# Exposing Hidden Interfaces: LLM-Guided Type Inference for Reverse Engineering macOS Private Frameworks

arXiv: https://arxiv.org/abs/2601.01673 · HTML: https://mlsanity.com/paper/2601.01673/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 42 references that are in the map.
- First posted on arXiv 4 Jan 2026.

## Builds on (most cited first, 8 of 8)

- [Emergent Abilities of Large Language Models](https://mlsanity.com/paper/2206.07682/) (2022)
- [LLM4Decompile: Decompiling Binary Code with Large Language Models](https://mlsanity.com/paper/2403.05286/) (2024)
- [Harnessing the Power of LLM to Support Binary Taint Analysis](https://mlsanity.com/paper/2310.08275/) (2023)
- [When Coding Style Survives Compilation: De-anonymizing Programmers from Executable Binaries](https://mlsanity.com/paper/1512.08546/) (2015)
- [Exploring the Efficacy of Large Language Models (GPT-4) in Binary Reverse Engineering](https://mlsanity.com/paper/2406.06637/) (2024)
- [How Far Have We Gone in Binary Code Understanding Using Large Language Models](https://mlsanity.com/paper/2404.09836/) (2024)
- [Polymorphic Type Inference for Machine Code](https://mlsanity.com/paper/1603.05495/) (2016)
- [BinSub: The Simple Essence of Polymorphic Type Inference for Machine Code](https://mlsanity.com/paper/2409.01841/) (2024)

## Abstract (arXiv)

Private macOS frameworks underpin critical services and daemons but remain undocumented and distributed only as stripped binaries, complicating security analysis. We present MOTIF, an agentic framework that integrates tool-augmented analysis with a finetuned large language model specialized for Objective-C type inference. The agent manages runtime metadata extraction, binary inspection, and constraint checking, while the model generates candidate method signatures that are validated and refined into compilable headers. On MOTIF-Bench, a benchmark built from public frameworks with groundtruth headers, MOTIF improves signature recovery from 15% to 86% compared to baseline static analysis tooling, with consistent gains in tool-use correctness and inference stability. Case studies on private frameworks show that reconstructed headers compile, link, and facilitate downstream security research and vulnerability studies. By transforming opaque binaries into analyzable interfaces, MOTIF establishes a scalable foundation for systematic auditing of macOS internals.