iPhone Static Code Analyzer
cocoa-touch, iphone, objective-c, static-analysis
Solution
Why care? You're not supposed to use private API for a good reason: Apple could easily break your application at any time, upsetting your users.
That said, use of NSInvocation, -performSelector: or any other similar technique is probably enough to avoid detection by a static analyzer.
Problem
A developing consensus among the iPhone developer community is that Apple has recently started using a static code analysis tool to detect use of undocumented API calls. Just for the sake of the argument, I wonder if it would be possible to work around this tool by generating the invocation at runtime like this: ``` NSString *const aMethod = @"doStuff:withStuff:"; SEL aSelector = NSSelectorFromString(aMethod); NSMethodSignature *aSignature = [targetObject methodSignatureForSelector:aSelector]; NSInvokation *anInvokation = [NSInvokation invocationWithMethodSignature:aSignature]; [anInvokation setTarget:targetObject]; [anInvokation setSelector:aSelector]; [anInvokation setArgument:&firstArg atIndex:2]; [anInvokation setArgument:&secondArg atIndex:3]; [anInvokation invoke]; ``` This almost seems too easy, so I wonder - what am I missing? How can Apple possibly detect this using static code analysis on the assembly? A couple of points: - I am aware that the method name will be stored in the binary as a static string. It would however be trivial to generate the method name at runtime as well using stringWithFormat: or other type of slight obfuscation (enough to confuse the static analyzer). - I know that this trick would be revealed by even the most trivial runtime analysis using gdb - my understanding has been that Apple analyses the binary itself, and maybe I'm completely wrong about that.