Recently someone on reddit asked “How on earth is the Facebook app size so large ?”. The person asking the question realized that the ~100Mb compressed App Store archive wasn’t all assets - a very large portion was the application binary.

How do you answer that question? You quickly reverse engineer the application!

1 Download the binary to a jailbroken device from the App Store

2 Find the application on the device.

SSH into the device and find the application container on the filesystem:

find / -type d -iname "SomeApp*.app"

3 Decrypt the binary

Install dumpdecrypted on the device. Follow the instructions for using it.

4 Get the files off the device using scp or rsync.

In most cases you will want the application container, the decrypted binary, and the application data container (i.e. what it writes out to the filesystem).

At this point you have the decrypted binary and it’s files. You can now run class-dump on the binary and output a directory of header files for all the classes in the binary, or you can use a disassembler like IDAPro or Hopper to easily see all the classes, symbols, etc.

In the case of the Facebook application, there are more than 18,000 classses in the application:

There is a LOT of crap in there. Even a “FBFeedAwesomeizer” - which alone is a collection of 74 classes and protocols.

This is why the application binary itself is over 114Mb.