Ghidra

# Demangles Swift class, function, and variable names
# @author LaurieWired
# @category Swift

# NOTES:
# Requires Swift to be installed on the machine
# Takes some time to run for larger applications

from ghidra.program.model.listing import Function
from ghidra.program.model.symbol import SymbolType
from java.lang import System
import subprocess

def demangle_swift_name(mangled_name):
    os_name = System.getProperty("os.name").lower()
    
    if "mac" in os_name:
        cmd = 'xcrun swift-demangle --simplified --compact'
        mangled_name = "'{}'".format(mangled_name)
    else:
        cmd = 'swift-demangle --simplified --compact'
    
    proc = subprocess.Popen(cmd, shell=True, 
                          stdout=subprocess.PIPE, 
                          stdin=subprocess.PIPE)
    proc.stdin.write(mangled_name)
    proc.stdin.close()
    demangled = proc.stdout.read().strip()
    proc.wait()
    
    return demangled

# Detects whether an app is using swizzling and prints all references
# @author LaurieWired
# @category iOS

from ghidra.program.model.symbol import SymbolType

def find_swizzling():
    swizzling_methods = [
        "method_exchangeImplementations",
        "class_getInstanceMethod",
        "class_getClassMethod",
        "method_setImplementation"
    ]
    
    swizzling_symbols = []
    for symbol in currentProgram.getSymbolTable().getAllSymbols(True):
        if symbol.getSymbolType() == SymbolType.FUNCTION and \
           any(method in symbol.getName() for method in swizzling_methods):
            swizzling_symbols.append(symbol)
    
    if not swizzling_symbols:
        print("No swizzling found")
        return
    
    for swizzling_symbol in swizzling_symbols:
        references = list(currentProgram.getReferenceManager()
                        .getReferencesTo(swizzling_symbol.getAddress()))
        
        if not references:
            print("Swizzling method {} located at address {}, but had no references"
                  .format(swizzling_symbol.getName(), 
                         swizzling_symbol.getAddress()))
            continue
        
        print("Swizzling method {} located at address {}, with references:"
              .format(swizzling_symbol.getName(), 
                     swizzling_symbol.getAddress()))
        for ref in references:
            print("Address: {}".format(ref.getFromAddress()))

find_swizzling()