4 ms·
> So for example, if only a few bytes have changed and the binary is only a few bytes different in size they can mostly rely on the tools. That's not how compi
by _qulr 6y ago
> So for example, if only a few bytes have changed and the binary is only a few bytes different in size they can mostly rely on the tools.
That's not how compiled optimized binaries work, especially not with Apple platforms, ever-changing Xcode and Swift compiler versions, etc. Have you tried comparing the binaries of minor app updates? (I just tried comparing the binaries of my own app updates, where I have the source code and know what changed, but it's not pretty, and not "a few bytes".) Moreover, App Store reviewers are not the least bit qualified to even make this determination with regard to "bytes changed".
Two binaries aren't even going to have the same load address for the __TEXT __text segment, and thus a lot of stuff will be different. You think App Store reviewers have any conception of the structure of a Mach-O? Now, one might try to hand-wave and say the "automated tools" will take care of everything, but that's extremely unlikely. Diffing binaries is a skill that requires a human with extensive experience in reverse engineering. If it were totally automated, then all of the securities researchers out there would have those tools too, but they don't. There are of course tools that help a lot, but the human researcher is still essential to the process.
- faeyanpiraat 6y agoI assume Apple has access to the source code of the app, so they probably are not comparing binary blobs for changes.
- _qulr 6y ago> I assume Apple has access to the source code of the app No, Apple doesn't get our source code. Why would you assume that?
- gregoriol 6y agoThey don't: you submit a compiled binary for review
- faeyanpiraat 6y agoI don't get the downvotes. They are making the compiler. How hard can it be to do a proper decompiler? They have the binary; they have the source (in some way)
- saagarjha 6y agoVery hard. Like, this is the holy grail of security/reverse engineering.
- colejohnson66 6y agoCompilation is designed to be a one way process. Without optimizations, it’s relatively easy to get the general gist of the code back, but once -O3 is added, the code doesn’t decompile easily. If a line of assembly is: mov eax, ebx ...that doesn’t tell you anything about what eax and ebx refer to. They’re just x86 registers with no clear relationship back to the variables. If Apple was demanding the debugging symbol database, that’d be something else. But they aren’t.