https://github.com/andyvand/class-dump

http://stevenygard.com/projects/class-dump

class-dump [options] <mach-o-file>

  -a             show instance variable offsets
  -A             show implementation addresses
  --arch <arch>  pick an architecture from a fat binary
                 (ppc, ppc64, i386, x86_64, armv6, armv7, armv7s, arm64)
  -C <regex>     only display classes matching regular expression
  -f <str>       find string in method name
  -H             generate per-class header files (use -o for output dir)
  -I             sort classes, categories, and protocols by inheritance
  -o <dir>       output directory used for -H
  -r             recursively expand frameworks and fixed VM shared libraries
  -s             sort classes and categories by name
  -S             sort methods by name
  -t             suppress header in output, for testing
  --list-arches  list the arches in the file, then exit
  --sdk-ios <v>  iOS SDK version to resolve frameworks against
  --sdk-mac <v>  macOS SDK version to resolve frameworks against
  --sdk-root <path>  full SDK root path

  --show-mach-header     dump the Mach-O header and exit
  --show-load-commands   dump the Mach-O load commands and exit
  --lipo-info            list architectures in a fat archive and exit

  --thin <arch>          extract a single architecture
  --out <file>           output path for write/extract operations
  --id <name>            set LC_ID_DYLIB (must fit in original space)
  --change OLD,NEW       rewrite LC_LOAD_DYLIB / LC_REEXPORT_DYLIB / etc.
  --rpath OLD,NEW        rewrite LC_RPATH
  --add-rpath <path>     add LC_RPATH (uses load command region slack)
  --delete-rpath <path>  delete LC_RPATH
  --strip-codesig        remove LC_CODE_SIGNATURE and trailing signature

  --dsc-info             print dyld_shared_cache header info
  --dsc-list-images      list all images in a dyld_shared_cache
  --dsc-extract DIR      extract every dylib from a cache to DIR
                         (uses Apple's dsc_extractor.bundle from Xcode)
  --with-cache FILE      use a cache to resolve selectors / type strings
                         when dumping cache-extracted dylibs
  --dsc-class-dump CACHE_OR_DIR --out OUTDIR
                         extract every dylib (or use already-extracted
                         dir) and class-dump each into OUTDIR/<install>/
  --dsc-image-timeout SEC  per-image wall-clock timeout (default 180s)
  --dsc-skip-existing    skip images whose output subdir is non-empty
  --dsc-in-process       run all images in-process (legacy; less robust)

  --list-fileset                       list LC_FILESET_ENTRY entries
  --extract-fileset NAME --out FILE    extract a fileset entry (raw slice)
  --fileset-class-dump --out OUTDIR    walk every LC_FILESET_ENTRY and dump
                                       per-kext headers into OUTDIR/<id>/.
                                       Without --cpp/--swift this emits the
                                       usual Objective-C header bundle;
                                       with --cpp it emits C++ headers
                                       reconstructed from each kext's
                                       LC_SYMTAB (kexts are mostly C++);
                                       with --swift it emits Swift
                                       extensions.

  --cpp     dump C++ classes from LC_SYMTAB Itanium-mangled symbols
  --swift   dump Swift extensions/types (mangled symbols demangled via
            libswiftCore)

  --scan-dir DIR    recursively pool type encodings from Mach-O files
                    under DIR so struct/union/protocol references in
                    the primary binary resolve to fuller definitions
                    (repeatable; pool images themselves are not emitted)
  --auto-scan       also scan the input's containing directory

  --decompile          run Ghidra headless over each dumped binary and
                       write a pseudo-C .c file next to the .h output
  --decompile-swift    same, but emits a .swift file containing only
                       Swift-mangled functions with names demangled by
                       Ghidra's Swift demangler (output is pseudo-C,
                       not real Swift source)
  --decompile-cpp      same, but emits a .cpp file containing only
                       Itanium-mangled C++ functions, with names
                       demangled and Itanium return/parameter types
                       applied before decompiling (so signatures carry
                       real types rather than Ghidra's `undefined`)

class-dump /System/Library/Frameworks/AppKit.framework

class-dump /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk/System/Library/Frameworks/UIKit.framework -r --sdk-ios 17.0

class-dump --dsc-info     /System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e
class-dump --dsc-list-images /System/Volumes/Preboot/Cryptexes/OS/System/Library/dyld/dyld_shared_cache_arm64e

class-dump --dsc-extract /tmp/cache-extracted /path/to/dyld_shared_cache_arm64e

class-dump --dsc-class-dump /path/to/dyld_shared_cache_arm64e \
           --out /tmp/dump --cpp --swift \
           --dsc-image-timeout 60 --decompile --decompile-cpp --decompile-swift

class-dump --list-fileset kernelcache.release.iphone16
class-dump --extract-fileset com.apple.driver.AppleH16 \
           kernelcache.release.iphone16 --out AppleH16.macho

class-dump --fileset-class-dump --cpp \
           --out /tmp/kcache-cpp kernelcache.release.iphone16

class-dump MyLib.dylib --id @rpath/MyLib.dylib --add-rpath @loader_path/../Frameworks --out MyLib.dylib.new

class-dump --strip-codesig fat.dylib --out fat.unsigned.dylib
class-dump --thin arm64 fat.unsigned.dylib --out arm64.dylib