Reverse engineering Apple's OS X

A thunking good time

Boost IT visibility and business value

Mac Secrets A number of folks have asked me what tools and techniques I use to reverse engineer Cocoa executables. I thought it would be worth taking some time out from documenting undocumented APIs to show you how easy it is to do the same thing for yourself.

My number-one favorite tool is class-dump, a command-line utility written originally by Steve Nygard. You can feed an executable to class-dump, and it will print out all the Objective-C class declarations contained within the file. This information alone is often enough to get you started with an undocumented API.

But class-dump is not without its wrinkles. First, you need to be aware that class-dump can have problems with Objective-C 2.0 files. To fix that, there's a variant of class-dump available called class-dump-x. Just search online, and you'll find it. The latest version of class-dump is 3.1.2.

The next problem is that class-dump can get very confused if the executable contains any references to C++ classes, spewing out all sorts of junk to stderr. The workaround is simply to pipe class-dump's output to a file, separating the garbage from the class-declarations you want to see.

Finally, class-dump can get confused by certain "fat" binaries, especially recent ones that contain 64-bit executables. The workaround here is simply to use the lipo or ditto tools to create a single-architecture executable that class-dump will then accept. You can read more about class-dump here.

OK, you've got your class declarations, but you want to look at the code itself, right? Another favorite tool is otx, which you can find here.

You might already be familiar with otool, a command-line utility that's bundled with OS X. otool generates a code disassembly (either PowerPC or Intel) of a specified executable, but the output generated is not very user friendly. otx is effectively an "otool after-burner" that drastically improves the output of otool.

Amongst other things, it annotates the code listing by placing Objective-C style comments alongside method calls. If you're working with C++ code, otx will also try to "unmangle" C++ symbols to their original state. This is very useful when examining certain Apple frameworks such as CoreUI, much of which is implemented using C++. For more on CoreUI, see my earlier article here.

The essential guide to IT transformation

Next page: The Wrinkle

More from The Register

next story
Intel's Raspberry Pi rival Galileo can now run Windows
Behold the Internet of Things. Wintel Things
The Return of BSOD: Does ANYONE trust Microsoft patches?
Sysadmins, you're either fighting fires or seen as incompetents now
Munich considers dumping Linux for ... GULP ... Windows!
Give a penguinista a hug, the Outlook's not good for open source's poster child
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Eat up Martha! Microsoft slings handwriting recog into OneNote on Android
Freehand input on non-Windows kit for the first time
Linux kernel devs made to finger their dongles before contributing code
Two-factor auth enabled for Kernel.org repositories
prev story


5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.