CODEWITHSUNDEEP
macosreverse-engineeringidadtracehopper
hrishikesh chaudhari
hrishikesh chaudhari

Reputation: 906

How to find objective-c methods at runtime for any Application on Mac?

For ex- You have TextEdit Application, when you save the file , I want to know which objective-c methods get called. I have headers file of Textedit using class-dump.

Is there any is way to know which of these methods (which we output from class-dump) gets called at runtime?

is there any way to do it with dtrace??

Upvotes: 2

Views: 255

Answers (1)

Andrew Henle
Andrew Henle

Reputation: 1

Assuming Objective-C methods translate directly to user-space function calls, you should be able to use the DTrace pid provider:

The pid Provider

The pid provider enables you to trace any instruction in a process. Unlike most other providers, pid probes are created on demand, based on the probe descriptions found in your D programs.

User Function Boundary Tracing

The simplest mode of operation for the pid provider is as the user space analogue to the fbt provider. The following example program traces all function entries and returns that are made from a single function. The $1 macro variable expands to the first operand on the command line. This macro variable is the process ID for the process to trace. The $2 macro variable expands to the second operand on the command line. This macro variable is the name of the function that all function calls are traced from.

Example 4–3 userfunc.d: Trace User Function Entry and Return

pid$1::$2:entry
{
  self->trace = 1;
}

pid$1::$2:return
/self->trace/
{
  self->trace = 0;
}

pid$1:::entry,
pid$1:::return
/self->trace/
{
}

This script produces output that is similar to the following example:

# ./userfunc.d 15032 execute
dtrace: script './userfunc.d' matched 11594 probes
  0  -> execute                               
  0    -> execute                             
  0      -> Dfix                              
  0      <- Dfix                              
  0      -> s_strsave                         
  0        -> malloc                          
  0        <- malloc                          
  0      <- s_strsave                         
  0      -> set                               
  0        -> malloc                          
  0        <- malloc                          
  0      <- set                               
  0      -> set1                              
  0        -> tglob                           
  0        <- tglob                           
  0      <- set1                              
  0      -> setq                              
  0        -> s_strcmp                        
  0        <- s_strcmp                        
...

Upvotes: 0

Related Questions