      str x8, [var_100h]
│   │┌────< 0x00007450      b 0x7460
│   │││││   ; CODE XREF from func.00007040 @ 0x7440(x)
│   ││└───> 0x00007454      mov x8, 0
│   ││ ││   0x00007458      str x8, [var_100h]
│   ││┌───< 0x0000745c      b 0x7460
│   │││││   ; CODE XREFS from func.00007040 @ 0x7450(x), 0x745c(x)
│   │└└───> 0x00007460      ldr x8, [var_100h]
│   │  ││   0x00007464      str x8, [var_f8h]
│   │ ┌───< 0x00007468      cbz x8, 0x7524
│   │┌────< 0x0000746c      b 0x7470
│   │││││   ; CODE XREF from func.00007040 @ 0x746c(x)
│   │└────> 0x00007470      ldr x8, [var_f8h]
│   │ │││   0x00007474      str x8, [var_f0h]
│   │┌────< 0x00007478      b 0x747c
│   │││││   ; CODE XREF from func.00007040 @ 0x7478(x)
│   │└────> 0x0000747c      ldr x8, [var_f0h]
│   │ │││   0x00007480      str x8, [var_d8h]
│   │ │││   0x00007484      str x8, [var_260h]
│   │ │││   0x00007488      adrp x9, sym.__PROTOCOLS__TtC10MASTestApp19InsecureUserSession ; 0x28000
│   │ │││   0x0000748c      ldr x9, [x9, 0x750]                        ; [0x28750:8]=8
│   │ │││                                                              ; field.class.MASTestApp.InsecureUserSession.var.userID
│   │ │││                                                              [31] -rw- section size 1656 named 31.__DATA.__data
│   │ │││   0x00007490      add x8, x8, x9
│   │ │││   0x00007494      ldr x9, [x8]
│   │ │││   0x00007498      str x9, [var_c8h]
│   │ │││   0x0000749c      ldr x0, [x8, 8]                            ; void *arg0
│   │ │││   0x000074a0      str x0, [var_d0h]
│   │ │││   0x000074a4      bl sym.imp.swift_bridgeObjectRetain        ; void *swift_bridgeObjectRetain(void *arg0)
│   │ │││   0x000074a8      ldr x0, [var_c8h]                          ; int64_t arg1
│   │ │││   0x000074ac      ldr x1, [var_d0h]                          ; int64_t arg2
│   │ │││   0x000074b0      ldr x8, [var_d8h]
│   │ │││   0x000074b4      adrp x9, sym.__PROTOCOLS__TtC10MASTestApp19InsecureUserSession ; 0x28000
│   │ │││   0x000074b8      ldr x9, [x9, 0x758]                        ; [0x28758:8]=24
│   │ │││                                                              ; field.class.MASTestApp.InsecureUserSession.var.isAdmin
│   │ │││                                                              MASTestApp.InsecureUserSession.isAdmin.allocator__Bool: allocator, isAdmin: allocator, Sbool -> allocator
│   │ │││   0x000074bc      add x8, x8, x9
│   │ │││   0x000074c0      ldrb w8, [x8]
│   │ │││   0x000074c4      and w2, w8, 1
│   │ │││   0x000074c8      bl sym.MASTestApp.MastgTest.accessDecision._6E8AB2C58CE173A727EF27CB85DF8CD8.userID.isAdmin.S__...tFZ_ ; func.00007b60
│   │ │││   0x000074cc      mov x2, x0
│   │ │││   0x000074d0      ldr x0, [var_d0h]                          ; void *arg0
│   │ │││   0x000074d4      str x2, [var_e0h]
│   │ │││   0x000074d8      str x1, [var_e8h]
│   │ │││   0x000074dc      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│   │ │││   0x000074e0      ldr x0, [var_d8h]
│   │ │││   0x000074e4      adrp x8, segment.__DATA_CONST              ; 0x24000
│   │ │││   0x000074e8      ldr x8, [x8, 0x198]                        ; [0x24198:8]=0
│   │ │││                                                              ; reloc.objc_release
│   │ │││   0x000074ec      blr x8
│   │ │││   0x000074f0      sub x0, x29, 0x100                         ; int64_t arg1
│   │ │││   0x000074f4      bl sym.___swift_destroy_boxed_opaque_existential_0
│   │ │││   0x000074f8      sub x0, x29, 0xa0                          ; int64_t arg1
│   │ │││   0x000074fc      bl sym....sypSgWOh                         ; func.00004708
│   │ │││   0x00007500      ldr x0, [var_1d8h]
│   │ │││   0x00007504      adrp x8, segment.__DATA_CONST              ; 0x24000
│   │ │││   0x00007508      ldr x8, [x8, 0x198]                        ; [0x24198:8]=0
│   │ │││                                                              ; reloc.objc_release
│   │ │││   0x0000750c      blr x8
│   │ │││   0x00007510      ldr x0, [var_e0h]
│   │ │││   0x00007514      ldr x1, [var_e8h]
│   │ │││   0x00007518      str x0, [arg_178h]
│   │ │││   0x0000751c      str x1, [arg_180h]
│   │┌────< 0x00007520      b 0x7694
│   │││││   ; CODE XREF from func.00007040 @ 0x7468(x)
│   ││└───> 0x00007524      mov w8, 0x1d
│   ││ ││   0x00007528      mov x0, x8
│   ││ ││   0x0000752c      mov w8, 1
│   ││ ││   0x00007530      mov x1, x8
│   ││ ││   0x00007534      str x1, [var_80h]
│   ││ ││   0x00007538      bl sym.imp.DefaultStringInterpolation.literalCapacity.interpolationCount_...itcfC_ ; DefaultStringInterpolation.literalCapacity.interpolationCount(...itcfC)
│   ││ ││   0x0000753c      add x20, sp, 0x268
│   ││ ││   0x00007540      str x20, [var_98h]
│   ││ ││   0x00007544      str x0, [var_268h]
│   ││ ││   0x00007548      str x1, [var_270h]
│   ││ ││   0x0000754c      adrp x0, sym.imp.swift_getOpaqueTypeConformance2 ; 0x1a000
│   ││ ││   0x00007550      add x0, x0, 0x5f0                          ; 0x1a5f0 ; "Decoded an unexpected type:"
│   ││ ││   0x00007554      mov w8, 0x1c
│   ││ ││   0x00007558      mov x1, x8
│   ││ ││   0x0000755c      mov w8, 1
│   ││ ││   0x00007560      str w8, [var_8ch]
│   ││ ││   0x00007564      and w2, w8, 1
│   ││ ││   0x00007568      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│   ││ ││   0x0000756c      str x1, [var_70h]
│   ││ ││   0x00007570      bl sym.imp.DefaultStringInterpolation.appendLiteral_...SSF_ ; DefaultStringInterpolation.appendLiteral(...SSF)
│   ││ ││   0x00007574      ldr x20, [var_98h]
│   ││ ││   ; DATA XREF from func.00014b6c @ 0x14cd4(r)
│   ││ ││   0x00007578      ldr x0, [var_70h]                          ; void *arg0
│   ││ ││   0x0000757c      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│   ││ ││   0x00007580      sub x0, x29, 0x100                         ; int64_t arg1
│   ││ ││   0x00007584      str x0, [arg_b0h]
│   ││ ││   0x00007588      ldur x1, [x29, -0xe8]                      ; int64_t arg2
│   ││ ││   0x0000758c      str x1, [arg_78h]
│   ││ ││   0x00007590      bl sym.___swift_project_boxed_opaque_existential_0
│   ││ ││   0x00007594      ldr x1, [arg_78h]
│   ││ ││   0x00007598      ldr w8, [var_8ch]
│   ││ ││   0x0000759c      and w2, w8, 1
│   ││ ││   0x000075a0      bl sym.imp.swift_getDynamicType
│   ││ ││   0x000075a4      bl sym....ss26DefaultStringInterpolationV06appendC0yyypXpF ; func.00007b2c
│   ││ ││   0x000075a8      ldr x20, [var_98h]
│   ││ ││   0x000075ac      ldr x1, [var_80h]
│   ││ ││   0x000075b0      ldr w8, [var_8ch]
│   ││ ││   0x000075b4      adrp x0, sym.imp.swift_getOpaqueTypeConformance2 ; 0x1a000
│   ││ ││   0x000075b8      add x0, x0, 0x60d
│   ││ ││   0x000075bc      and w2, w8, 1
│   ││ ││   0x000075c0      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│   ││ ││   0x000075c4      str x1, [arg_90h]
│   ││ ││   0x000075c8      bl sym.imp.DefaultStringInterpolation.appendLiteral_...SSF_ ; DefaultStringInterpolation.appendLiteral(...SSF)
│   ││ ││   0x000075cc      ldr x0, [arg_90h]                          ; void *arg0
│   ││ ││   0x000075d0      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│   ││ ││   0x000075d4      ldr x8, [var_268h]
│   ││ ││   0x000075d8      str x8, [arg_a8h]
│   ││ ││   0x000075dc      ldr x0, [var_270h]                         ; void *arg0
│   ││ ││   0x000075e0      str x0, [arg_a0h]
│   ││ ││   0x000075e4      bl sym.imp.swift_bridgeObjectRetain        ; void *swift_bridgeObjectRetain(void *arg0)
│   ││ ││   0x000075e8      ldr x0, [var_98h]                          ; void *arg1
│   ││ ││   0x000075ec      bl sym....ss26DefaultStringInterpolationVWOh ; func.00009098
│   ││ ││   0x000075f0      ldr x1, [arg_a0h]
│   ││ ││   0x000075f4      ldr x0, [arg_a8h]
│   ││ ││   0x000075f8      bl sym.imp.stringInterpolation__String_...cfC_ ; stringInterpolation__String(...cfC)
│   ││ ││   0x000075fc      mov x2, x0
│   ││ ││   0x00007600      ldr x0, [arg_b0h]                          ; int64_t arg1
│   ││ ││   0x00007604      str x2, [arg_b8h]
│   ││ ││   0x00007608      str x1, [arg_c0h]
│   ││ ││   0x0000760c      bl sym.___swift_destroy_boxed_opaque_existential_0
│   ││ ││   0x00007610      sub x0, x29, 0xa0                          ; int64_t arg1
│   ││ ││   0x00007614      bl sym....sypSgWOh                         ; func.00004708
│   ││ ││   0x00007618      ldr x0, [var_1d8h]
│   ││ ││   0x0000761c      adrp x8, segment.__DATA_CONST              ; 0x24000
│   ││ ││   0x00007620      ldr x8, [x8, 0x198]                        ; [0x24198:8]=0
│   ││ ││                                                              ; reloc.objc_release
│   ││ ││   0x00007624      blr x8
│   ││ ││   0x00007628      ldr x0, [arg_b8h]
│   ││ ││   0x0000762c      ldr x1, [arg_c0h]
│   ││ ││   0x00007630      str x0, [arg_178h]
│   ││ ││   0x00007634      str x1, [arg_180h]
│   ││┌───< 0x00007638      b 0x7694
│   │││││   ; CODE XREF from func.00007040 @ 0x73ec(x)
│   │││└──> 0x0000763c      add x0, sp, 0x2a0                          ; int64_t arg1
│   │││ │   0x00007640      bl sym....sypSgWOh                         ; func.00004708
│   │││ │   0x00007644      adrp x0, sym.imp.swift_getOpaqueTypeConformance2 ; 0x1a000
│   │││ │   0x00007648      add x0, x0, 0x5d0                          ; 0x1a5d0 ; "Decoded no root object."
