Hacker News Reader

Self-modifying code is prohibited on iOS by codesigning. However, achieving Turing complete execution capable of calling any API not behind an entitlement is very feasible and regularly passes App Store review for simple cases. The more complicated ones might too, but they aren't delivered via the store very often ;)

View on HN

If you can convert data into an API call, then it becomes an issue of steganography. The only way to trust a binary is through 100% code coverage through all possible inputs, which is intractable.

Code signing and a secure enclave may help protect against local use cases, like ransomware, but doesn't protect against hybrid attacks, like granting access to 3rd parties.

Maybe this means that all binaries in 2040 should be derived from open source with AI doing the threat detection.

… take me through this? Is it evaluating through NSObject keypaths? I’m a noob and just curious.

Easy one is to embed an interpreter and let it call arbitrary Objective-C code

Reply on news.ycombinator.com