competition-ios-runtime

1# Competition iOS Runtime
2 
3Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4 
5Use this skill when the decisive path runs through live iOS trust boundaries rather than static strings or plist values alone.
6 
7Reply in Simplified Chinese unless the user explicitly requests English.
8 
9## Quick Start
10 
111. Preserve the original IPA, extracted bundle, and any decrypted or re-signed copy as separate artifacts.
122. Start with `Info.plist`, entitlements, URL schemes, frameworks, Keychain usage, and local app storage before broad runtime hooks.
133. Choose the narrowest runtime boundary that proves behavior: signer, trust evaluator, Keychain accessor, Objective-C or Swift method, or network request builder.
144. Correlate static bundle evidence and live hook output before claiming the trust path is understood.
155. Reproduce the accepted request, token, or gated branch from the smallest hook set.
16 
17## Workflow
18 
19### 1. Static iOS Triage
20 
21- Map bundle structure, `Info.plist`, entitlements, URL schemes, universal links, embedded frameworks, and app group paths.
22- Record likely trust boundaries: request signers, device binding, certificate checks, jailbreak checks, Keychain access, or local cache loading.
23…