│   │││ │   0x0000764c      mov w8, 0x17
│   │││ │   0x00007650      mov x1, x8
│   │││ │   0x00007654      mov w8, 1
│   │││ │   0x00007658      and w2, w8, 1
│   │││ │   0x0000765c      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│   │││ │   0x00007660      str x0, [var_60h]
│   │││ │   0x00007664      str x1, [var_68h]
│   │││ │   0x00007668      sub x0, x29, 0xa0                          ; int64_t arg1
│   │││ │   0x0000766c      bl sym....sypSgWOh                         ; func.00004708
│   │││ │   0x00007670      ldr x0, [var_1d8h]
│   │││ │   0x00007674      adrp x8, segment.__DATA_CONST              ; 0x24000
│   │││ │   0x00007678      ldr x8, [x8, 0x198]                        ; [0x24198:8]=0
│   │││ │                                                              ; reloc.objc_release
│   │││ │   0x0000767c      blr x8
│   │││ │   0x00007680      ldr x0, [var_60h]
│   │││ │   0x00007684      ldr x1, [var_68h]
│   │││ │   0x00007688      str x0, [arg_178h]
│   │││ │   0x0000768c      str x1, [arg_180h]
│   │││┌──< 0x00007690      b 0x7694
│   │││││   ; CODE XREFS from func.00007040 @ 0x73c4(x), 0x7520(x), 0x7638(x), 0x7690(x), 0x77f8(x)
│  ┌└└└└──> 0x00007694      ldr x0, [var_178h]
│  ╎    │   0x00007698      ldr x1, [var_180h]
│  ╎    │   0x0000769c      add sp, sp, 0x3a0
│  ╎    │   0x000076a0      ldp x29, x30, [var_20h]
│  ╎    │   0x000076a4      ldp x20, x19, [var_10h]
│  ╎    │   0x000076a8      ldp x22, x21, [sp], 0x30
│  ╎    │   0x000076ac      ret
│  ╎    │   ; CODE XREF from func.00007040 @ 0x70b0(x)
│  ╎    └─> 0x000076b0      ldr x0, [var_208h]
│  ╎        0x000076b4      str x0, [var_48h]
│  ╎        0x000076b8      bl sym.imp.swift_errorRetain
│  ╎        0x000076bc      ldr x8, [var_48h]
│  ╎        0x000076c0      stur x8, [x29, -0x38]
│  ╎        0x000076c4      mov w8, 0x11
│  ╎        0x000076c8      mov x0, x8
│  ╎        0x000076cc      str x0, [var_8h]
│  ╎        0x000076d0      mov w8, 1
│  ╎        0x000076d4      mov x1, x8
│  ╎        0x000076d8      bl sym.imp.DefaultStringInterpolation.literalCapacity.interpolationCount_...itcfC_ ; DefaultStringInterpolation.literalCapacity.interpolationCount(...itcfC)
│  ╎        0x000076dc      mov x8, x1
│  ╎        0x000076e0      ldr x1, [var_8h]
│  ╎        0x000076e4      sub x20, x29, 0x48
│  ╎        0x000076e8      str x20, [arg_30h]
│  ╎        0x000076ec      stur x0, [x29, -0x48]
│  ╎        0x000076f0      stur x8, [x29, -0x40]
│  ╎        0x000076f4      adrp x0, sym.imp.swift_getOpaqueTypeConformance2 ; 0x1a000
│  ╎        0x000076f8      add x0, x0, 0x5b0                          ; 0x1a5b0 ; "Decoding failed:"
│  ╎        0x000076fc      mov w8, 1
│  ╎        0x00007700      str w8, [arg_24h]
│  ╎        0x00007704      and w2, w8, 1
│  ╎        0x00007708      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│  ╎        0x0000770c      str x1, [arg_10h]
│  ╎        0x00007710      bl sym.imp.DefaultStringInterpolation.appendLiteral_...SSF_ ; DefaultStringInterpolation.appendLiteral(...SSF)
│  ╎        0x00007714      ldr x0, [arg_10h]                          ; void *arg0
│  ╎        0x00007718      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│  ╎        0x0000771c      ldr x0, [var_48h]
│  ╎        0x00007720      sub x1, x29, 0x50
│  ╎        0x00007724      sub x2, x29, 0x68
│  ╎        0x00007728      bl sym.imp.swift_getErrorValue
│  ╎        0x0000772c      ldur x20, [x29, -0x68]
│  ╎        0x00007730      ldur x0, [x29, -0x60]
│  ╎        0x00007734      ldur x1, [x29, -0x58]
│  ╎        0x00007738      bl sym.imp.Error.Foundation.localizedDescription_...vg_ ; Error.Foundation.localizedDescription(...vg)
│  ╎        0x0000773c      ldr x20, [arg_30h]
│  ╎        0x00007740      mov x8, x0
│  ╎        0x00007744      sub x0, x29, 0x78
│  ╎        0x00007748      str x0, [arg_18h]
│  ╎        0x0000774c      stur x8, [x29, -0x78]
│  ╎        0x00007750      stur x1, [x29, -0x70]
│  ╎        0x00007754      adrp x1, segment.__DATA_CONST              ; 0x24000
│  ╎        0x00007758      ldr x1, [x1, 0x690]                        ; [0x24690:8]=0
│  ╎                                                                   ; reloc....SSN
│  ╎        0x0000775c      adrp x2, segment.__DATA_CONST              ; 0x24000
│  ╎        0x00007760      ldr x2, [x2, 0x6b8]
│  ╎        0x00007764      adrp x3, segment.__DATA_CONST              ; 0x24000
│  ╎        0x00007768      ldr x3, [x3, 0x6b0]                        ; [0x246b0:8]=0
│  ╎                                                                   ; reloc.TextOutputStreamable.setter_...P_
│  ╎        0x0000776c      bl sym.imp.DefaultStringInterpolation.append...C0yyxs06CustomB11ConvertibleRzs20TextOutputStreamableRzlF
│  ╎        0x00007770      ldr x20, [arg_30h]
│  ╎        0x00007774      ldr x0, [arg_18h]                          ; int64_t arg1
│  ╎        0x00007778      bl sym....sSSWOh                           ; func.00008a08
│  ╎        0x0000777c      ldr w8, [arg_24h]
│  ╎        0x00007780      adrp x0, sym.imp.swift_getOpaqueTypeConformance2 ; 0x1a000
│  ╎        0x00007784      add x0, x0, 0x920                          ; "__objc_classrefs__DATA_CONST"
│  ╎        0x00007788      mov x1, 0
│  ╎        0x0000778c      and w2, w8, 1
│  ╎        0x00007790      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│  ╎        0x00007794      str x1, [arg_28h]
│  ╎        0x00007798      bl sym.imp.DefaultStringInterpolation.appendLiteral_...SSF_ ; DefaultStringInterpolation.appendLiteral(...SSF)
│  ╎        0x0000779c      ldr x0, [arg_28h]                          ; void *arg0
│  ╎        0x000077a0      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│  ╎        0x000077a4      ldur x8, [x29, -0x48]
│  ╎        0x000077a8      str x8, [arg_40h]
│  ╎        0x000077ac      ldur x0, [x29, -0x40]                      ; void *arg0
│  ╎        0x000077b0      str x0, [arg_38h]
│  ╎        0x000077b4      bl sym.imp.swift_bridgeObjectRetain        ; void *swift_bridgeObjectRetain(void *arg0)
│  ╎        0x000077b8      ldr x0, [arg_30h]                          ; void *arg1
│  ╎        0x000077bc      bl sym....ss26DefaultStringInterpolationVWOh ; func.00009098
│  ╎        0x000077c0      ldr x1, [arg_38h]
│  ╎        0x000077c4      ldr x0, [arg_40h]
│  ╎        0x000077c8      bl sym.imp.stringInterpolation__String_...cfC_ ; stringInterpolation__String(...cfC)
│  ╎        0x000077cc      mov x2, x0
│  ╎        0x000077d0      ldr x0, [var_48h]
