iOS安全攻防(十七):Fishhook – iPhone手機開發技術文章 iPhone軟體開發教學課程

Fishhook

眾所周知,Objective-C的首選hook方案為Method Swizzle,於是大傢紛紛表示核心內容應該用C寫。
接下來進階說說iOS下C函數的hook方案,先介紹第一種方案————fishhook .

什麼是fishhook

fishhook是facebook提供的一個動態修改鏈接Mach-O符號表的開源工具。

什麼是Mach-O

Mach-O為Mach Object文件格式的縮寫,也是用於iOS可執行文件,目標代碼,動態庫,內核轉儲的文件格式。
Mach-O有自己的dylib規范。

fishhook的原理

詳見官方的How it works,這裡我作個簡要說明。
dyld鏈接2種符號,lazy和non-lazy,fishhook可以重新鏈接/替換本地符號。

vcD48cD7I5828y/nKvqOsX19EQVRBx/jT0MG9uPZzZWN0aW9uus22r8yst/u6xcG0vdPP4LnYo7pfX25sX3N5bWJvbF9wdHIgoaJfX2xhX3N5bWJvbF9wdHKho19fbmxfc3ltYm9sX3B0cs6q0ru49ta41evK/dfpo6zWsb3TttTTpm5vbi1sYXp5sPO2qMr9vt2ho19fbGFfc3ltYm9sX3B0ctKyysfSu7j21rjV68r91+mjrM2ouf1keWxkX3N0dWJfYmluZGVyuKjW+sG0vdOhozxtYWNoLW8vbG9hZGVyLmg+tcRzZWN0aW9uzbfM4bmpt/u6xbHttcTGq9LGwb+hozxiciAvPs28yr7W0KOsMTA2McrHvOS907f7usWx7bXExqvSxsG/o6wqo6jGq9LGwb8rvOS907f7usW12Na3o6k9MTYzNDOjrLy0t/u6xbHtxqvSxsG/oaO3+7rFse3W0MO/0ru49r3hubm2vMrH0ru49m5saXN0veG5uczlo6zG5NbQsPy6rNfWt/ux7car0sbBv6Gjzai5/dfWt/ux7car0sbBv9fu1tXIt7aouq/K/da41euhozxiciAvPjxiciAvPmZpc2hob29rvs3Kx7bUvOS907f7usWx7bXExqvSxsG/tq+1xMrWvcWjrMzhuanSu7j2vNm1xG5saXN0veG5uczlo6y007b4tO+1vWhvb2u1xMS/tcShozxiciAvPjxiciAvPjxiciAvPmZpc2hob29rzOa7u7f7usW6r8r9o7o8YnIgLz48YnIgLz48L3A+PHByZSBjbGFzcz0=”brush:java;”>int rebind_symbols(struct rebinding rebindings[], size_t rebindings_nel) {
int retval = prepend_rebindings(rebindings, rebindings_nel);
if (retval next) {
_dyld_register_func_for_add_image(rebind_symbols_for_image);
} else {
uint32_t c = _dyld_image_count();
for (uint32_t i = 0; i < c; i++) {
rebind_symbols_for_image(_dyld_get_image_header(i), _dyld_get_image_vmaddr_slide(i));
}
}
return retval;
}
關鍵函數是 _dyld_register_func_for_add_image,這個函數是用來註冊回調,當dyld鏈接符號時,調用此回調函數。 rebind_symbols_for_image 做瞭具體的替換和填充。

fishhook替換Core Foundation函數的例子

以下是官方提供的替換Core Foundation中open和close函數的實例代碼

#import 

#import 

#import "AppDelegate.h"
#import "fishhook.h"

static int (*orig_close)(int);
static int (*orig_open)(const char *, int, ...);

void save_original_symbols() {
  orig_close = dlsym(RTLD_DEFAULT, "close");
  orig_open = dlsym(RTLD_DEFAULT, "open");
}

int my_close(int fd) {
  printf("Calling real close(%d)\n", fd);
  return orig_close(fd);
}

int my_open(const char *path, int oflag, ...) {
  va_list ap = {0};
  mode_t mode = 0;

  if ((oflag & O_CREAT) != 0) {
    // mode only applies to O_CREAT
    va_start(ap, oflag);
    mode = va_arg(ap, int);
    va_end(ap);
    printf("Calling real open('%s', %d, %d)\n", path, oflag, mode);
    return orig_open(path, oflag, mode);
  } else {
    printf("Calling real open('%s', %d)\n", path, oflag);
    return orig_open(path, oflag, mode);
  }
}

int main(int argc, char * argv[])
{
  @autoreleasepool {
    save_original_symbols();
    //fishhook用法
    rebind_symbols((struct rebinding[2]){{"close", my_close}, {"open", my_open}}, 2);

    // Open our own binary and print out first 4 bytes (which is the same
    // for all Mach-O binaries on a given architecture)
    int fd = open(argv[0], O_RDONLY);
    uint32_t magic_number = 0;
    read(fd, &magic_number, 4);
    printf("Mach-O Magic Number: %x \n", magic_number);
    close(fd);

    return UIApplicationMain(argc, argv, nil, NSStringFromClass([AppDelegate class]));
  }
}

註釋//fishhook用法 處

rebind_symbols((struct rebinding[2]){{"close", my_close}, {"open", my_open}}, 2);

傳入rebind_symbols的第一個參數是一個結構體數組,大括號中為對應數組內容。

不得不說,facebook忒NB。

發佈留言