Sure! It's a combination of static and dynamic analysis. I have a jailbroken phone, which allows me to access any file on the filesystem and decrypt any App Store binaries[1]. The first step is to find in which binaries the functionality lives. I know from searching that AirDrop lives in Sharing.framework[2], which has a supporting daemon, sharingd. Then, I open the binaries in a disassembler like IDA Pro[3] or Hopper[4] to determine how they work. Running class-dump is also helpful[5]. If I need to inspect a process like sharingd at runtime, I use Cycript[6], which gives me an Objective-C REPL into the process, or LLDB[7].

[1] https://github.com/stefanesser/dumpdecrypted

[2] https://github.com/JaviSoto/iOS8-Runtime-Headers/tree/master...

[3] https://www.hex-rays.com/products/ida/

[4] http://www.hopperapp.com/

[5] http://stevenygard.com/projects/class-dump/

[6] http://www.cycript.org/

[7] http://iphonedevwiki.net/index.php/Debugserver

Oh crap, I didn't know IDA was free for non-commercial use. I thought it was like Photoshop: prohibitively expensive for most users, so everyone pirates it. I'm going to have to give that a shot.

Maybe you'd like Radare, which is free software. http://www.radare.org/y/

Thank you for the link.

An old version is free, and lacking the decompiler. It's a good tool, but it's really not IDA Pro.

IDA is not the expensive part, the Hex-Rays decompiler is. A single license can cost up to $2000 :(

The free version is also Windows-only