API Hiding
Protection ID: api_hiding
API Hiding conceals references to system framework calls in your application binary. This prevents static analysis tools from identifying which system APIs your application uses, hiding sensitive functionality like cryptography, keychain access, or network operations.
Configuration
{
"protections": {
"api_hiding": "medium"
}
}{
"protections": {
"api_hiding": "medium"
}
}Available levels: "simple", "medium", "complex".
How It Works
One of the first things a reverse engineer does when analyzing an iOS application is look at the imported symbols and API calls. References to SecItemCopyMatching reveal keychain access, CCCrypt indicates cryptographic operations, and NSURLSession shows network communication. These references provide a high-level map of the application's capabilities without analyzing any actual code.
API Hiding removes these direct references by obscuring how the application resolves and calls system APIs. After protection, static analysis tools cannot determine which framework functions the application uses by examining the import table or cross-references.
Intensity Levels
| Level | Description |
|---|---|
simple | Hides the most commonly analyzed API references |
medium | Broader hiding that covers most framework calls |
complex | Comprehensive hiding with additional indirection layers |
When to Use
API Hiding is recommended for applications that perform security-sensitive operations such as cryptography, keychain access, biometric authentication, DRM/license checks, or network communication with sensitive endpoints. It prevents analysts from quickly identifying these operations through API-level analysis.
Related
- Symbol Renaming - Rename your own symbols
- String Encryption - Encrypt API endpoint strings
- Protections Overview - All available protections