I am learning to disassemble and analyze objective-c binaries. One of my frustrations is that in Hopper, and IDA, it seems that the proper cross-references and control flow are not preserved. I believe this is because of Objective-C's message passing technique.
As you can see it is very hard to follow. Everything seems to coalesce on message send, with very little indication of where control flow actually begins. For instance, I am trying to determine what calls mk. Obviously it is being routed through message send, but where does the call originate? Of course, the cross references IDA provides seem to stop at any Objective-C function - making it hard to determine who is calling it.
I have tried this plugin: https://github.com/zynamics/objc-helper-plugin-ida
But it results in "nothing to patch."
Does IDA have a feature to help with this? How might I trace through this by hand if need be?
Some have already suggested that I just resolve this through dynamic analysis, but I'd prefer to understand the proper way to analyze it statically.