Identifying Message-Based API Calls in iOS Binaries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static analysis of iOS applications in Objective-C binaries is challenging due to the difficulty in translating machine code back to source code, as symbol information like variable types and names are stripped off during compilation, making it hard to identify message-based API calls efficiently.
Innovation Solution
The system employs a method to scan iOS applications by extracting and recognizing arguments of 'objc_msgSend' calls, using backward and forward slicing to locate static addresses and symbols, and focusing on public API definitions to differentiate between local and platform library calls, resulting in a faster and more accurate identification of public API calls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If machine code is directly analyzed, then analysis speed is improved, but measurement precision deteriorates due to loss of symbol information
Solution Approach 1:
The patent uses disassembled assembly code as an intermediary representation between machine code and source code. This allows static analysis to be performed on a form that retains symbolic information (variable names, function names, types) while still being derived from the compiled binary, thus resolving the contradiction between analysis speed and identification accuracy
Solution Approach 2:
The patent performs preliminary disassembly of machine code to assembly code before conducting static analysis. This preliminary action preserves symbol information that would be lost in direct machine code analysis, enabling more accurate identification of message-based API calls while maintaining efficiency through automated processing
2Reliability
If comprehensive static analysis is performed on all code, then identification completeness is improved, but productivity deteriorates due to high computational overhead
Solution Approach 1:
The patent extracts and focuses specifically on 'objc_msgSend' call arguments and public API definitions, rather than performing comprehensive analysis on all code. This selective extraction approach maintains identification completeness for message-based APIs while significantly improving analysis throughput by reducing computational overhead
Solution Approach 2:
The patent segments the analysis process into distinct phases: extracting objc_msgSend calls, identifying public API definitions, and matching them together. This segmentation allows each phase to be optimized independently, improving overall productivity while maintaining comprehensive identification through systematic coverage of each segment
Data Source
AI summary
Disclosed are various embodiments for fast and accurate identification of message-based application programming interface (API) calls in Objective-C binaries. An application binary is analyzed to determine a first listing of classes and a first listing of methods. Metadata is extracted from the application to determine a second listing of classes and a second listing of methods. A listing of external classes and a listing of external methods are determined. Data identifying public API definitions is obtained. Public APIs invoked by the application are determined by comparing the external classes and methods with the public API definitions.