iOS Obfuscated Import Table

Question

I'm looking at an Apple iOS binary file which is heavily protected and I trying to figure out if there's a way to get some of the information back.

When I open the binary in IDA I see this in the Imports Tab:

Address     |            Name                 |     Library
0002EFF0    |     lg8ZfjWOccD3RctMJwwU9b      |  /usr/lib/libstdc++.6.dylib
0002EFF4    |          4rqFsZJpPBx            |  /usr/lib/libz.1.dylib
0002EFF8    |     I0Lotzqwlr8UzNDPNddy5       |/System/Library/Frameworks/UIKit.framework/UIKit

etc...

I'm trying to figure out what is going on, appreciate if someone could tell me how this could happen, and it there's a way for me to resolve what functions are being used.

Answer 1

My guess would be that the packer/obfuscator does manual importing by scanning for dylibs in memory or maybe walking the dyld structures. The names in the import list are red herrings, and the fake imports are probably present only to ensure the loading of the required dylibs. you will have to analyze and/or debug the code to figure out how it really works.