1

I am searching for a tool or a combination of tools that can be used for static analysis of closed-source iPhone apps. I am interested in building a control flow graph of these apps. So I am thinking of doing the following:

  • Decrypt the app, if required
  • Decompile/disassemble the app (for ex., the equivalent tool in Android would be ded: Decompiling Android Applications)
  • Construct a control flow graph from the disassembled source code (again, for Android, I could use a tool such as SOOT that works on Java files obtained after disassembly of Android apps)

I came across the following tools, but I am not sure which one of these would be appropriate.

For disassembly:

  • Interactive Disassembler - Some research projects have reported using it, but now it is commercial.
  • Hopper - Not sure whether this can produce output in a format other than assembly language

For static analysis:

My question is: what should be the right combination of the tools from the above two groups so that the output of disassembler can be used as the input to the static analyzer?

Note: One similar question to this is Objective-C static analysis tools — plugin to Xcode?. But the focus there was on a tool that could be used with Xcode and hence would be useful for developers who are writing iPhone apps. I am, however, interested in tools that can be used for analyzing iPhone apps whose source code may not be available.

Community
  • 1
  • 1
user541064
  • 333
  • 2
  • 7
  • Did you manage to find any useful tool for ios app to get the call-graphs either from static or dynamic analysis? – ramo May 23 '14 at 18:39

1 Answers1

0

You CANNOT get the real code using this disassembly apps.

gallileo
  • 462
  • 5
  • 21
  • Agreed. But my ultimate goal is not to obtain the real source code. All I am interested in is to build a control flow graph (CFG) of the app statically. As long as the output of the disassembler can be fed to a tool that can build CFG, that would suffice. Please see this paper where they used IDA Pro as the disassembler and wrote their own code to build CFG: http://www.syssec-project.eu/m/page-media/3/egele-ndss11.pdf . What I wonder is whether writing such code by myself is the only option. – user541064 Oct 10 '13 at 15:49