We present LibKit, the first approach and tool for detecting the name and version of third-party libraries (TPLs) present in iOS apps. LibKit automatically builds fingerprints for 86K library versions available through the CocoaPods dependency manager and matches them on the decrypted app executables to identify the TPLs (name and version) an iOS app uses. LibKit supports apps written in Swift and Objective-C, detects statically and dynamically linked libraries, and addresses challenges such as partially included libraries and different compiler versions and configurations producing variants of the same library version. On a ground truth of 95 open-source apps, LibKit identifies libraries with a precision of 0.911 and a recall of 0.839. LibKit also significantly outperforms the state-of-the-art CRiOS tool for identifying TPL boundaries. When applied to 1,500 apps from the iTunes Store, LibKit detects 47,015 library versions, identifying popular apps that contain old library versions.

This paper studies how developers use different programming languages in the iOS ecosystem by examining 161,883 releases of 25,231 third-party libraries spanning 11 years available through CocoaPods, a popular iOS dependency manager. Our empirical study shows that since its release, Swift has been widely adopted, but most libraries, even recent ones, still use Objective-C as their primary programming language. Looking at a small set of 38 open-source iOS apps, instead, we observe that apps are instead predominantly written in Swift by now. We also observe significant C usage across both libraries and apps. Our results suggest that analysis tools for iOS apps should not only support Swift, but also Objective-C and C code.