用大模型逆向推导苹果私有框架接口，让闭源二进制可分析。
Exposing Hidden Interfaces: LLM-Guided Type Inference for Reverse Engineering macOS Private Frameworks
- 结合大模型与工具链，自动推断Objective-C方法签名。
- 在基准测试中签名恢复率从15%提升至86%。
- 可生成可编译头文件，助力安全研究与漏洞挖掘。
私有macOS框架支撑关键服务但无文档且仅以剥离的二进制分发，阻碍安全分析。我们提出MOTIF，一个集成工具增强分析与微调大语言模型的智能体框架，专用于Objective-C类型推断。该智能体负责运行时元数据提取、二进制检查及约束验证，模型生成候选方法签名并经验证优化为可编译头文件。在MOTIF-Bench（基于公开框架构建，含真实头文件）上，相比基线静态分析工具，签名恢复率从15%提升至86%，工具使用准确率与推断稳定性均显著提高。对私有框架的案例研究显示，重建头文件可成功编译链接，有效支持下游安全研究与漏洞分析。MOTIF将封闭二进制转化为可分析接口，为系统化审计macOS内部机制奠定可扩展基础。
原文摘要 · Abstract (English)
Private macOS frameworks underpin critical services and daemons but remain undocumented and distributed only as stripped binaries, complicating security analysis. We present MOTIF, an agentic framework that integrates tool-augmented analysis with a finetuned large language model specialized for Objective-C type inference. The agent manages runtime metadata extraction, binary inspection, and constraint checking, while the model generates candidate method signatures that are validated and refined into compilable headers. On MOTIF-Bench, a benchmark built from public frameworks with groundtruth headers, MOTIF improves signature recovery from 15% to 86% compared to baseline static analysis tooling, with consistent gains in tool-use correctness and inference stability. Case studies on private frameworks show that reconstructed headers compile, link, and facilitate downstream security research and vulnerability studies. By transforming opaque binaries into analyzable interfaces, MOTIF establishes a scalable foundation for systematic auditing of macOS internals.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。