> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/ios-appsec/static-analysis/common-issues/application-binary.md). # Application Binary ### Insecure APIs Insecure APIs check - Binary Analysis * **Usage of Banned/Deprecated APIs** ``` _strcpy _strcat _strncat _strlen _alloca _printf _vsprintf _vsnprintf _sscanf _scanf _fopen _stat / _stat _memcpy _memmove _get _gets ``` * To check in binary, use this command * command ``` otool -I -v | grep -w "_strcat" otool -I -v | grep -w "_sscanf" ``` * Linux ``` llvm-otool-19 -I -v Payload/Myapp.app/Myapp | grep -Ei "_strcpy$|_strcat$|_strncat$|_strlen$|_alloca$|_printf$|_vsprintf$|_vsnprintf$|_sscanf$|_scanf$|_fopen$|_stat$|_stat$|_memcpy$|_memmove$|_get$|_gets$" ``` *** ### Insecure Functions * Insecure Malloc Function check - Binary Analysis (Insecure Memory Functions) * Insecure Random Function check - Binary Analysis (Insecure Random Functions) ``` otool -I -v | grep -w "_malloc" ``` * Linux ``` llvm-otool-19 -I -v Payload/Myapp.app/Myapp | grep "_malloc" ``` ``` llvm-otool-19 -I -v Payload/Myapp.app/Myapp | grep -Ei "_random|_srand|_rand" ``` or ``` strings Payload/Myapp.app/Myapp | grep -a "_malloc" strings Payload/Myapp.app/Myapp | grep -a "_random" strings Payload/Myapp.app/Myapp | grep -a "_rand" strings Payload/Myapp.app/Myapp | grep -a "_srand" ``` *** ### Check for weak hashing algorithms * command ``` otool -I -v | grep -w "_CC_MD5" otool -I -v | grep -w "_CC_SHA1" ``` * Linux ``` llvm-otool-19 -I -v Payload/Myapp.app/Myapp | grep -Ei "_CC_SHA1|_CC_MD5" ``` or ``` strings Payload/Myapp.app/Myapp | grep -a "_CC_MD5" ``` *** ### **Unencrypted Application Binary** ```bash otool -arch all -Vl Myapp.app/Myapp | grep -A5 LC_ENCRYPT ``` * Linux ``` llvm-otool-19 -arch all -Vl Myapp.app/Myapp | grep -A5 LC_ENCRYPT ``` You’d see output like: ``` Load command 21 cmd LC_ENCRYPTION_INFO_64 cmdsize 24 cryptoff 4096 cryptsize 16384 cryptid 1 ``` * `cryptid 1` → **Encrypted (FairPlay applied)** ✅ * `cryptid 0` → **Unencrypted** ⚠️ *** ### **Application binary compiled without `fobjc-arc` flag** *** ### Referance * * * *