iPhone 定位数据解析研究：LLM 直接逆向不可靠，写工具却好用
Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker
研究者实测两个前沿模型逆向 Apple 的 protobuf 格式，直接分析错误一堆，但让 Claude 写个 Extractor 工具反而靠谱，思路很实用。
剑桥研究团队（arXiv 2610.21597）测试了 Claude Opus 4.8 与 Codex GPT Sol 5.6 两款模型能否从 Apple 二进制文件中重建 iPhone 发往 Apple 定位服务的 protobuf 格式。结果大多数生成的 schema 包含大量错误，且因内部自洽而难以察觉，不适合用于隐私与取证分析。但让 Claude 编写的 Python 工具 Extractor 表现可靠，能从 Apple 二进制中稳定恢复 protobuf schema。团队用越狱 iPhone 8（iOS 16.7.11）的网络流量验证了该工具的实用性。
Decoding What iOS Location Services Send to Apple: An LLM Is an Unreliable Analyst but a Useful Toolmaker
Reverse engineering the data formats used by mobile software is skilled and slow, and using AI to assist with it is attractive. We evaluate this for the protobuf messages that an iPhone sends to Apple's location services. Working from Apple's binaries, we use two frontier models (Claude Opus 4.8, Codex GPT Sol 5.6) to reconstruct the schemas of protobufs observed in network traffic. The great majority of the schemas contain substantial errors, and these are hard to detect because the schemas are internally consistent. Direct AI use is therefore unsuitable for forensic and privacy analysis. AI can, however, write reliable analysis tools when their output can be validated. We use Claude to write a Python tool, Extractor, that reliably recovers protobuf schemas from Apple binaries. We validate it against binaries compiled from schemas with known answers, previously published schemas, and network measurements. We demonstrate the use of Extractor to decode and analyse the location services network traffic of a jailbroken iPhone 8 (iOS 16.7.11).
