长平狐 发布于 2012/08/13 15:44
阅读 117
收藏 0




Disassembling Private APIs on Mac OS X

There are several ways to reverse engineer private APIs on Mac OS X. For example, if you needed to know how a certain AppKit function was implemented, you could try some of the following.

To find APIs in a library:
nm -g /System/Library/Frameworks/AppKit.framework/AppKit
To generate headers of Objective-C classes in a library:
class-dump -H -o /AppKit_Headers /System/Library/Frameworks/AppKit.framework/AppKit 
To view the disassembly of a function:
gdb /Applications/
break -[NSApplication run]

To generate disassembly for an entire library:
otool -tV /System/Library/Frameworks/AppKit.framework/AppKit
I've recently also started using  otx. This works very similarly to otool but in addition it will annotate the assembly. The best part is that it will resolve Objective-C calls making it much easier to tell what a function is doing. Here's a sample output of otool (top) vs otx (bottom):
Until I discovered otx I had to trace Objective-C using the si/ni commands in gdb to figure out what a function was doing.