I'm sure some security researcher somewhere has run the app through a debugger/disassembler to verify exactly this.