│  ╎        0x000077d4      str x2, [arg_50h]
│  ╎        0x000077d8      str x1, [arg_58h]
│  ╎        0x000077dc      bl sym.imp.swift_errorRelease
│  ╎        0x000077e0      ldr x0, [var_48h]
│  ╎        0x000077e4      bl sym.imp.swift_errorRelease
│  ╎        0x000077e8      ldr x0, [arg_50h]
│  ╎        0x000077ec      ldr x1, [arg_58h]
│  ╎        0x000077f0      str x0, [arg_178h]
│  ╎        0x000077f4      str x1, [arg_180h]
└  └──────< 0x000077f8      b 0x7694

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
            ; CALL XREF from func.000063d4 @ 0x65ac(x) ; sym.MASTestApp.MastgTest.mastg.completion_...FZ_
┌ 2360: sym.MASTestApp.MastgTest.importSharedSession.from.Foundation.URL...V_tFZ (int64_t arg1, int64_t arg_10h, int64_t arg_20h);
│ `- args(x0, sp[0x10..0x20]) vars(86:sp[0x8..0x2a0])
│           0x00006644      stp x22, x21, [var_30h]!                   ; MASTestApp.MastgTest.importSharedSession.from.Foundation.URL...V_tFZ
│           0x00006648      stp x20, x19, [var_10h]
│           0x0000664c      stp x29, x30, [var_20h]
│           0x00006650      add x29, sp, 0x20
│           0x00006654      sub sp, sp, 0x270
│           0x00006658      sub x8, x29, 0x20
│           0x0000665c      stur x0, [x8, -0x100]                      ; arg1
│           0x00006660      stur xzr, [x29, -0x28]
│           0x00006664      stur xzr, [x29, -0x30]
│           0x00006668      stur xzr, [x29, -0x40]
│           0x0000666c      stur xzr, [x29, -0x38]
│           0x00006670      stur xzr, [x29, -0x50]
│           0x00006674      stur xzr, [x29, -0x48]
│           0x00006678      mov x0, 0
│           0x0000667c      sub x8, x29, 0x40
│           0x00006680      stur x0, [x8, -0x100]
│           0x00006684      adrp x0, sym.__PROTOCOLS__TtC10MASTestApp19InsecureUserSession ; 0x28000
│           0x00006688      add x0, x0, 0x7b0                          ; int64_t arg1
│           0x0000668c      adrp x1, 0x1b000
│           0x00006690      add x1, x1, 0x9a0                          ; int64_t arg2
│           0x00006694      bl sym.___swift_instantiateConcreteTypeFromMangledNameV2
│           0x00006698      ldur x8, [x0, -8]                          ; [0x287a8:8]=0
│                                                                      ; sym....sS2SSysWL
│                                                                      ...sS2SSysWL
│           0x0000669c      ldr x8, [x8, 0x40]
│           0x000066a0      lsr x8, x8, 0
│           0x000066a4      add x8, x8, 0xf
│           0x000066a8      and x9, x8, 0xfffffffffffffff0
│           0x000066ac      sub x8, x29, 0x38
│           0x000066b0      stur x9, [x8, -0x100]
│           0x000066b4      adrp x16, segment.__DATA_CONST             ; 0x24000
│           0x000066b8      ldr x16, [x16, 0x1b0]                      ; [0x241b0:8]=0
│                                                                      ; reloc.__chkstk_darwin
│           0x000066bc      blr x16
│           0x000066c0      sub x8, x29, 0x38
│           0x000066c4      ldur x9, [x8, -0x100]
│           0x000066c8      mov x8, sp
│           0x000066cc      subs x0, x8, x9
│           0x000066d0      sub x8, x29, 0x30
│           0x000066d4      stur x0, [x8, -0x100]
│           0x000066d8      mov sp, x0
│           0x000066dc      adrp x0, sym.__PROTOCOLS__TtC10MASTestApp19InsecureUserSession ; 0x28000
│           0x000066e0      add x0, x0, 0x7b8                          ; int64_t arg1
│           0x000066e4      adrp x1, 0x1b000
│           0x000066e8      add x1, x1, 0x9a8                          ; int64_t arg2
│           0x000066ec      bl sym.___swift_instantiateConcreteTypeFromMangledNameV2
│           0x000066f0      ldur x8, [x0, -8]                          ; [0x287b0:8]=0
│                                                                      ; sym.Foundation.URLQueryItem:_GenericAccessorM__1
│                                                                      Foundation.URLQueryItem: GenericAccessorM
│           0x000066f4      ldr x8, [x8, 0x40]
│           0x000066f8      lsr x8, x8, 0
│           0x000066fc      add x8, x8, 0xf
│           0x00006700      and x9, x8, 0xfffffffffffffff0
│           0x00006704      sub x8, x29, 0x28
│           0x00006708      stur x9, [x8, -0x100]
│           0x0000670c      adrp x16, segment.__DATA_CONST             ; 0x24000
│           0x00006710      ldr x16, [x16, 0x1b0]                      ; [0x241b0:8]=0
│                                                                      ; reloc.__chkstk_darwin
│           0x00006714      blr x16
│           0x00006718      sub x8, x29, 0x28
│           0x0000671c      ldur x9, [x8, -0x100]
│           0x00006720      mov x8, sp
│           0x00006724      subs x0, x8, x9
│           0x00006728      stur x0, [x29, -0x100]
│           0x0000672c      mov sp, x0
│           0x00006730      mov x0, 0
│           0x00006734      bl sym.imp.Foundation.URLComponents...VMa
│           0x00006738      ldur x8, [x29, -0x100]
│           0x0000673c      mov x9, x0
│           0x00006740      sub x10, x29, 0x20
│           0x00006744      ldur x0, [x10, -0x100]
│           0x00006748      stur x9, [x29, -0xf0]
│           0x0000674c      ldur x9, [x9, -8]
│           0x00006750      sub x10, x29, 8
│           0x00006754      stur x9, [x10, -0x100]
│           0x00006758      ldr x9, [x9, 0x40]
│           0x0000675c      lsr x9, x9, 0
│           0x00006760      add x9, x9, 0xf
│           0x00006764      and x9, x9, 0xfffffffffffffff0
│           0x00006768      sub x10, x29, 0x18
│           0x0000676c      stur x9, [x10, -0x100]
│           0x00006770      adrp x16, segment.__DATA_CONST             ; 0x24000
│           0x00006774      ldr x16, [x16, 0x1b0]                      ; [0x241b0:8]=0
│                                                                      ; reloc.__chkstk_darwin
│           0x00006778      blr x16
│           0x0000677c      sub x9, x29, 0x18
│           0x00006780      ldur x10, [x9, -0x100]
│           0x00006784      mov x9, sp
│           0x00006788      subs x9, x9, x10
│           0x0000678c      sub x10, x29, 0x10
│           0x00006790      stur x9, [x10, -0x100]
│           0x00006794      mov sp, x9
│           0x00006798      stur x9, [x29, -0x28]
│           0x0000679c      mov x9, x0
│           0x000067a0      stur x9, [x29, -0x30]
│           0x000067a4      mov w9, 0
│           0x000067a8      mov w10, 1
│           0x000067ac      stur w10, [x29, -0xf4]
