This is one thing I've been wondering about, how is it that they don't know every single API call the executable is linked to? I know that Objective C and mess

This is one thing I've been wondering about, how is it that they don't know every single API call the executable is linked to? I know that Objective C and messaging is different from function linking in some fashion, but certainly there must be a way of determining if disallowed APIs are ever called, at all, without just using the app and hoping you trap them. I think at the very least they should be able to examine the executable for object types used, and function signatures used, as well as determining what signatures are passed to which objects.