Mac下的私有API私有函数扫描

Disassembling Private APIs on Mac OS X

There are several ways to reverse engineer private APIs on Mac OS X. For example, if you needed to know how a certain AppKit function was implemented, you could try some of the following.

To find APIs in a library:

nm -g /System/Library/Frameworks/AppKit.framework/AppKit

To generate headers of Objective-C classes in a library:

class-dump -H -o /AppKit_Headers /System/Library/Frameworks/AppKit.framework/AppKit 

To view the disassembly of a function:

gdb /Applications/Calculator.app/Contents/MacOS/Calculator
break -[NSApplication run]
run
disas

To generate disassembly for an entire library:

otool -tV /System/Library/Frameworks/AppKit.framework/AppKit

I've recently also started using  otx. This works very similarly to otool but in addition it will annotate the assembly. The best part is that it will resolve Objective-C calls making it much easier to tell what a function is doing. Here's a sample output of otool (top) vs otx (bottom):

Until I discovered otx I had to trace Objective-C using the si/ni commands in gdb to figure out what a function was doing.