{
  "added_at": "2026-10-20",
  "arxiv_id": "2610.21597",
  "arxiv_version_reviewed": "v1",
  "authors": [
    "Douglas Leith"
  ],
  "bibtex_url": "https://awesomerea.org/papers/citations/paper-ios-protobuf-extractor.bib",
  "code_url": "https://github.com/doug-leith/ios-protobuf-decoding",
  "date_basis": "First arXiv submission; the reviewed version is v1, not a verified proceedings publication.",
  "date_basis_zh": "采用 arXiv 首次提交日期；审阅版本为 v1，并非已经核实的会议录出版。",
  "date_precision": "day",
  "description_en": "Compares direct LLM recovery of Apple PBCodable schemas with an AI-written Extractor checked against compiled synthetic fixtures, published descriptors and captured traffic. It shows how plausible recovered schemas can silently decode values incorrectly.",
  "description_zh": "比较直接用大语言模型恢复 Apple PBCodable 模式与构建 Extractor 工具两种路径；工具以编译后的合成样本、既有描述文件和捕获流量交叉检查，说明看似合理的模式也可能静默解码出错误值。",
  "doi": null,
  "entry_url": "https://awesomerea.org/papers/paper-ios-protobuf-extractor/",
  "entry_url_zh": "https://awesomerea.org/zh/papers/paper-ios-protobuf-extractor/",
  "evidence_urls": [
    "https://arxiv.org/abs/2610.21597",
    "https://arxiv.org/html/2610.21597v1",
    "https://github.com/doug-leith/ios-protobuf-decoding/blob/9a4a688c52686f82c1a86e386848edc4eb671746/README.md",
    "https://github.com/doug-leith/ios-location-services-study-data/blob/a091d8dad932faf7e8e526ef07b854640ce8bc23/README.md"
  ],
  "first_arxiv_date": "2026-10-15",
  "id": "paper-ios-protobuf-extractor",
  "json_url": "https://awesomerea.org/papers/paper-ios-protobuf-extractor/record.json",
  "kind": "research",
  "markdown_url": "https://awesomerea.org/papers/paper-ios-protobuf-extractor/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/papers/paper-ios-protobuf-extractor/index.md",
  "metadata_notes": "ArXiv names Douglas Leith; the manuscript uses D.J. Leith. No repository-wide license was verified.",
  "metadata_notes_zh": "arXiv 列名 Douglas Leith，手稿使用 D.J. Leith。未核实仓库整体许可。",
  "pdf_url": "https://arxiv.org/pdf/2610.21597v1",
  "project_url": null,
  "publication_date": "2026-10-15",
  "publication_status": "preprint",
  "record_type": "paper",
  "runtime_tested": false,
  "scope_limitations_en": "The direct-agent study uses 17 seeds with 7,788 field occurrences, 4,987 distinct. Apple's true schemas remain unpublished; synthetic tests share the recovered template's assumptions. Traffic comes from one jailbroken iPhone 8 on iOS 16.7.11. Matching fields in newer OS binaries does not verify their network behavior. The maintained code also documents estimated or unresolved fields.",
  "scope_limitations_zh": "直接智能体评测采用 17 个种子，共 7,788 次字段出现，其中 4,987 个不同字段。Apple 的真实模式未公开，合成测试共享恢复模板的假设。流量来自一台运行 iOS 16.7.11 的越狱 iPhone 8；较新系统二进制中的字段一致，不等于其联网行为已验证。维护中的代码也明确记录估计或尚未解决的字段。",
  "targets": [
    "binary",
    "protocol",
    "app"
  ],
  "title": "Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker",
  "title_zh": "解码 iOS 定位服务发送给 Apple 的数据：大语言模型并非可靠分析员，却能辅助构建工具",
  "url": "https://arxiv.org/abs/2610.21597",
  "venue": "arXiv",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20",
  "why_fits_en": "A concrete binary-to-protocol-schema recovery study that separates parseable output from verified interpretation.",
  "why_fits_zh": "具体研究从二进制恢复协议模式，并区分可解析输出与经过验证的解释。",
  "year": 2026
}