│           0x000067b0      and w1, w9, 1
│           0x000067b4      bl sym.imp.Foundation.URLComponents.url.resolvingAgainstBaseURL...A0G0Vh_SbtcfC
│           0x000067b8      sub x8, x29, 8
│           0x000067bc      ldur x8, [x8, -0x100]
│           0x000067c0      ldur x0, [x29, -0x100]
│           0x000067c4      ldur w1, [x29, -0xf4]
│           0x000067c8      ldur x2, [x29, -0xf0]
│           0x000067cc      ldr x8, [x8, 0x30]
│           0x000067d0      blr x8
│           0x000067d4      subs w8, w0, 1
│       ┌─< 0x000067d8      b.ne 0x67ec
│      ┌──< 0x000067dc      b 0x67e0
│      ││   ; CODE XREF from func.00006644 @ 0x67dc(x)
│      └──> 0x000067e0      ldur x0, [x29, -0x100]                     ; int64_t arg1
│       │   0x000067e4      bl sym.Foundation.URLComponents:_GenericAccessorW.bool____GenericAccessor ; func.00009030
│      ┌──< 0x000067e8      b 0x6f24
│      ││   ; CODE XREF from func.00006644 @ 0x67d8(x)
│      │└─> 0x000067ec      sub x8, x29, 0x10
│      │    0x000067f0      ldur x20, [x8, -0x100]
│      │    0x000067f4      ldur x2, [x29, -0xf0]
│      │    0x000067f8      ldur x1, [x29, -0x100]
│      │    0x000067fc      sub x8, x29, 8
│      │    0x00006800      ldur x8, [x8, -0x100]
│      │    0x00006804      ldr x8, [x8, 0x20]
│      │    0x00006808      mov x0, x20
│      │    0x0000680c      blr x8
│      │    0x00006810      bl sym.imp.Foundation.URLComponents.queryItems.URLQueryItem...VGSgvg
│      │    0x00006814      sub x8, x29, 0x48
│      │    0x00006818      stur x0, [x8, -0x100]
│      │┌─< 0x0000681c      cbz x0, 0x6838
│     ┌───< 0x00006820      b 0x6824
│     │││   ; CODE XREF from func.00006644 @ 0x6820(x)
│     └───> 0x00006824      sub x8, x29, 0x48
│      ││   0x00006828      ldur x8, [x8, -0x100]
│      ││   0x0000682c      sub x9, x29, 0x50
│      ││   0x00006830      stur x8, [x9, -0x100]
│     ┌───< 0x00006834      b 0x683c
│     │││   ; CODE XREF from func.00006644 @ 0x681c(x)
│    ┌──└─> 0x00006838      b 0x6f08
│    │││    ; CODE XREF from func.00006644 @ 0x6834(x)
│    │└───> 0x0000683c      sub x8, x29, 0x40
│    │ │    0x00006840      ldur x21, [x8, -0x100]
│    │ │    0x00006844      sub x8, x29, 0x50
│    │ │    0x00006848      ldur x8, [x8, -0x100]
│    │ │    0x0000684c      sub x20, x29, 0xe8
│    │ │    0x00006850      stur x8, [x29, -0xe8]
│    │ │    0x00006854      adrp x0, sym.__PROTOCOLS__TtC10MASTestApp19InsecureUserSession ; 0x28000
│    │ │    0x00006858      add x0, x0, 0x7c0                          ; int64_t arg1
│    │ │    0x0000685c      adrp x1, 0x1b000
│    │ │    0x00006860      add x1, x1, 0x9b0                          ; int64_t arg2
│    │ │    0x00006864      bl sym.___swift_instantiateConcreteTypeFromMangledNameV2
│    │ │    0x00006868      sub x8, x29, 0x58
│    │ │    0x0000686c      stur x0, [x8, -0x100]
│    │ │    0x00006870      bl sym....sSay10Foundation12URLQueryItemVGSayxGSTsWl ; func.00009138
│    │ │    0x00006874      sub x8, x29, 0x30
│    │ │    0x00006878      ldur x8, [x8, -0x100]
│    │ │    0x0000687c      sub x9, x29, 0x58
│    │ │    0x00006880      ldur x2, [x9, -0x100]
│    │ │    0x00006884      mov x3, x0
│    │ │    0x00006888      adrp x0, 0x6000
│    │ │    0x0000688c      add x0, x0, 0xf7c
│    │ │    0x00006890      mov x1, 0
│    │ │    0x00006894      bl sym.imp.first.where.Element_...KF_      ; first.where.Element(...KF)
│    │ │┌─< 0x00006898      cbnz x21, 0x6f78
│    │┌───< 0x0000689c      b 0x68a0
│    ││││   ; CODE XREF from func.00006644 @ 0x689c(x)
│    │└───> 0x000068a0      sub x0, x29, 0xe8                          ; void *arg1
│    │ ││   0x000068a4      bl sym....sSay10Foundation12URLQueryItemVGWOh ; func.000091ac
│    │ ││   0x000068a8      mov x0, 0
│    │ ││   0x000068ac      bl sym.imp.Foundation.URLQueryItem...VMa
│    │ ││   0x000068b0      mov x2, x0
│    │ ││   0x000068b4      sub x8, x29, 0x30
│    │ ││   0x000068b8      ldur x0, [x8, -0x100]
│    │ ││   0x000068bc      sub x8, x29, 0x68
│    │ ││   0x000068c0      stur x2, [x8, -0x100]
│    │ ││   0x000068c4      ldur x8, [x2, -8]
│    │ ││   0x000068c8      sub x9, x29, 0x60
│    │ ││   0x000068cc      stur x8, [x9, -0x100]
│    │ ││   0x000068d0      ldr x8, [x8, 0x30]
│    │ ││   0x000068d4      mov w1, 1
│    │ ││   0x000068d8      blr x8
│    │ ││   0x000068dc      subs w8, w0, 1
│    │┌───< 0x000068e0      b.ne 0x68f8
│   ┌─────< 0x000068e4      b 0x68e8
│   │││││   ; CODE XREF from func.00006644 @ 0x68e4(x)
│   └─────> 0x000068e8      sub x8, x29, 0x30
│    ││││   0x000068ec      ldur x0, [x8, -0x100]                      ; int64_t arg1
│    ││││   0x000068f0      bl sym.Foundation.URLQueryItem:_GenericAccessorW.bool____GenericAccessor ; func.000091d4
│   ┌─────< 0x000068f4      b 0x6f08
│   │││││   ; CODE XREF from func.00006644 @ 0x68e0(x)
│   ││└───> 0x000068f8      sub x8, x29, 0x30
│   ││ ││   0x000068fc      ldur x20, [x8, -0x100]
│   ││ ││   0x00006900      bl sym.imp.Foundation.URLQueryItem.value_...Sgvg_ ; Foundation.URLQueryItem.value(...Sgvg)
│   ││ ││   0x00006904      sub x8, x29, 0x60
│   ││ ││   0x00006908      ldur x8, [x8, -0x100]
│   ││ ││   0x0000690c      mov x2, x0
│   ││ ││   0x00006910      sub x9, x29, 0x30
│   ││ ││   0x00006914      ldur x0, [x9, -0x100]
│   ││ ││   0x00006918      sub x9, x29, 0x88
│   ││ ││   0x0000691c      stur x2, [x9, -0x100]
│   ││ ││   0x00006920      mov x2, x1
│   ││ ││   0x00006924      sub x9, x29, 0x68
│   ││ ││   0x00006928      ldur x1, [x9, -0x100]
│   ││ ││   0x0000692c      sub x9, x29, 0x80
│   ││ ││   0x00006930      stur x2, [x9, -0x100]
│   ││ ││   0x00006934      ldr x8, [x8, 8]
│   ││ ││   0x00006938      blr x8
│   ││ ││   0x0000693c      sub x8, x29, 0x88
│   ││ ││   0x00006940      ldur x9, [x8, -0x100]
│   ││ ││   0x00006944      sub x8, x29, 0x80
│   ││ ││   0x00006948      ldur x8, [x8, -0x100]
│   ││ ││   0x0000694c      sub x10, x29, 0x78
│   ││ ││   0x00006950      stur x9, [x10, -0x100]
│   ││ ││   0x00006954      sub x9, x29, 0x70
│   ││ ││   0x00006958      stur x8, [x9, -0x100]
│   ││┌───< 0x0000695c      b 0x6960
│   │││││   ; CODE XREFS from func.00006644 @ 0x695c(x), 0x6f20(x)
│  ┌──└───> 0x00006960      sub x8, x29, 0x78
│  ╎││ ││   0x00006964      ldur x9, [x8, -0x100]
│  ╎││ ││   0x00006968      sub x8, x29, 0x70
│  ╎││ ││   0x0000696c      ldur x8, [x8, -0x100]
│  ╎││ ││   0x00006970      sub x10, x29, 0x98
│  ╎││ ││   0x00006974      stur x8, [x10, -0x100]
│  ╎││ ││   0x00006978      sub x10, x29, 0x90
