Objective-C Binary API Call Detection via Metadata Slicing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static analysis of iOS applications in binary form is challenging due to the loss of symbol information during compilation, making it difficult to identify message-based API calls in Objective-C binaries, and existing methods are inefficient and prone to false negatives.
Innovation Solution
A method involving the extraction of metadata from Objective-C binaries, focusing on public API definitions, and using forward and backward slicing to identify 'objc_msgSend' calls, which allows for faster and more accurate detection of public API calls without resolving all 'objc_msgSend' calls, thereby improving the efficiency of application scanning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If static analysis is performed on Objective-C binaries, then application scanning can be conducted without source code, but symbol information is lost during compilation making API call identification difficult
Solution Approach 1:
The patent performs preliminary actions by extracting and analyzing metadata sections (_objc_selrefs, _objc_classrefs, _objc_imageinfo) from the binary before attempting to identify API calls. This preliminary extraction of available information structures enables subsequent identification of objc_msgSend calls and their arguments without requiring source code or symbol information.
Solution Approach 2:
The patent uses metadata sections as intermediary structures between the compiled binary and the original source code information. By analyzing these intermediary metadata sections that contain selector references, class references, and image information, the system can indirectly identify API calls despite the loss of direct symbol information during compilation.
2Measurement precision
If existing methods identify all objc_msgSend calls, then comprehensive API detection is achieved, but analysis time increases significantly
Solution Approach 1:
The patent extracts and focuses only on the critical metadata sections (_objc_selrefs, _objc_classrefs, and _objc_imageinfo) that are directly relevant to identifying public API calls. By extracting only this essential information rather than analyzing the entire binary or all objc_msgSend calls, the system achieves accurate API detection with significantly reduced analysis time.
Solution Approach 2:
The patent applies partial action by identifying a subset of objc_msgSend calls that are most likely to be public API calls, rather than exhaustively analyzing all objc_msgSend calls in the binary. This partial analysis approach focuses computational resources on the most relevant calls based on metadata patterns, achieving good detection accuracy with reduced time cost.
3Measurement precision
If comprehensive analysis of binary code is performed, then all API calls can be identified, but false negatives occur due to complexity
Solution Approach 1:
The patent segments the analysis process into distinct steps: first extracting metadata sections, then identifying objc_msgSend calls based on metadata patterns, and finally determining which calls represent public API invocations. This segmentation of the complex analysis into manageable segments reduces false negatives by systematically addressing each aspect of API identification rather than attempting a monolithic analysis.
Data Source
AI summary
Disclosed are various embodiments for fast and accurate identification of message-based application programming interface (API) calls in applications. A set of compliance rules is obtained from a compliance rule store. A request to analyze an application is received. An application analysis is performed by scanning the application to identify one or more public APIs invoked by the application. The set of compliance rules are enforced on the application based at least in part on the application analysis.