"Therefore, except for the lost data on exact types of Objective-C objects in arguments, it’s possible to get the complete reconstruction of an interface."
Well, you lose the return type as well. Generally in these cases the app is fired up in the debugger and stopped on one of these methods, then dynamically introspected to figure out what it is. Since all Objective-C objects carry around a representation of their class, it's possible for the runtime to provide this to us.
That is one of the key things which empowered the jailbreak/tweak community. It becomes quite simple to understand (as well as manipulate) interfaces between software components.