│  ╎││ ││   0x0000697c      stur x9, [x10, -0x100]
│  ╎││┌───< 0x00006980      cbz x8, 0x69ac
│ ┌───────< 0x00006984      b 0x6988
│ │╎│││││   ; CODE XREF from func.00006644 @ 0x6984(x)
│ └───────> 0x00006988      sub x8, x29, 0x90
│  ╎│││││   0x0000698c      ldur x9, [x8, -0x100]
│  ╎│││││   0x00006990      sub x8, x29, 0x98
│  ╎│││││   0x00006994      ldur x8, [x8, -0x100]
│  ╎│││││   0x00006998      sub x10, x29, 0xa8
│  ╎│││││   0x0000699c      stur x9, [x10, -0x100]
│  ╎│││││   0x000069a0      sub x9, x29, 0xa0
│  ╎│││││   0x000069a4      stur x8, [x9, -0x100]
│ ┌───────< 0x000069a8      b 0x69cc
│ │╎│││││   ; CODE XREF from func.00006644 @ 0x6980(x)
│ │╎││└───> 0x000069ac      ldur x1, [x29, -0xf0]
│ │╎││ ││   0x000069b0      sub x8, x29, 0x10
│ │╎││ ││   0x000069b4      ldur x0, [x8, -0x100]
│ │╎││ ││   0x000069b8      sub x8, x29, 8
│ │╎││ ││   0x000069bc      ldur x8, [x8, -0x100]
│ │╎││ ││   0x000069c0      ldr x8, [x8, 8]
│ │╎││ ││   0x000069c4      blr x8
│ │╎││┌───< 0x000069c8      b 0x6f24
│ │╎│││││   ; CODE XREF from func.00006644 @ 0x69a8(x)
│ └───────> 0x000069cc      sub x8, x29, 0xa8
│  ╎│││││   0x000069d0      ldur x9, [x8, -0x100]
│  ╎│││││   0x000069d4      sub x8, x29, 0xa0
│  ╎│││││   0x000069d8      ldur x8, [x8, -0x100]
│  ╎│││││   0x000069dc      sub x10, x29, 0xc8
│  ╎│││││   0x000069e0      stur x8, [x10, -0x100]
│  ╎│││││   0x000069e4      sub x10, x29, 0xc0
│  ╎│││││   0x000069e8      stur x9, [x10, -0x100]
│  ╎│││││   0x000069ec      stur x9, [x29, -0x40]
│  ╎│││││   0x000069f0      stur x8, [x29, -0x38]
│  ╎│││││   0x000069f4      bl sym.Foundation.Data.base64Encoded.options.NSDataBase64DecodingOptions...A0_ ; func.00007014
│  ╎│││││   0x000069f8      sub x8, x29, 0xc8
│  ╎│││││   0x000069fc      ldur x1, [x8, -0x100]
│  ╎│││││   0x00006a00      mov x2, x0
│  ╎│││││   0x00006a04      sub x8, x29, 0xc0
│  ╎│││││   0x00006a08      ldur x0, [x8, -0x100]
│  ╎│││││   0x00006a0c      bl sym.imp.Foundation.Data.base64Encoded.options.NSDataBase64DecodingOptions...VtcfC
│  ╎│││││   0x00006a10      sub x8, x29, 0xb8
│  ╎│││││   0x00006a14      stur x0, [x8, -0x100]
│  ╎│││││   0x00006a18      sub x8, x29, 0xb0
│  ╎│││││   0x00006a1c      stur x1, [x8, -0x100]
│  ╎│││││   0x00006a20      mov x9, -0x1000000000000000
│  ╎│││││   0x00006a24      and x8, x1, 0xf000000000000000
│  ╎│││││   0x00006a28      subs x8, x8, x9
│ ┌───────< 0x00006a2c      b.eq 0x6a58
│ ────────< 0x00006a30      b 0x6a34
│ │╎│││││   ; CODE XREF from func.00006644 @ 0x6a30(x)
│ ────────> 0x00006a34      sub x8, x29, 0xb0
│ │╎│││││   0x00006a38      ldur x8, [x8, -0x100]
│ │╎│││││   0x00006a3c      sub x9, x29, 0xb8
│ │╎│││││   0x00006a40      ldur x9, [x9, -0x100]
│ │╎│││││   0x00006a44      sub x10, x29, 0xd8
│ │╎│││││   0x00006a48      stur x9, [x10, -0x100]
│ │╎│││││   0x00006a4c      sub x9, x29, 0xd0
│ │╎│││││   0x00006a50      stur x8, [x9, -0x100]
│ ────────< 0x00006a54      b 0x6a84
│ │╎│││││   ; CODE XREF from func.00006644 @ 0x6a2c(x)
│ └───────> 0x00006a58      sub x8, x29, 0xc8
│  ╎│││││   0x00006a5c      ldur x0, [x8, -0x100]                      ; void *arg0
│  ╎│││││   0x00006a60      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│  ╎│││││   0x00006a64      sub x8, x29, 8
│  ╎│││││   0x00006a68      ldur x8, [x8, -0x100]
│  ╎│││││   0x00006a6c      sub x9, x29, 0x10
│  ╎│││││   0x00006a70      ldur x0, [x9, -0x100]
│  ╎│││││   0x00006a74      ldur x1, [x29, -0xf0]
│  ╎│││││   0x00006a78      ldr x8, [x8, 8]
│  ╎│││││   0x00006a7c      blr x8
│ ┌───────< 0x00006a80      b 0x6f24
│ │╎│││││   ; CODE XREF from func.00006644 @ 0x6a54(x)
│ ────────> 0x00006a84      sub x8, x29, 0xd8
│ │╎│││││   0x00006a88      ldur x9, [x8, -0x100]
│ │╎│││││   0x00006a8c      sub x8, x29, 0xd0
│ │╎│││││   0x00006a90      ldur x8, [x8, -0x100]
│ │╎│││││   0x00006a94      sub x10, x29, 0xf0
│ │╎│││││   0x00006a98      stur x8, [x10, -0x100]
│ │╎│││││   0x00006a9c      sub x10, x29, 0xe8
│ │╎│││││   0x00006aa0      stur x9, [x10, -0x100]
│ │╎│││││   0x00006aa4      stur x9, [x29, -0x50]
│ │╎│││││   0x00006aa8      stur x8, [x29, -0x48]
│ │╎│││││   0x00006aac      mov w8, 0x5c                               ; '\\'
│ │╎│││││   0x00006ab0      mov x0, x8
│ │╎│││││   0x00006ab4      mov w8, 4
│ │╎│││││   0x00006ab8      mov x1, x8
│ │╎│││││   0x00006abc      bl sym.imp.DefaultStringInterpolation.literalCapacity.interpolationCount_...itcfC_ ; DefaultStringInterpolation.literalCapacity.interpolationCount(...itcfC)
│ │╎│││││   0x00006ac0      sub x20, x29, 0x60
│ │╎│││││   0x00006ac4      stur x0, [x29, -0x60]
│ │╎│││││   0x00006ac8      stur x1, [x29, -0x58]
│ │╎│││││   0x00006acc      adrp x0, sym.imp.swift_getOpaqueTypeConformance2 ; 0x1a000
│ │╎│││││   0x00006ad0      add x0, x0, 0x540                          ; 0x1a540 ; "Imported a session from a deep link ("
│ │╎│││││   0x00006ad4      mov w8, 0x25                               ; '%'
│ │╎│││││   0x00006ad8      mov x1, x8
│ │╎│││││   0x00006adc      mov w8, 1
│ │╎│││││   0x00006ae0      and w2, w8, 1
│ │╎│││││   0x00006ae4      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│ │╎│││││   0x00006ae8      sub x8, x29, 0xe0
│ │╎│││││   0x00006aec      stur x1, [x8, -0x100]
│ │╎│││││   0x00006af0      bl sym.imp.DefaultStringInterpolation.appendLiteral_...SSF_ ; DefaultStringInterpolation.appendLiteral(...SSF)
│ │╎│││││   0x00006af4      sub x8, x29, 0x20
│ │╎│││││   0x00006af8      ldur x20, [x8, -0x100]
│ │╎│││││   0x00006afc      sub x8, x29, 0xe0
│ │╎│││││   0x00006b00      ldur x0, [x8, -0x100]                      ; void *arg0
│ │╎│││││   0x00006b04      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│ │╎│││││   0x00006b08      bl sym.imp.Foundation.URL.scheme_...Sgvg_  ; Foundation.URL.scheme(...Sgvg)
│ │╎│││││   0x00006b0c      stur x0, [x29, -0x80]
│ │╎│││││   0x00006b10      stur x1, [x29, -0x78]
│ │╎│││││   0x00006b14      ldur x8, [x29, -0x78]
│ ────────< 0x00006b18      cbz x8, 0x6b34
│ ────────< 0x00006b1c      b 0x6b20
│ │╎│││││   ; CODE XREF from func.00006644 @ 0x6b1c(x)
│ ────────> 0x00006b20      ldur x9, [x29, -0x80]
│ │╎│││││   0x00006b24      ldur x8, [x29, -0x78]
│ │╎│││││   0x00006b28      stur x9, [x29, -0x70]
│ │╎│││││   0x00006b2c      stur x8, [x29, -0x68]
│ ────────< 0x00006b30      b 0x6b60
│ │╎│││││   ; CODE XREF from func.00006644 @ 0x6b18(x)
│ ────────> 0x00006b34      adrp x0, sym.imp.swift_getOpaqueTypeConformance2 ; 0x1a000
│ │╎│││││   0x00006b38      add x0, x0, 0x920                          ; "__objc_classrefs__DATA_CONST"
