最近比较热Mach-O LC_LOAD_DYLIB Hook,自己的尝试

技能讨论
1

砸壳这些不表了,我们拿Wechat来实验把.

设备 iPhone6 9.0.2

1.编写dylib

我是用theos里面的library来创建的

创建后代码:


__attribute__((constructor)) static void entry() {
	NSLog(@"hook success");
}

然后make编译成 hook1.dylib

2. 修改微信的二进制文件,加入LC_LOAD_DYLIB

我是用https://github.com/KJCracks/yololib这个工具一键注入的

ScholardeMacBook-Pro:WeChat.app scholar$ yololib WeChat hook1.dylib
2016-02-24 15:16:02.766 yololib[19207:715790] dylib path @executable_path/hook1.dylib
2016-02-24 15:16:02.767 yololib[19207:715790] dylib path @executable_path/hook1.dylib
Reading binary: WeChat

2016-02-24 15:16:02.768 yololib[19207:715790] FAT binary!
2016-02-24 15:16:02.768 yololib[19207:715790] Injecting to arch 9
2016-02-24 15:16:02.768 yololib[19207:715790] Patching mach_header..
2016-02-24 15:16:02.768 yololib[19207:715790] Attaching dylib..

2016-02-24 15:16:02.768 yololib[19207:715790] Injecting to arch 0
2016-02-24 15:16:02.768 yololib[19207:715790] 64bit arch wow
2016-02-24 15:16:02.768 yololib[19207:715790] dylib size wow 56
2016-02-24 15:16:02.768 yololib[19207:715790] mach.ncmds 73
2016-02-24 15:16:02.768 yololib[19207:715790] mach.ncmds 74
2016-02-24 15:16:02.768 yololib[19207:715790] Patching mach_header..
2016-02-24 15:16:02.768 yololib[19207:715790] Attaching dylib..

2016-02-24 15:16:02.768 yololib[19207:715790] size 52
2016-02-24 15:16:02.768 yololib[19207:715790] complete!

注入完成,我们用MathOView查看一下

QQ20160224-0@2x.png1800×844 131 KB

可以看到写入成功了,然后把hook1.dylib放到同一个目录下面

3. 重新打包,安装

准备ent.xml,XXX为你自己的签名ID

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>keychain-access-groups</key>
	<array>
		<string>XXXXX.com.tencent.xin</string>
	</array>
	<key>com.apple.developer.team-identifier</key>
	<string>XXXXXXX</string>
	<key>application-identifier</key>
	<string>XXXX.com.tencent.xin</string>
</dict>
</plist>

然后把embedded.mobileprovision放入下面这3个文件夹

WeChat.app/PlugIns/WeChatShareExtensionNew.appex
WeChat.app/Watch/WeChatWatchNative.app
WeChat.app

依次对其签名,签名后后正常运行在非越狱环境 :smile:

1 个赞
2

微信的话，可能会作自校验；你换个App试试看？

3

用相同的方式试了几个了.全部这个问题…

就流程来说我没做错吧

4

是参考的这个帖子吗？

5

部分是的. 唯一不同的是dylib是用theos里面的library来创建的

6

有可能是这个问题，2种方式调试：

  1. 你只写个ctor，里面一句NSLog(@"hello");试试看有没有输出；
  2. LLDB启动App，单步跟进，看看能不能到dylib内部去。
    就知道是不是dylib的问题了
7

好的,我现在怀疑是不是因为theos创建library的问题,这个是需要依赖mobilesubstrate?

8

lldb启动都失败了…

`error: failed to launch process debugserver: failed to get the task for process -1``

9

应该是不需要的，但我不敢100%确定，所以让你写个只含有constructor的dylib试试看啊

10

刚刚确定了下,和dylib应该无关

  1. 修改armv7的LC_LOAD_DYLIB,怎么修改都不会闪退.
    于是尝试针对arm64进行修改
    1 编辑hex文件,把其中两个LC_LOAD_DYLIB换了一下位置,(位置和偏移/长度我都修改了) ,替换后闪退
    2 随便修改一个LC_LOAD_DYLIB的名字,(比如把A换成B),替换后闪退.
11

应该也不是微信的自检测.因为lldb启动直接退出.

尝试把二进制文件的MD5改变,然后进入也是正常的

12

我突然想到一种可能,因为看到LC_CODE_SIGNATURE,会不会因为没有ldid签名啊? 因为我是想运行在越狱机做测试的,所以就跳过签名那步了

13

请问这个问题您解决了吗，我也遇到这个问题了，但是我签名后还是有问题

14

解决了,至少描述一下吧

15

theos会产生一个LC指向系统的MS,这个路径在非越狱下不存在，改成weak手工注入一个路径正确的就解决了。

16

和lz一样的os version，在越狱环境下成功无闪退，但是非越狱环境下安装失败，mobiledevice install_app报错！AMDeviceSecureInstallApplication, itune也无法安装。
查过并没有依赖mobilesubstrate。

17

我在非越狱机器上使用企业证书尝试，签名后安装成功，但是闪退，不知道为啥。。。

18

个人证书创建appid 的时候提示不能创建“com.tencent.xin”
没法修改embedded.mobileprovision了，这个怎么解决哈？
There were errors in the data supplied. Please correct and re-submit.
An App ID with Identifier ‘com.tencent.xin’ is not available. Please enter a different string.

