An Objective-C app carries its own map. Because the runtime sends messages by name, the release binary keeps class names, selectors, property names and method lists, and anyone who decrypts it can read that map and change method implementations while the app runs. Otukan protects both sides of that exposure: it renames the metadata the runtime never looks up by string, detects unapproved method interception on your sensitive classes, and accepts every change against your crash tooling and real journeys. Scope is the Objective-C layer of an iOS app on physical devices; Swift code is covered on Swift app security.
Selectors, classes and runtime metadata
The compiler writes several metadata sections into every Objective-C binary. Each one helps the runtime, and each one helps an analyst.
| Metadata | Why the runtime needs it | What an analyst learns | What Otukan does |
|---|---|---|---|
| Class names | Class lookup, archiving, introspection | The structure of your app, class by class | Renames classes that are never looked up by string |
| Selectors | Message dispatch by name | Every method’s purpose, such as verifyPIN: | Renames selectors outside your dynamic-name list |
| Property and ivar names | Key-value coding and layout | Which fields hold tokens, balances or flags | Renames them where no string lookup reaches them |
| Protocol lists | Conformance checks | How modules talk to each other | Renames private protocols |
| String literals | Constants you reference | Endpoints, error text, feature flags | Encodes the strings you mark as sensitive |
Names that must stay readable
Some names are part of a contract with the system. Interface builder connects outlets and actions by name. Keyed archives store class names inside saved data. Key-value coding and NSSelectorFromString build names from strings at run time. Core Data maps entities to classes by name. Otukan keeps these untouched and renames the rest, so an app that relies on dynamic lookups keeps working as it did.
Method interception and approved SDK behaviour
Objective-C lets code swap the implementation behind a selector while the app runs. That is how many legitimate SDKs attach to your app delegate, and it is also the cheapest way for an attacker to skip a PIN check or rewrite a transfer amount.
What attackers change
- Implementation swaps. A new function replaces the one behind a selector, so every caller now runs attacker code.
- Class changes on one object. An object is moved to a generated subclass whose methods behave differently.
- Added forwarding. A class starts forwarding messages it used to handle directly, sending them through code the attacker controls.
- New categories. An injected library adds methods to your classes that override the originals.
How Otukan tells them apart
Otukan records the method replacements your embedded SDKs make on a clean, signed build. At run time it checks the implementations behind your sensitive selectors against that approved picture. A change inside the approved set is ignored. A change outside it produces a signal naming the class and selector, which travels with your next sensitive request so your backend can decide. Hooking at the native layer is covered on iOS hooking detection.
Release compatibility and diagnostics
Protection must survive the same release routine as your code. Otukan treats compatibility as part of the product.
Crash reports stay readable
Symbolication of Objective-C frames uses your dSYM files. For renamed classes and selectors, Otukan keeps a private rename map per build, so your team can translate a protected crash report back to original names. The map stays with you.
Behaviour that must not change
Before each release, the protected build is run on physical devices through install, update from the previous version, sign-in and your most sensitive flow. Categories, +load methods and classes created from strings are exercised explicitly, because they are where a careless rename would show. A negative run on a clean device confirms that approved SDK swaps stay silent.
Diagnosing a signal
When a swizzling signal fires, it names the selector and the moment it was seen, such as launch or before a transfer. That lets your engineers reproduce it in an authorised lab rather than guess. For the wider iOS picture, return to iOS app security, and further walkthroughs are in iOS app security guides.