How to statically dump all ObjC methods called in a Cocoa App?

Question

Assume I have a Cocoa-based Mac or iOS app. I'd like to run a static analyzer on my app's source code or my app's binary to retrieve a list of all Objective-C methods called therein. Is there a tool that can do this?

A few points:

1. I am looking for a static solution. I am not looking for a dynamic solution.

2. Something which can be run against either a binary or source code is acceptable.

3. Ideally the output would just be a massive de-duped list of Objective-C methods like:

   …
   -[MyClass foo]
   …
   +[NSMutableString stringWithCapacity:]
   …
   -[NSString length]
   …
   

   (If it's not de-duped that's cool)

4. If other types of symbols (C functions, static vars, etc) are present, that is fine.

5. I'm familiar with class-dump, but AFAIK, it dumps the declared Classes in your binary, not the called methods in your binary. That's not what I'm looking for. If I am wrong, and you can do this with class-dump, please correct me.

6. I'm not entirely sure this is feasible. So if it's not, that's a good answer too. :)

Answer 1

The closest I'm aware of is otx, which is a wrapper around otool and can reconstruct the selectors at objc_msgSend() call sites.

http://otx.osxninja.com/

Answer 2

If you are asking for finding a COMPLETE list of all methods called then this is impossible, both statically and dynamically. The reason is that methods may be called in a variety of ways and even be dynamically and programmatically assembled.

In addition to regular method invocations using the Objective-C messages like [Object message] you can also dispatch messages using the C-API functions from objc/message.h, e.g. objc_msgSend(str, del). Or you can dispatch them using the NSInvocation API or with performSelector:withObject: (and similar methods), see the examples here. The selectors used in all these cases can be static strings or they can even be constructed programmatically from strings, using things like NSSelectorFromString.

To make matters worse Objective-C even supports dynamic message resolution which allows an object to respond to messages that do not correspond to methods at all!

If you are satisfied with only specific method invocations then parsing the source code for the patterns listed above will give you a minimal list of methods that may be called during execution. But the list may be both incomplete (i.e., not contain methods that may be called) as well as overcomplete (i.e., may contain methods that are not called in practice).