在 iOS 中，如何在基板调整中找到所有挂钩功能

逆向工程 ios
2021-06-27 14:09:08

我正在尝试反转已编译的调整。作为第一步，我想找出它挂钩的所有函数。我可以找到所有对基板框架函数的调用，但我没有弄清楚哪些函数被挂钩 ( r0)。做这个的最好方式是什么？

  1. 如何使用gdb而不是附加到正在运行的进程来启动应用程序。直接的方法导致 aSIGABRT和调用堆栈看起来像

    #0  0x39ee91f0 in __pthread_kill ()
#1  0x39f53796 in pthread_kill ()
#2  0x39e99fdc in abort ()
#3  0x33bdec10 in GSRegisterPurpleNamedPort ()
#4  0x33bde890 in _GSEventInitialize ()
#5  0x31604f38 in UIApplicationMain ()
#6  0x0022d97c in ?? ()
#7  0x000910c8 in ?? ()

  2. 我试图编写一个调整来挂钩基板框架功能，例如MSHookFunction.

    #include <CydiaSubstrate.h>

void (*oldMSHookFunction)(void *, void *, void **);

void newMSHookFunction(void *symbol, void *hook, void **old) {
    printf("CC_HOOKED\n");
    oldMSHookFunction(symbol, hook, old); 
 }

__attribute__((constructor)) static void initialize() {
    NSLog(@"CC_LOADED");
    MSHookFunction(MSHookFunction, &newMSHookFunction, &oldMSHookFunction);
 }

使用syslog，我发现我的调整已成功加载并CC_LOADED打印，并且在我之后加载了其他调整。但是，没有CC_HOOKED打印出来。发生了什么 ？

2个回答
#include "substrate.h"
#include <dlfcn.h>

void resolveSymbol(const void *addr) {
    Dl_info info;
    if (dladdr(addr, &info)) {
        NSLog(@"<hooksubstrate> Resolved symbol at address %p: dli_fname %s, dli_fbase %p, dli_sname %s, dli_saddr %p", addr, info.dli_fname, info.dli_fbase, info.dli_sname, info.dli_saddr);
    }
    else {
        NSLog(@"<hooksubstrate> Can't resolve symbol at address %p", addr);
    }
}

void (*oldMSHookFunction)(void *, void *, void **);

void newMSHookFunction(void *symbol, void *hook, void **old) {
    NSLog(@"<hooksubstrate> MSHookFunction: symbol %p, new %p, old %p", symbol, hook, old);
    resolveSymbol(symbol);
    resolveSymbol(hook);
    resolveSymbol(old);
    oldMSHookFunction(symbol, hook, old);
}

void (*oldMSHookMessageEx)(Class, SEL, IMP, IMP *);

void newMSHookMessageEx(Class c/*lass*/, SEL s/*elector*/, IMP replacement, IMP *result) {
    NSLog(@"<hooksubstrate> MSHookMessageEx: class %@, selector %@, new %p, old %p", NSStringFromClass(c/*lass*/), NSStringFromSelector(s/*elector*/), replacement, result);
    resolveSymbol((const void *) *replacement);
    resolveSymbol((const void *) result);
    oldMSHookMessageEx(c/*lass*/, s/*elector*/, replacement, result);
}

__attribute__((constructor))
static void initialize() {
    MSHookFunction(MSHookMessageEx, &newMSHookMessageEx, &oldMSHookMessageEx);
    MSHookFunction(MSHookFunction, &newMSHookFunction, &oldMSHookFunction);
    NSLog(@"<hooksubstrate> Hooked into MSHookFunction & MSHookMessageEx");
}

带有示例输出（对于旧版本）

> cat /dev/null > /var/log/syslog
> cat /var/log/syslog | grep "Loading"
Sep 12 17:06:54 iPad Clash of Clans[2372]: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/HookSubstrate.dylib
Sep 12 17:06:54 iPad Clash of Clans[2372]: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/xxCOCPlugin.dylib
> cat /var/log/syslog | grep "<cc>"
Sep 12 17:06:54 iPad Clash of Clans[2372]: <cc> Hooked into MSHookFunction & MSHookMessageEx
Sep 12 17:06:54 iPad Clash of Clans[2372]: <cc> MSHookFunction: old 0x845fd, new 0x3af4fd
Sep 12 17:06:54 iPad Clash of Clans[2372]: <cc> Resolved symbol at address 0x845fd: dli_fname /var/mobile/Applications/1A631C27-CE93-4845-B7FB-0637D600E10C/Clash of Clans.app/Clash of Clans, dli_fbase 0x4000, dli_sname (null), dli_saddr 0x0
Sep 12 17:06:54 iPad Clash of Clans[2372]: <cc> Resolved symbol at address 0x3af4fd: dli_fname /Library/MobileSubstrate/DynamicLibraries/xxCOCPlugin.dylib, dli_fbase 0x3a7000, dli_sname _Z20func_hook_new_searchi, dli_saddr 0x3af4fd
Sep 12 17:06:54 iPad Clash of Clans[2372]: <cc> MSHookMessageEx: class AppController, selector application:didFinishLaunchingWithOptions:, new 0x3afdb5
Sep 12 17:06:54 iPad Clash of Clans[2372]: <cc> Resolved symbol at address 0x3afdb5: dli_fname /Library/MobileSubstrate/DynamicLibraries/xxCOCPlugin.dylib, dli_fbase 0x3a7000, dli_sname _Z60hook_AppController_application_didFinishLaunchingWithOptionsP11objc_objectP13objc_selectorS0_S0_, dli_saddr 0x3afdb5

通过首先在 IDA Pro 中对 _MSHookMes​​sageEx 进行交叉引用，您可以在调整中找到所有挂钩的 Objective C 方法。在调用 _MSHookMes​​sageEx 的函数中，可以看到方法名称已加载到 R1 中，就在调用 _MSHookMes​​sageEx 之前。

要使用 gdb 启动应用程序，请使用 debugserver。它充当 iOS 上远程 gdb 或 lldb 的端点。您可以在此页面上找到有关 debugserver 的更多信息 - http://iphonedevwiki.net/index.php/Debugserver

另外，我建议使用 Theos ( http://iphonedevwiki.net/index.php/Theos ) 来执行函数挂钩。它使 MobileSubtrate 调整的开发变得更加容易。

从你的问题来看，我似乎明白你正试图挂钩 MobileSubtrate 自己的功能，如 MSHookFunction。MobileSubstrate 仅设计用于挂钩其他功能而不是其本身。

其它你可能感兴趣的问题
上一篇x86_64 调用约定 下一篇反转 DDRAW 应用程序