Sure! It's a combination of static and dynamic analysis. I have a jailbroken phone, which allows me to access any file on the filesystem and decrypt any App Sto

Sure! It's a combination of static and dynamic analysis. I have a jailbroken phone, which allows me to access any file on the filesystem and decrypt any App Store binaries[1]. The first step is to find in which binaries the functionality lives. I know from searching that AirDrop lives in Sharing.framework[2], which has a supporting daemon, sharingd. Then, I open the binaries in a disassembler like IDA Pro[3] or Hopper[4] to determine how they work. Running class-dump is also helpful[5]. If I need to inspect a process like sharingd at runtime, I use Cycript[6], which gives me an Objective-C REPL into the process, or LLDB[7]. [1] https://github.com/stefanesser/dumpdecrypted https://github.com/stefanesser/dumpdecrypted [2] https://github.com/JaviSoto/iOS8-Runtime-Headers/tree/master/PrivateFrameworks/Sharing.framework https://github.com/JaviSoto/iOS8-Runtime-Headers/tree/master... [3] https://www.hex-rays.com/products/ida/ https://www.hex-rays.com/products/ida/ [4] http://www.hopperapp.com/ http://www.hopperapp.com/ [5] http://stevenygard.com/projects/class-dump/ http://stevenygard.com/projects/class-dump/ [6] http://www.cycript.org/ http://www.cycript.org/ [7] http://iphonedevwiki.net/index.php/Debugserver http://iphonedevwiki.net/index.php/Debugserver