How find all subroutine calls using Hopper?

Question

How one can find all subroutine calls once an iOS app has been load into Hopper ?

If I understand correctly, a subroutine is identified by a unique address. So in the binary, all calls to this subroutine should point to this address. Thus, it should be possible to list all calls to this address, am I wrong ? It seems to be a simple things to look for, yet I cannot find anything about that elsewhere.

Answer 1

If I correctly understand your question, you are searching for the Cross References feature in Hopper.

Cross References

Cross References (or simply XREFs) is a feature of disassemblers to show you where certain functions and objects were called from or which functions and objects are used by a specific function. We can simplify it by relate to it as XREF-To and XREF-From. The referenced can be either Data or Code.

XREFs are a valuable resource when we want to figure out exactly where a function was called from or what functions the current function calls. This, as you understand, can be quite useful, so we don’t have to iterate the stack for frame pointers to look for the function that called the current function or alternatively searching by hand for a CALLs to specific addresses.

Hopper

In hopper disassembler you can can see XREFs-To addresses by pressing X while you mark the desired address. XREFs-From can be shown using Alt+X. Alternatively you can find the Cross References lists under Navigate in the Hopper's top toolbar. You can also find the references to and from an adress by pressing Right Click on it and then choosing either "References to..." or "References from...".

Neverthless, when a program is analyzed, Hopper is adding a list of XREFs-From in the comments:

  j_puts:
08048390   jmp   dword [puts@GOT]   ; puts@GOT,puts, CODE XREF=sub_8048662+15, sub_8048662+31, sub_8048662+86, sub_8048662+104

Answer 2

I'm not sure how it works on IOS or hopper but from my experience function calls can be obfuscated. I've seen values loaded into registers and then some algorithm is performed before a call is made to said register.

Ex. A function is located at VA 1000

1. Load value 100 into register1
2. Multiply register1 by 5
3. Add 500 to register1
4. Push arguments onto the stack
5. Call register1

I hope this helps a bit.