3

I'm looking at an Apple iOS binary file which is heavily protected and I trying to figure out if there's a way to get some of the information back.

When I open the binary in IDA I see this in the Imports Tab:

Address     |            Name                 |     Library
0002EFF0    |     lg8ZfjWOccD3RctMJwwU9b      |  /usr/lib/libstdc++.6.dylib
0002EFF4    |          4rqFsZJpPBx            |  /usr/lib/libz.1.dylib
0002EFF8    |     I0Lotzqwlr8UzNDPNddy5       |/System/Library/Frameworks/UIKit.framework/UIKit

etc...

I'm trying to figure out what is going on, appreciate if someone could tell me how this could happen, and it there's a way for me to resolve what functions are being used.

2

My guess would be that the packer/obfuscator does manual importing by scanning for dylibs in memory or maybe walking the dyld structures. The names in the import list are red herrings, and the fake imports are probably present only to ensure the loading of the required dylibs. you will have to analyze and/or debug the code to figure out how it really works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.