Home/ Questions/Q 3403252
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-18T05:14:17+00:00

I read some info regarding getting .h files for undocumented API. Most of sources

  • 0

I read some info regarding getting .h files for undocumented API. Most of sources recommend class-dump (or class-dump-x and class-dump-z).

However it doesn’t work with iPhone Security.framework. It doesn’t contain Objective-C runtime information.

The only other way which I found is to use nm or otool. This will give the names of functions and disassembly for them.

Does anybody know some faster way to get undocumented functions signature than reading disassembly and trying to figure out what parameters go where and what could it be?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You mean this undocumented api, documented here..

    Security.framework is not private or undocumented.

    As far as headers go, installed on my harddrive in the 3.2 sdk i find:

    /Security.framework/Headers/Security.h
    /Security.framework/Headers/Secbase.h
    /Security.framework/Headers/SecCertificate.h
    /Security.framework/Headers/SecIdentitiy.h
    /Security.framework/Headers/SecImportExport.h
    /Security.framework/Headers/SecItem.h
    /Security.framework/Headers/SecKey.h
    /Security.framework/Headers/SecPolicy.h
    /Security.framework/Headers/SecRandom.h
    /Security.framework/Headers/SecTrust.h

    As for a little reverse engineering 101, you should realise that a framework doesn’t contain or in anyway have a use for header files, or function signatures. When provided they are solely for the benefit of the developer. There is no C or C++ or objective-c code in the compiled framework, only the raw machine code.

    As you have seen, if objective-c was used Class-Dump can do a pretty good job of arranging objective-c symbols into something that looks like a header file, only missing type information that isn’t used at runtime, so still not that useful.

    If the source language was C then you are screwed. There may be a function name symbol but there is no info about arguments or return type.

    • 0