19

按照狗神的root注入dylib的方式对NZT 8.1.1版本实现注入，dylib就是打印========run_cmd begin: …===========的log有打印出来，但是NZT却挂了。。有谁知道怎么回事呢？

May 20 11:12:35 iPhone SpringBoard[56] : Can’t find any path
May 20 11:12:35 iPhone SpringBoard[56] : themedPath:/var/mobile/Media/PandaHome/res/ShortcutIcon.bundle/res/icon/ghost_green_48@2x.png
May 20 11:12:35 iPhone SpringBoard[56] : END
May 20 11:12:35 iPhone SpringBoard[56] : CGImageSourceCreateWithFile [end]:<CGImageSource 0x17036a740 [0x195106c80]>
May 20 11:12:35 iPhone NZT[605] : ========run_cmd begin: …===========
May 20 11:12:35 iPhone NZT[605] : NZT(605,0x331649dc) malloc: *** error for object 0x6c83e1: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug
May 20 11:12:35 iPhone ReportCrash[607] : MS:Notice: Injecting: (null) [ReportCrash] (1141.16)
May 20 11:12:35 iPhone ReportCrash[607] : MS:Error: binary does not support this cpu type
May 20 11:12:35 iPhone ReportCrash[607] : MS:Error: failure to check PHNetWorkOpt.dylib
May 20 11:12:35 iPhone ReportCrash[607] : MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/SBPandaHome.dylib
May 20 11:12:35 iPhone ReportCrash[607] : PandaHomeInitialize
May 20 11:12:35 iPhone ReportCrash[607] : MS:warning: message not found [_UIAssetManager imageNamed:scale:idiom:subtype:cachingOptions:]
May 20 11:12:35 iPhone ReportCrash[607] : identifier (null)
May 20 11:12:35 iPhone ReportCrash[607] : folderBackground: (null)
May 20 11:12:35 iPhone ReportCrash[607] : reload
May 20 11:12:35 iPhone ReportCrash[607] : newversion
May 20 11:12:35 iPhone ReportCrash[607] : themes:(
)
May 20 11:12:35 iPhone ReportCrash[607] : themeInfoPlist: {
}
May 20 11:12:35 iPhone ReportCrash[607] : isIOS5
May 20 11:12:35 iPhone ReportCrash[607] : InitSafariWeb
May 20 11:12:35 iPhone ReportCrash[607] : UIKit had loaded.
May 20 11:12:35 iPhone ReportCrash[607] : _UIImageWithName:0x1884f9064
May 20 11:12:35 iPhone ReportCrash[607] : UIKit has end Load
May 20 11:12:35 iPhone ReportCrash[607] : _Z24GetFileNameForThisActionmPcRb: 0x0
May 20 11:12:35 iPhone ReportCrash[607] : _Z24GetFileNameForThisActionmPcmRb: 0x0
May 20 11:12:35 iPhone ReportCrash[607] : _Z24GetFileNameForThisActionjPcjRb: 0x1833162e4
May 20 11:12:35 iPhone ReportCrash[607] : ImageIO end
May 20 11:12:35 iPhone ReportCrash[607] : CPBitmapCreateImagesFromPath: 0x189c18a34
May 20 11:12:35 iPhone ReportCrash[607] : open sound library end
May 20 11:12:35 iPhone ReportCrash[607] : MS:warning: nil class argument for selector imageNamed:
May 20 11:12:35 iPhone ReportCrash[607] : MS:warning: nil class argument for selector initWithName:inBundle:
May 20 11:12:35 iPhone ReportCrash[607] : getTheme,FILE:(
“SMSBackground.png”,
“SMSBackground.jpg”,
“SMSBackground@2x.png”,
“SMSBackground@2x.jpg”,
“SMSBackground-568h@2x.png”,
“SMSBackground-375w-667h@2x.png”,
“SMSBackground-414w-736h@3x.png”
)
May 20 11:12:35 iPhone ReportCrash[607] : path: (null)
May 20 11:12:35 iPhone ReportCrash[607] : init finish
May 20 11:12:35 iPhone ReportCrash[607] : initWith
May 20 11:12:35 iPhone ReportCrash[607] : services
May 20 11:12:35 iPhone ReportCrash[607] : task_set_exception_ports(B07, 400, 1503, 0, 0) failed with error (4: (os/kern) invalid argument)
May 20 11:12:35 iPhone ReportCrash[607] : ReportCrash acting against PID 605
May 20 11:12:36 iPhone ReportCrash[607] : Formulating crash report for process NZT[605]
May 20 11:12:36 iPhone com.apple.xpc.launchd[1] (UIKitApplication:NZT[0xf60b][605]) : Service exited due to signal: Abort trap: 6
May 20 11:12:36 iPhone ReportCrash[607] : Saved report to /Library/Logs/CrashReporter/NZT_2016-05-20-111235_iPhone.ips
May 20 11:12:36 iPhone SpringBoard[56] : Application ‘UIKitApplication:NZT[0xf60b]’ crashed.
May 20 11:12:36 iPhone SpringBoard[56] : NSBundle$localizedStringForKey$value$table
May 20 11:12:36 iPhone SpringBoard[56] : WB:Debug:[NSBundle(com.apple.springboard) localizedStringForKey:“SEARCH_BAR_PLACEHOLDER_LOCAL_ONLY” value:"" table:“SpringBoard”] (zh)

20

好像野指针了，但是把它原生的NZT可执行文件放进去又可以正常运行。。谁帮忙分析下什么情况撒？
NZT(605,0x331649dc) malloc: *** error for object 0x6c83e1: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug