Teams looking for "iOS protection" often mix two jobs. Hardening tries to make a binary harder to reverse: anti-debug, integrity checks, string encryption aimed at attackers. Obfuscation changes how the program looks to another program or reviewer: names, layout, resources, and call stacks, so two builds are no longer obvious twins. Crab is built for the second job, at the compilation system, so you archive and submit without babysitting a rewritten source tree.
What hardening usually does
A typical hardening SDK injects a runtime that detects debuggers, encrypts a subset of strings, and maybe virtualizes a few functions. That can raise the cost of cracking. It does not automatically give you a new fingerprint for App Review. Two hardened builds from the same project still share class lists, asset names, and plugin folders unless you also rename those layers.
What compile-level obfuscation changes
Language obfuscation renames types, fields, and functions in C, C++, Objective-C, Swift, and Dart, and can expand source and encrypt constants. Call-stack obfuscation changes the shape of traces. Resource obfuscation renames files, breaks signatures, and encrypts payloads. A dual symbol table keeps a restorable dSYM so crash tools still work. An isolated runtime SDK means each package carries supporting bits that do not match the last customer’s build.
How to choose
If the problem is “this IPA looks like last month’s IPA or like our other listing”, start with obfuscation and honest store metadata. If the problem is “we need to raise the cost of dumping the binary”, talk about hardening as a separate layer. Running both without a plan can break reflection, Flutter channels, or crash symbolication. Crab’s exclusion lists exist so engine and plugin contracts stay stable. Read 4.3, FAQ, and the docs before you turn every switch on.
We do not treat obfuscation as a way to hide features from review. Guideline 2.3.1 still requires the listing to match the binary. Use the tool to separate characteristics and protect code, then submit a product that is what it says it is. Uni-app uses IPA hardening, not the Xcode-project confuse flow. IR-level protection (OLLVM-like) uses Crab Directed Hardening: Framework for an SDK, App for the main binary.
Request a trial, then archive and submit
Download App Center, choose the General or Uni-app edition, then apply for a license on the registration-code page. The docs cover the operator steps.