iOS安全攻防(十七):Fishhook
阿新 • • 發佈:2019-02-08
Fishhook
眾所周知,Objective-C的首選hook方案為Method Swizzle,於是大家紛紛表示核心內容應該用C寫。
接下來進階說說iOS下C函式的hook方案,先介紹第一種方案————fishhook .
什麼是fishhook
fishhook是facebook提供的一個動態修改連結Mach-O符號表的開源工具。
什麼是Mach-O
Mach-O為Mach Object檔案格式的縮寫,也是用於iOS可執行檔案,目的碼,動態庫,核心轉儲的檔案格式。Mach-O有自己的dylib規範。
fishhook的原理
詳見官方的How it works,這裡我作個簡要說明。dyld連結2種符號,lazy和non-lazy,fishhook可以重新連結/替換本地符號。
如圖所示,__DATA區有兩個section和動態符號連結相關:__nl_symbol_ptr 、__la_symbol_ptr。__nl_symbol_ptr為一個指標陣列,直接對應non-lazy繫結資料。__la_symbol_ptr也是一個指標陣列,通過dyld_stub_binder輔助連結。<mach-o/loader.h>的section頭提供符號表的偏移量。
圖示中,1061是間接符號表的偏移量,*(偏移量+間接符號地址)=16343,即符號表偏移量。符號表中每一個結構都是一個nlist結構體,其中包含字元表偏移量。通過字元表偏移量最終確定函式指標。
fishhook就是對間接符號表的偏移量動的手腳,提供一個假的nlist結構體,從而達到hook的目的。
fishhook替換符號函式:
int rebind_symbols(struct rebinding rebindings[], size_t rebindings_nel) { int retval = prepend_rebindings(rebindings, rebindings_nel); if (retval < 0) { return retval; } // If this was the first call, register callback for image additions (which is also invoked for // existing images, otherwise, just run on existing images if (!rebindings_head->next) { _dyld_register_func_for_add_image(rebind_symbols_for_image); } else { uint32_t c = _dyld_image_count(); for (uint32_t i = 0; i < c; i++) { rebind_symbols_for_image(_dyld_get_image_header(i), _dyld_get_image_vmaddr_slide(i)); } } return retval; }
關鍵函式是 _dyld_register_func_for_add_image,這個函式是用來註冊回撥,當dyld連結符號時,呼叫此回撥函式。 rebind_symbols_for_image 做了具體的替換和填充。
fishhook替換Core Foundation函式的例子
以下是官方提供的替換Core Foundation中open和close函式的例項程式碼
#import <dlfcn.h>
#import <UIKit/UIKit.h>
#import "AppDelegate.h"
#import "fishhook.h"
static int (*orig_close)(int);
static int (*orig_open)(const char *, int, ...);
void save_original_symbols() {
orig_close = dlsym(RTLD_DEFAULT, "close");
orig_open = dlsym(RTLD_DEFAULT, "open");
}
int my_close(int fd) {
printf("Calling real close(%d)\n", fd);
return orig_close(fd);
}
int my_open(const char *path, int oflag, ...) {
va_list ap = {0};
mode_t mode = 0;
if ((oflag & O_CREAT) != 0) {
// mode only applies to O_CREAT
va_start(ap, oflag);
mode = va_arg(ap, int);
va_end(ap);
printf("Calling real open('%s', %d, %d)\n", path, oflag, mode);
return orig_open(path, oflag, mode);
} else {
printf("Calling real open('%s', %d)\n", path, oflag);
return orig_open(path, oflag, mode);
}
}
int main(int argc, char * argv[])
{
@autoreleasepool {
save_original_symbols();
//fishhook用法
rebind_symbols((struct rebinding[2]){{"close", my_close}, {"open", my_open}}, 2);
// Open our own binary and print out first 4 bytes (which is the same
// for all Mach-O binaries on a given architecture)
int fd = open(argv[0], O_RDONLY);
uint32_t magic_number = 0;
read(fd, &magic_number, 4);
printf("Mach-O Magic Number: %x \n", magic_number);
close(fd);
return UIApplicationMain(argc, argv, nil, NSStringFromClass([AppDelegate class]));
}
}
註釋//fishhook用法 處
rebind_symbols((struct rebinding[2]){{"close", my_close}, {"open", my_open}}, 2);
傳入rebind_symbols的第一個引數是一個結構體陣列,大括號中為對應陣列內容。
不得不說,facebook忒NB。