  Although iOS is the second most popular mobile operating system and is often
considered the more secure one, approaches to automatically analyze iOS
applications are scarce and generic app analysis frameworks do not exist. This
is on the one hand due to the closed ecosystem putting obstacles in the way of
reverse engineers and on the other hand due to the complexity of reverse
engineering and analyzing app binaries. Reliably lifting accurate call graphs,
control flows, and data dependence graphs from binary code, as well as
reconstructing object-oriented high-level concepts is a non-trivial task and
the choice of the lifted target representation determines the analysis
capabilities. None of the various existing intermediate representations is a
perfect fit for all types of analysis, while the detection of vulnerabilities
requires techniques ranging from simple pattern matching to complex
inter-procedural data flow analyses. We address this gap by introducing liOS, a
binary lifting and analysis framework for iOS applications that extracts lifted
information from several frontends and unifies them in a "supergraph"
representation that tolerates missing parts and is further extended and
interlinked by liOS "passes". A static analysis of the binary is then realized
in the form of graph traversal queries, which can be considered as an
advancement of classic program query languages. We illustrate this approach by
means of a typical JavaScript/Objective-C bridge, which can lead to remote code
execution in iOS applications.
