Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Objective-C Code Obfuscation

Tags:

objective-c

Is there any way to obfuscate Objective-C Code ?

Thanks

like image 537
Biranchi Avatar asked Nov 13 '09 05:11

Biranchi


People also ask

How do you obfuscate in Objective C?

There is no easy way to do code obfuscation in Objective-C. It is possible, but be ready to be extremely limited in how you do your development. There are plenty of posts on the subject if you search for them on StackOverflow or your favorite search engine. You might wish to look at PPiOS-Rename.

What is CS obfuscation?

In software development, obfuscation is the deliberate act of creating source or machine code that is difficult for humans to understand. Like obfuscation in natural language, it may use needlessly roundabout expressions to compose statements.

Do iOS apps need obfuscation?

Code obfuscation has become a standard practice for iOS developers to prevent hackers from decompiling and reverse engineering code. Obfuscation can scramble the app's code (in various ways) to make it difficult to comprehend and analyze.


2 Answers

The selectors are still plaintext - otool -o will dump out all your objects and the methods they define. You can also dump out all internal and external selectors accessed in the code with a one-liner that follows. Obfuscating method and parameter names at the source level would probably be easiest, though doing it at the object level will also obfuscate in a language-independent way at the expense of some linker table manipulation.

otool -s __TEXT __objc_methname yourapp.app/executable_file |expand -8 | cut -c17- | sed -n '3,$p' | perl -n -e 'print join("\n",split(/\x00/,scalar reverse (reverse unpack("(a4)*",pack("(H8)*",split(/\s/,$_))))))'|less
like image 140
Robert Diamond Avatar answered Oct 14 '22 15:10

Robert Diamond


Objective c is a straight superset of C, therefore all normal C obfuscation techniques work. If you want to work with cocoa, however, you're going to have a bit of an obstacle because the method names are fairly self-documenting.

For your own methods, you just have to self-document the methods incorrectly. e.g.

-(void) doSomethingInnocent:(BOOL)animated withObject:passwords;

when you would normally have written:

-(void) sendObjectToMyServer:(BOOL)coverupAnimation;
like image 43
Kenny Winker Avatar answered Oct 14 '22 15:10

Kenny Winker