Black-box iOS application pentesting is a growing and hot topic. For most pentests, the most pain and effort is are consumed by the initial phases of the work, i.ei.e. basic mapping of the application features and where the individual features are implemented within the binary. We describe a MobileSubstrate based, semi-automatic approach for mapping security related features, such as encryption, jailbreak detection, keychain usage.