│ │╎│││││   0x00006b3c      mov x1, 0
│ │╎│││││   0x00006b40      mov w8, 1
│ │╎│││││   0x00006b44      and w2, w8, 1
│ │╎│││││   0x00006b48      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│ │╎│││││   0x00006b4c      stur x0, [x29, -0x70]
│ │╎│││││   0x00006b50      stur x1, [x29, -0x68]
│ │╎│││││   0x00006b54      ldur x8, [x29, -0x78]
│ ────────< 0x00006b58      cbz x8, 0x6c0c
│ ────────< 0x00006b5c      b 0x6c10
│ │╎│││││   ; CODE XREFS from func.00006644 @ 0x6b30(x), 0x6c0c(x), 0x6c18(x)
│ ────────> 0x00006b60      ldur x9, [x29, -0x70]
│ │╎│││││   0x00006b64      ldur x8, [x29, -0x68]
│ │╎│││││   0x00006b68      sub x0, x29, 0x90
│ │╎│││││   0x00006b6c      sub x10, x29, 0x100
│ │╎│││││   0x00006b70      stur x0, [x10, -0x100]
│ │╎│││││   0x00006b74      stur x9, [x29, -0x90]
│ │╎│││││   0x00006b78      stur x8, [x29, -0x88]
│ │╎│││││   0x00006b7c      adrp x1, segment.__DATA_CONST              ; 0x24000
│ │╎│││││   0x00006b80      ldr x1, [x1, 0x690]                        ; [0x24690:8]=0
│ │╎│││││                                                              ; reloc....SSN
│ │╎│││││   0x00006b84      adrp x2, segment.__DATA_CONST              ; 0x24000
│ │╎│││││   0x00006b88      ldr x2, [x2, 0x6b8]
│ │╎│││││   0x00006b8c      adrp x3, segment.__DATA_CONST              ; 0x24000
│ │╎│││││   0x00006b90      ldr x3, [x3, 0x6b0]                        ; [0x246b0:8]=0
│ │╎│││││                                                              ; reloc.TextOutputStreamable.setter_...P_
│ │╎│││││   0x00006b94      sub x20, x29, 0x60
│ │╎│││││   0x00006b98      sub x8, x29, 0x108
│ │╎│││││   0x00006b9c      stur x20, [x8, -0x100]
│ │╎│││││   0x00006ba0      bl sym.imp.DefaultStringInterpolation.append...C0yyxs06CustomB11ConvertibleRzs20TextOutputStreamableRzlF
│ │╎│││││   0x00006ba4      sub x8, x29, 0x108
│ │╎│││││   0x00006ba8      ldur x20, [x8, -0x100]
│ │╎│││││   0x00006bac      sub x8, x29, 0x100
│ │╎│││││   0x00006bb0      ldur x0, [x8, -0x100]                      ; int64_t arg1
│ │╎│││││   0x00006bb4      bl sym....sSSWOh                           ; func.00008a08
│ │╎│││││   0x00006bb8      adrp x0, sym.imp.swift_getOpaqueTypeConformance2 ; 0x1a000
│ │╎│││││   0x00006bbc      add x0, x0, 0x566
│ │╎│││││   0x00006bc0      mov w8, 3
│ │╎│││││   0x00006bc4      mov x1, x8
│ │╎│││││   0x00006bc8      mov w8, 1
│ │╎│││││   0x00006bcc      and w2, w8, 1
│ │╎│││││   0x00006bd0      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│ │╎│││││   0x00006bd4      sub x8, x29, 0xf8
│ │╎│││││   0x00006bd8      stur x1, [x8, -0x100]
│ │╎│││││   0x00006bdc      bl sym.imp.DefaultStringInterpolation.appendLiteral_...SSF_ ; DefaultStringInterpolation.appendLiteral(...SSF)
│ │╎│││││   0x00006be0      sub x8, x29, 0x20
│ │╎│││││   0x00006be4      ldur x20, [x8, -0x100]
│ │╎│││││   0x00006be8      sub x8, x29, 0xf8
│ │╎│││││   0x00006bec      ldur x0, [x8, -0x100]                      ; void *arg0
│ │╎│││││   0x00006bf0      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│ │╎│││││   0x00006bf4      bl sym.imp.Foundation.URL.host_...Sgvg_    ; Foundation.URL.host(...Sgvg)
│ │╎│││││   0x00006bf8      stur x0, [x29, -0xb0]
│ │╎│││││   0x00006bfc      stur x1, [x29, -0xa8]
│ │╎│││││   0x00006c00      ldur x8, [x29, -0xa8]
│ ────────< 0x00006c04      cbz x8, 0x6c30
│ ────────< 0x00006c08      b 0x6c1c
│ │╎│││││   ; CODE XREF from func.00006644 @ 0x6b58(x)
│ ────────> 0x00006c0c      b 0x6b60
│ │╎│││││   ; CODE XREF from func.00006644 @ 0x6b5c(x)
│ ────────> 0x00006c10      sub x0, x29, 0x80                          ; void *arg1
│ │╎│││││   0x00006c14      bl sym....sSSSgWOh                         ; func.00008b3c
│ ────────< 0x00006c18      b 0x6b60
│ │╎│││││   ; CODE XREF from func.00006644 @ 0x6c08(x)
│ ────────> 0x00006c1c      ldur x9, [x29, -0xb0]
│ │╎│││││   0x00006c20      ldur x8, [x29, -0xa8]
│ │╎│││││   0x00006c24      stur x9, [x29, -0xa0]
│ │╎│││││   0x00006c28      stur x8, [x29, -0x98]
│ ────────< 0x00006c2c      b 0x6c5c
│ │╎│││││   ; CODE XREF from func.00006644 @ 0x6c04(x)
│ ────────> 0x00006c30      adrp x0, sym.imp.swift_getOpaqueTypeConformance2 ; 0x1a000
│ │╎│││││   0x00006c34      add x0, x0, 0x920                          ; "__objc_classrefs__DATA_CONST"
│ │╎│││││   0x00006c38      mov x1, 0
│ │╎│││││   0x00006c3c      mov w8, 1
│ │╎│││││   0x00006c40      and w2, w8, 1
│ │╎│││││   0x00006c44      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│ │╎│││││   0x00006c48      stur x0, [x29, -0xa0]
│ │╎│││││   0x00006c4c      stur x1, [x29, -0x98]
│ │╎│││││   0x00006c50      ldur x8, [x29, -0xa8]
│ ────────< 0x00006c54      cbz x8, 0x6ef8
│ ────────< 0x00006c58      b 0x6efc
│ │╎│││││   ; CODE XREFS from func.00006644 @ 0x6c2c(x), 0x6ef8(x), 0x6f04(x)
│ ────────> 0x00006c5c      ldur x9, [x29, -0xa0]
│ │╎│││││   0x00006c60      ldur x8, [x29, -0x98]
│ │╎│││││   0x00006c64      sub x0, x29, 0xc0
│ │╎│││││   0x00006c68      sub x10, x29, 0x190
│ │╎│││││   0x00006c6c      stur x0, [x10, -0x100]
│ │╎│││││   0x00006c70      stur x9, [x29, -0xc0]
│ │╎│││││   0x00006c74      stur x8, [x29, -0xb8]
│ │╎│││││   0x00006c78      adrp x1, segment.__DATA_CONST              ; 0x24000
│ │╎│││││   0x00006c7c      ldr x1, [x1, 0x690]                        ; [0x24690:8]=0
│ │╎│││││                                                              ; reloc....SSN
│ │╎│││││   0x00006c80      sub x8, x29, 0x160
│ │╎│││││   0x00006c84      stur x1, [x8, -0x100]
│ │╎│││││   0x00006c88      adrp x2, segment.__DATA_CONST              ; 0x24000
│ │╎│││││   0x00006c8c      ldr x2, [x2, 0x6b8]
│ │╎│││││   0x00006c90      sub x8, x29, 0x170
│ │╎│││││   0x00006c94      stur x2, [x8, -0x100]
│ │╎│││││   0x00006c98      adrp x3, segment.__DATA_CONST              ; 0x24000
│ │╎│││││   0x00006c9c      ldr x3, [x3, 0x6b0]                        ; [0x246b0:8]=0
│ │╎│││││                                                              ; reloc.TextOutputStreamable.setter_...P_
│ │╎│││││   0x00006ca0      sub x8, x29, 0x168
│ │╎│││││   0x00006ca4      stur x3, [x8, -0x100]
│ │╎│││││   0x00006ca8      sub x20, x29, 0x60
│ │╎│││││   0x00006cac      sub x8, x29, 0x140
│ │╎│││││   0x00006cb0      stur x20, [x8, -0x100]
│ │╎│││││   0x00006cb4      bl sym.imp.DefaultStringInterpolation.append...C0yyxs06CustomB11ConvertibleRzs20TextOutputStreamableRzlF
│ │╎│││││   0x00006cb8      sub x8, x29, 0x140
│ │╎│││││   0x00006cbc      ldur x20, [x8, -0x100]
│ │╎│││││   0x00006cc0      sub x8, x29, 0x190
│ │╎│││││   0x00006cc4      ldur x0, [x8, -0x100]                      ; int64_t arg1
