Reproduce “Exposing Hidden Interfaces: LLM-Guided Type Inference for Reverse Engineering macOS Private Frameworks” on OpenResearch

About this paper

Arina Kharlamova, Youcheng Sun, Ting Yu

Researchers at MBZUAI developed MOTIF, an LLM-guided, iterative framework that leverages static analysis and a semantic linter to accurately recover Objective-C method signatures from stripped macOS private frameworks. This framework achieved 83.5% partial match accuracy and 64.7% exact match accuracy on public frameworks, outperforming baseline methods and performing comparably to larger proprietary LLMs at 1/8th the parameter scale.

Key insights

• Combining LLM reasoning with deterministic program analysis tools and a closed-loop linter feedback mechanism substantially improves the accuracy and stability of type inference for complex Objective-C binaries.
• Iterative refinement, guided by semantic constraints, is crucial for resolving ambiguous types like collection generics and delegate protocols, which are difficult for one-shot or purely static methods.
• A lightweight, fine-tuned LLM can achieve performance competitive with larger proprietary models when integrated into a tool-augmented agentic framework, demonstrating efficient and controllable binary analysis capabilities.

Summary by alphaXiv.