What the Blazes?! – Why are there iOS Artefacts in my Windows 10 Applications?

Recently a colleague of mine was diving into the Facebook application on Windows 10 when they noticed something odd: plist files 

For those of you not in the know, plist or “Property List” is a data format used widely across Apple devices, both desktop and embedded devices running iOS and the like. They are widely used to hold configuration information but are often used as a more general data storage format. They come in two flavours: an XML based text format and a more compact binary format – but wait, hold up a second! Let’s not get bogged down on what plist files are and focus on the bigger question: what the dickens is this Apple format doing in a Windows application!? 

And it doesn’t stop with the presence of plists either! Taking a peek at the application data folder (%APPDATA%\Local\Packages\Facebook.Facebook_8xx8rvfyw5nnt) and heading into the “LocalState” folder we see this: 

This here looks a heckof-alot like what you’d expect to see in the application folder of an iOS app, especially in the “Library” folder were we even see references to “NSHTTPCookieStorage” which is only a bloomin’ Mac API (the files contained therein are packed full of plist goodness too!). What in the world is all of this Mac data doing inside a Windows application? 

Turning to the installation folder for the App, which you’ll find in “\Program Files\WindowsApps\Facebook.Facebook_[version goes here]”, we find a range of dlls that the app is making use of, but there is a pattern to a number of the file names – can you spot it? 

osmeta” is mentioned in the file names of a number of the dlls. There are even a number of cases where well known libraries (such as ffmpeg and glesv2) have been suffixed by “osmeta” – but what is this mysterious entity? 

A little tactical Googling reveals that osmeta is a start-up that Facebook acquired in March 2013 (https://techcrunch.com/2013/04/10/has-facebook-quietly-acquired-osmeta-a-stealth-mobile-software-startup/). Although osmeta’s webpage is long gone, you can still find it on The Internet Archive (https://web.archive.org/web/20130528132601/http://osmeta.com/about/) however it’s very light on detail as to what it was that they were building:  

osmeta is a Silicon Valley startup. We are working on really, really interesting software technology. It’s big. We will tell you more when the time is right. 

However, there are some clues: multiple mentions of software emulation and virtualisation as well as this image accompanied by the caption: “Incredible possibilities, tremendous opportunities—for developers and users of many, many devices everywhere, including devices in cars, airplanes, and consumer electronics.” 

Given these clues along with the presence of these “modified” dll files in the installation folder it seems likely that osmeta is providing some kind of interoperability layer, emulation or dare I say: “Meta Operating System” which takes an application designed for one operating system and allows it to run on another (I’m not the first to reach this conclusion: https://news.ycombinator.com/item?id=11599617). 

So as to why we’re seeing iOS artefacts all over this Windows 10 app – it’s because it is the iOS App.  

This is a somewhat unexpected turn of events, but this iOS to Windows translation is not unheard of. In fact, Microsoft themselves have clearly noticed that iOS is a very popular platform for developers of Apps and have started developing Windows Bridge for iOS, also known as “Project Islandwood” and “WinObjC” (https://developer.microsoft.com/en-us/windows/bridges/ios), which makes it very easy for developers to quickly port their iOS Apps to Windows 10 –  so we might expect to see even more iOS-ness making its way to a Windows 10 machine near you, soon!  

 

Alex Caithness
Principal Analyst (Research & Development)