Decompiling Objective-C libraries

Question

I've just finished a library in Objective-C that I compiled as a Static Library for distribution.

I'd wanted to know what chances to get this decompiled are out there.

• Do you know any software that can do this?
• If so, how could I protect me better?

EDIT: My static lib is made for iPhone / ARM

I created an algorithm that depending on the some parameters of the app, it can run as demo or as full code. You init the object with X variables and unlock the full version. I was wondering if they'll be able to see this algorithm so they can create a key generator.

Answer 1

It's not clear what you are trying to protect yourself from. Yes, it can be reverse engineered. The simplest tool is otool, part of the standard developer distribution:

otool -tV <library>

From that they run up to things like IDA Pro, which has iPhone support and is very nice for this kind of work. In between, I'm really surprised that I haven't seen a rework of otx for iPhone/ARM yet. I wouldn't be surprised to see one show up eventually. And of course there's gdb if you're trying to work out how things flow and what the data is at various points.

If you have more details about what you're trying to protect yourself from, there may be some targeted answers. Beyond that, read Chuck's comments.

Answer 2

If it executes, it can be decompiled. Objective-C is particularly easy to decompile into readable code thanks to its dynamic features. If you want to make things a little bit harder, you could write most of your code in plain C and strip the executable — which of course has the tradeoff of making your application design harder to manage. But be honest with yourself: If somebody wants to crack your code, you are not going to be able to stop them. Crackers have practically unlimited amounts of time and enthusiasm and will actually be excited by any novel efforts you put in to stop them. Nobody has yet made uncrackable software, and the biggest corporations in the world have tried. You're not going to do better than them, especially if you need to ask about it on Stack Overflow.

Take the time that you would have put into thwarting decompilation and use it to make your product better — that will have a much better ROI.

Answer 3

ChanceGetsDecompiled = ExpectedGainFromBeingDecompiled / PopularityOfLibrary

Well if you REALLY want to know I would try decompiling it your self. You don't say if this is for PPC, Intel, or ARM which makes a difference. Here is a decompiler for Intel i386 Decompiler

I don't know what you could do (I don't think there is much) to limit this. Code can always be reverse engineered. Be happy that your not using java or .net. Their decompilation is so nice.