│ │╎│││││   0x00006cc8      bl sym....sSSWOh                           ; func.00008a08
│ │╎│││││   0x00006ccc      adrp x0, sym.imp.swift_getOpaqueTypeConformance2 ; 0x1a000
│ │╎│││││   0x00006cd0      add x0, x0, 0x570                          ; 0x1a570 ; ").\n\nINSECURE (NSCoding):\n"
│ │╎│││││   0x00006cd4      mov w8, 0x19
│ │╎│││││   0x00006cd8      mov x1, x8
│ │╎│││││   0x00006cdc      mov w8, 1
│ │╎│││││   0x00006ce0      sub x9, x29, 0x14c
│ │╎│││││   0x00006ce4      stur w8, [x9, -0x100]
│ │╎│││││   0x00006ce8      and w2, w8, 1
│ │╎│││││   0x00006cec      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│ │╎│││││   0x00006cf0      sub x8, x29, 0x188
│ │╎│││││   0x00006cf4      stur x1, [x8, -0x100]
│ │╎│││││   0x00006cf8      bl sym.imp.DefaultStringInterpolation.appendLiteral_...SSF_ ; DefaultStringInterpolation.appendLiteral(...SSF)
│ │╎│││││   0x00006cfc      sub x8, x29, 0x140
│ │╎│││││   0x00006d00      ldur x20, [x8, -0x100]
│ │╎│││││   0x00006d04      sub x8, x29, 0x188
│ │╎│││││   0x00006d08      ldur x0, [x8, -0x100]                      ; void *arg0
│ │╎│││││   0x00006d0c      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│ │╎│││││   0x00006d10      sub x8, x29, 0xe8
│ │╎│││││   0x00006d14      ldur x0, [x8, -0x100]                      ; int64_t arg1
│ │╎│││││   0x00006d18      sub x8, x29, 0xf0
│ │╎│││││   0x00006d1c      ldur x1, [x8, -0x100]                      ; int64_t arg2
│ │╎│││││   0x00006d20      bl sym.MASTestApp.MastgTest.decodeInsecurely._6E8AB2C58CE173A727EF27CB85DF8CD8.Foundation.Data...VFZ ; func.00007040
│ │╎│││││   0x00006d24      sub x8, x29, 0x170
│ │╎│││││   0x00006d28      ldur x2, [x8, -0x100]
│ │╎│││││   0x00006d2c      sub x8, x29, 0x168
│ │╎│││││   0x00006d30      ldur x3, [x8, -0x100]
│ │╎│││││   0x00006d34      mov x9, x0
│ │╎│││││   0x00006d38      mov x8, x1
│ │╎│││││   0x00006d3c      sub x10, x29, 0x160
│ │╎│││││   0x00006d40      ldur x1, [x10, -0x100]
│ │╎│││││   0x00006d44      sub x0, x29, 0xd0
│ │╎│││││   0x00006d48      sub x10, x29, 0x180
│ │╎│││││   0x00006d4c      stur x0, [x10, -0x100]
│ │╎│││││   0x00006d50      stur x9, [x29, -0xd0]
│ │╎│││││   0x00006d54      stur x8, [x29, -0xc8]
│ │╎│││││   0x00006d58      bl sym.imp.DefaultStringInterpolation.append...C0yyxs06CustomB11ConvertibleRzs20TextOutputStreamableRzlF
│ │╎│││││   0x00006d5c      sub x8, x29, 0x140
│ │╎│││││   0x00006d60      ldur x20, [x8, -0x100]
│ │╎│││││   0x00006d64      sub x8, x29, 0x180
│ │╎│││││   0x00006d68      ldur x0, [x8, -0x100]                      ; int64_t arg1
│ │╎│││││   0x00006d6c      bl sym....sSSWOh                           ; func.00008a08
│ │╎│││││   0x00006d70      sub x8, x29, 0x14c
│ │╎│││││   0x00006d74      ldur w8, [x8, -0x100]
│ │╎│││││   0x00006d78      adrp x0, sym.imp.swift_getOpaqueTypeConformance2 ; 0x1a000
│ │╎│││││   0x00006d7c      add x0, x0, 0x590                          ; 0x1a590 ; "\n\nSECURE (NSSecureCoding):\n"
│ │╎│││││   0x00006d80      mov w9, 0x1b
│ │╎│││││   0x00006d84      mov x1, x9
│ │╎│││││   0x00006d88      and w2, w8, 1
│ │╎│││││   0x00006d8c      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│ │╎│││││   0x00006d90      sub x8, x29, 0x178
│ │╎│││││   0x00006d94      stur x1, [x8, -0x100]
│ │╎│││││   0x00006d98      bl sym.imp.DefaultStringInterpolation.appendLiteral_...SSF_ ; DefaultStringInterpolation.appendLiteral(...SSF)
│ │╎│││││   0x00006d9c      sub x8, x29, 0x140
│ │╎│││││   0x00006da0      ldur x20, [x8, -0x100]
│ │╎│││││   0x00006da4      sub x8, x29, 0x178
│ │╎│││││   0x00006da8      ldur x0, [x8, -0x100]                      ; void *arg0
│ │╎│││││   0x00006dac      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│ │╎│││││   0x00006db0      sub x8, x29, 0xe8
│ │╎│││││   0x00006db4      ldur x0, [x8, -0x100]                      ; int64_t arg1
│ │╎│││││   0x00006db8      sub x8, x29, 0xf0
│ │╎│││││   0x00006dbc      ldur x1, [x8, -0x100]                      ; int64_t arg2
│ │╎│││││   0x00006dc0      bl sym.MASTestApp.MastgTest.decodeSecurely._6E8AB2C58CE173A727EF27CB85DF8CD8.Foundation.Data...VFZ ; func.000077fc
│ │╎│││││   0x00006dc4      sub x8, x29, 0x170
│ │╎│││││   0x00006dc8      ldur x2, [x8, -0x100]
│ │╎│││││   0x00006dcc      sub x8, x29, 0x168
│ │╎│││││   0x00006dd0      ldur x3, [x8, -0x100]
│ │╎│││││   0x00006dd4      mov x9, x0
│ │╎│││││   0x00006dd8      mov x8, x1
│ │╎│││││   0x00006ddc      sub x10, x29, 0x160
│ │╎│││││   0x00006de0      ldur x1, [x10, -0x100]
│ │╎│││││   0x00006de4      sub x0, x29, 0xe0
│ │╎│││││   0x00006de8      sub x10, x29, 0x158
│ │╎│││││   0x00006dec      stur x0, [x10, -0x100]
│ │╎│││││   0x00006df0      stur x9, [x29, -0xe0]
│ │╎│││││   0x00006df4      stur x8, [x29, -0xd8]
│ │╎│││││   0x00006df8      bl sym.imp.DefaultStringInterpolation.append...C0yyxs06CustomB11ConvertibleRzs20TextOutputStreamableRzlF
│ │╎│││││   0x00006dfc      sub x8, x29, 0x140
│ │╎│││││   0x00006e00      ldur x20, [x8, -0x100]
│ │╎│││││   0x00006e04      sub x8, x29, 0x158
│ │╎│││││   0x00006e08      ldur x0, [x8, -0x100]                      ; int64_t arg1
│ │╎│││││   0x00006e0c      bl sym....sSSWOh                           ; func.00008a08
│ │╎│││││   0x00006e10      sub x8, x29, 0x14c
│ │╎│││││   0x00006e14      ldur w8, [x8, -0x100]
│ │╎│││││   0x00006e18      adrp x0, sym.imp.swift_getOpaqueTypeConformance2 ; 0x1a000
│ │╎│││││   0x00006e1c      add x0, x0, 0x920                          ; "__objc_classrefs__DATA_CONST"
│ │╎│││││   0x00006e20      mov x1, 0
│ │╎│││││   0x00006e24      and w2, w8, 1
│ │╎│││││   0x00006e28      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│ │╎│││││   0x00006e2c      sub x8, x29, 0x148
│ │╎│││││   0x00006e30      stur x1, [x8, -0x100]
│ │╎│││││   0x00006e34      bl sym.imp.DefaultStringInterpolation.appendLiteral_...SSF_ ; DefaultStringInterpolation.appendLiteral(...SSF)
│ │╎│││││   0x00006e38      sub x8, x29, 0x148
│ │╎│││││   0x00006e3c      ldur x0, [x8, -0x100]                      ; void *arg0
│ │╎│││││   0x00006e40      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│ │╎│││││   0x00006e44      ldur x8, [x29, -0x60]
│ │╎│││││   0x00006e48      sub x9, x29, 0x130
│ │╎│││││   0x00006e4c      stur x8, [x9, -0x100]
│ │╎│││││   0x00006e50      ldur x0, [x29, -0x58]                      ; void *arg0
│ │╎│││││   0x00006e54      sub x8, x29, 0x138
│ │╎│││││   0x00006e58      stur x0, [x8, -0x100]
│ │╎│││││   0x00006e5c      bl sym.imp.swift_bridgeObjectRetain        ; void *swift_bridgeObjectRetain(void *arg0)
