Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
How one can find all subroutine calls once an iOS app has been load into Hopper ?
If I understand correctly, a subroutine is identified by a unique address. So in the binary, all calls to this subroutine should point to this address. Thus, it should be possible to list all calls to this address, am I wrong ? It seems to be a simple things to look for, yet I cannot find anything about that elsewhere.
If I correctly understand your question, you are searching for the Cross References feature in Hopper.
Cross References (or simply XREFs) is a feature of disassemblers to show you where certain functions and objects were called from or which functions and objects are used by a specific function. We can simplify it by relate to it as XREF-To and XREF-From. The referenced can be either Data or Code.
XREFs are a valuable resource when we want to figure out exactly where a function was called from or what functions the current function calls. This, as you understand, can be quite useful, so we don’t have to iterate the stack for frame pointers to look for the function that called the current function or alternatively searching by hand for a CALLs to specific addresses.
In hopper disassembler you can can see XREFs-To addresses by pressing X while you mark the desired address. XREFs-From can be shown using Alt+X. Alternatively you can find the Cross References lists under Navigate in the Hopper's top toolbar.
You can also find the references to and from an adress by pressing Right Click on it and then choosing either "References to..." or "References from...".
Neverthless, when a program is analyzed, Hopper is adding a list of XREFs-From in the comments:
j_puts:
08048390 jmp dword [puts@GOT] ; puts@GOT,puts, CODE XREF=sub_8048662+15, sub_8048662+31, sub_8048662+86, sub_8048662+104
I'm not sure how it works on IOS or hopper but from my experience function calls can be obfuscated. I've seen values loaded into registers and then some algorithm is performed before a call is made to said register.
Ex. A function is located at VA 1000
I hope this helps a bit.