│ │╎│││││   0x00006e60      sub x8, x29, 0x140
│ │╎│││││   0x00006e64      ldur x0, [x8, -0x100]                      ; void *arg1
│ │╎│││││   0x00006e68      bl sym....ss26DefaultStringInterpolationVWOh ; func.00009098
│ │╎│││││   0x00006e6c      sub x8, x29, 0x138
│ │╎│││││   0x00006e70      ldur x1, [x8, -0x100]
│ │╎│││││   0x00006e74      sub x8, x29, 0x130
│ │╎│││││   0x00006e78      ldur x0, [x8, -0x100]
│ │╎│││││   0x00006e7c      bl sym.imp.stringInterpolation__String_...cfC_ ; stringInterpolation__String(...cfC)
│ │╎│││││   0x00006e80      mov x2, x0
│ │╎│││││   0x00006e84      sub x8, x29, 0xe8
│ │╎│││││   0x00006e88      ldur x0, [x8, -0x100]                      ; void *arg1
│ │╎│││││   0x00006e8c      sub x8, x29, 0x128
│ │╎│││││   0x00006e90      stur x2, [x8, -0x100]
│ │╎│││││   0x00006e94      mov x2, x1                                 ; int64_t arg_30h
│ │╎│││││   0x00006e98      sub x8, x29, 0xf0
│ │╎│││││   0x00006e9c      ldur x1, [x8, -0x100]                      ; int64_t arg2
│ │╎│││││   0x00006ea0      sub x8, x29, 0x120
│ │╎│││││   0x00006ea4      stur x2, [x8, -0x100]
│ │╎│││││   0x00006ea8      bl sym.Foundation.Data._Representation_...Oe_ ; func.000090c0
│ │╎│││││   0x00006eac      sub x8, x29, 0xc8
│ │╎│││││   0x00006eb0      ldur x0, [x8, -0x100]                      ; void *arg0
│ │╎│││││   0x00006eb4      bl sym.imp.swift_bridgeObjectRelease       ; void swift_bridgeObjectRelease(void *arg0)
│ │╎│││││   0x00006eb8      sub x8, x29, 8
│ │╎│││││   0x00006ebc      ldur x8, [x8, -0x100]
│ │╎│││││   0x00006ec0      sub x9, x29, 0x10
│ │╎│││││   0x00006ec4      ldur x0, [x9, -0x100]
│ │╎│││││   0x00006ec8      ldur x1, [x29, -0xf0]
│ │╎│││││   0x00006ecc      ldr x8, [x8, 8]
│ │╎│││││   0x00006ed0      blr x8
│ │╎│││││   0x00006ed4      sub x8, x29, 0x128
│ │╎│││││   0x00006ed8      ldur x0, [x8, -0x100]
│ │╎│││││   0x00006edc      sub x8, x29, 0x120
│ │╎│││││   0x00006ee0      ldur x1, [x8, -0x100]
│ │╎│││││   0x00006ee4      sub x8, x29, 0x118
│ │╎│││││   0x00006ee8      stur x0, [x8, -0x100]
│ │╎│││││   0x00006eec      sub x8, x29, 0x110
│ │╎│││││   0x00006ef0      stur x1, [x8, -0x100]
│ ────────< 0x00006ef4      b 0x6f54
│ │╎│││││   ; CODE XREF from func.00006644 @ 0x6c54(x)
│ ────────> 0x00006ef8      b 0x6c5c
│ │╎│││││   ; CODE XREF from func.00006644 @ 0x6c58(x)
│ ────────> 0x00006efc      sub x0, x29, 0xb0                          ; void *arg1
│ │╎│││││   0x00006f00      bl sym....sSSSgWOh                         ; func.00008b3c
│ ────────< 0x00006f04      b 0x6c5c
│ │╎│││││   ; CODE XREFS from func.00006644 @ 0x6838(x), 0x68f4(x)
│ │╎└└────> 0x00006f08      mov x8, 0
│ │╎  │││   0x00006f0c      mov x9, x8
│ │╎  │││   0x00006f10      sub x10, x29, 0x78
│ │╎  │││   0x00006f14      stur x9, [x10, -0x100]
│ │╎  │││   0x00006f18      sub x9, x29, 0x70
│ │╎  │││   0x00006f1c      stur x8, [x9, -0x100]
│ │└──────< 0x00006f20      b 0x6960
│ │   │││   ; CODE XREFS from func.00006644 @ 0x67e8(x), 0x69c8(x), 0x6a80(x)
│ └───└└──> 0x00006f24      adrp x0, sym.imp.swift_getOpaqueTypeConformance2 ; 0x1a000
│       │   0x00006f28      add x0, x0, 0x4e0                          ; 0x1a4e0 ; "No session payload in the URL.\nExpected mastgtest://import?session=<base64 archive>."
│       │   0x00006f2c      mov w8, 0x54                               ; 'T'
│       │   0x00006f30      mov x1, x8
│       │   0x00006f34      mov w8, 1
│       │   0x00006f38      and w2, w8, 1
│       │   0x00006f3c      bl sym.imp._builtinStringLiteral.utf8CodeUnitCount.isASCII__String:_Builtin.Word__B_...cfC_ ; _builtinStringLiteral.utf8CodeUnitCount.isASCII__String: Builtin.Word, B(...cfC)
│       │   0x00006f40      sub x8, x29, 0x118
│       │   0x00006f44      stur x0, [x8, -0x100]
│       │   0x00006f48      sub x8, x29, 0x110
│       │   0x00006f4c      stur x1, [x8, -0x100]
│      ┌──< 0x00006f50      b 0x6f54
│      ││   ; CODE XREFS from func.00006644 @ 0x6ef4(x), 0x6f50(x)
│ ─────└──> 0x00006f54      sub x8, x29, 0x118
│       │   0x00006f58      ldur x0, [x8, -0x100]
│       │   0x00006f5c      sub x8, x29, 0x110
│       │   0x00006f60      ldur x1, [x8, -0x100]
│       │   0x00006f64      sub sp, x29, 0x20
│       │   0x00006f68      ldp x29, x30, [var_20h]
│       │   0x00006f6c      ldp x20, x19, [var_10h]
│       │   0x00006f70      ldp x22, x21, [sp], 0x30
│       │   0x00006f74      ret
│       │   ; CODE XREF from func.00006644 @ 0x6898(x)
└       └─> 0x00006f78      brk 1

Evaluation

The test fails because the app disables secure coding by passing 0 to setRequiresSecureCoding:. It then calls decodeObjectForKey: without an expected class or allowed class list. And, all of this is reachable from the mastgtest custom URL scheme import path, which an attacker can trigger with a crafted link.

Further reverse engineering shows how the vulnerable decode is reachable from a custom URL scheme payload:

flowchart TD
    A["mastgtest://import?session=BASE64"] --> B["importSharedSession, 0x00006644"]
    B --> C["Base64 decode, 0x000069f4 to 0x00006a0c"]
    C --> D["decodeInsecurely, 0x00007040"]
    D --> E["setRequiresSecureCoding false, 0x000070c8 to 0x000070d4"]
    E --> F["decodeObjectForKey, 0x00007130 to 0x00007134"]
    F --> G["Class named in archive is instantiated"]

The === Reachability from URL payload === section of output.txt traces MastgTest.importSharedSession(from:) (function at 0x00006644, full function in importSharedSession.asm):

  • It parses URL components, reads the session query item, Base64-decodes the value at 0x000069f4 to 0x00006a0c.
  • Then, it passes the resulting data to MastgTest.decodeInsecurely at 0x00006d20.

The === Consequence path === section of output.txt follows what a substituted CachedDocument does once instantiated:

  • Its initializer decodes fileName at 0x00005644 and contents at 0x00005818.
  • Then, it calls restoreToDisk at 0x00005a78 (function at 0x00005b14), which builds a file path with appendingPathComponent and writes the file at 0x00005e10.
flowchart TD
    A["Substituted class from archive"] --> B["init(coder:), 0x00005644"]
    B --> C["decode fileName and contents"]
    C --> D["restoreToDisk, 0x00005b14"]
    D --> E["write call, 0x00005e10"]

The secure decoding path is the contrast. The same URL import function also calls a separate secure decoder at 0x00006dc0. In that path, class restricted unarchiving is used for the expected session class, so a substituted archive is rejected before the substituted class initializer can run.