Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Search for binding symbols also via LC_DYLD_CHAINED_FIXUPS #123

Open
wants to merge 7 commits into
base: master
Choose a base branch
from
Open

Search for binding symbols also via LC_DYLD_CHAINED_FIXUPS #123

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
deb48db
Also explore symbols defined in self image
p-x9 Apr 19, 2024
204eaec
Name of the exported symbol will always start with "_".
p-x9 Apr 19, 2024
12d1dfe
Search binding symbols via dyld_chained_fixups
p-x9 Apr 19, 2024
7191de5
Fix to replace symbol pointer in `__DATA_CONST` segment correctly
p-x9 Apr 19, 2024
9c65ebc
Fix condition for checking if indirect symbol is local or absolute
p-x9 Apr 19, 2024
b9e02b8
remove unnecessary print
p-x9 Apr 19, 2024
22b0f3e
Fix FishHook in the app as well.
p-x9 Apr 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 31 additions & 14 deletions FrameworkClientApp/FishHook.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ private func replaceSymbolAtImage(
) {
var linkeditCmd: UnsafeMutablePointer<segment_command_64>!
var dataCmd: UnsafeMutablePointer<segment_command_64>!
var dataConstCmd: UnsafeMutablePointer<segment_command_64>!
var symtabCmd: UnsafeMutablePointer<symtab_command>!
var dynamicSymtabCmd: UnsafeMutablePointer<dysymtab_command>!

Expand All @@ -56,10 +57,14 @@ private func replaceSymbolAtImage(
let curCmdNameOffset = MemoryLayout.size(ofValue: curCmd.pointee.cmd) + MemoryLayout.size(ofValue: curCmd.pointee.cmdsize)
let curCmdNamePointer = curCmdPointer.advanced(by: curCmdNameOffset).assumingMemoryBound(to: Int8.self)
let curCmdName = String(cString: curCmdNamePointer)
if (curCmdName == SEG_LINKEDIT) {
switch curCmdName {
case SEG_LINKEDIT:
linkeditCmd = curCmd
} else if (curCmdName == SEG_DATA) {
case SEG_DATA:
dataCmd = curCmd
case "__DATA_CONST":
dataConstCmd = curCmd
default: break
}
} else if curCmd.pointee.cmd == LC_SYMTAB {
symtabCmd = UnsafeMutablePointer<symtab_command>(OpaquePointer(curCmd))
Expand All @@ -70,7 +75,7 @@ private func replaceSymbolAtImage(
curCmdPointer += Int(curCmd.pointee.cmdsize)
}

if linkeditCmd == nil || symtabCmd == nil || dynamicSymtabCmd == nil || dataCmd == nil {
if linkeditCmd == nil || symtabCmd == nil || dynamicSymtabCmd == nil || (dataCmd == nil && dataConstCmd == nil) {
return
}

Expand All @@ -83,15 +88,18 @@ private func replaceSymbolAtImage(
return
}

for tmp in 0..<dataCmd.pointee.nsects {
let curSection = UnsafeMutableRawPointer(dataCmd).advanced(by: MemoryLayout<segment_command_64>.size + MemoryLayout<section_64>.size*Int(tmp)).assumingMemoryBound(to: section_64.self)

// symbol_pointers sections
if curSection.pointee.flags == S_LAZY_SYMBOL_POINTERS {
replaceSymbolPointerAtSection(curSection, symtab: symtab!, strtab: strtab!, indirectsym: indirectsym!, slide: slide, symbolName: symbol, newMethod: newMethod, oldMethod: &oldMethod)
}
if curSection.pointee.flags == S_NON_LAZY_SYMBOL_POINTERS {
replaceSymbolPointerAtSection(curSection, symtab: symtab!, strtab: strtab!, indirectsym: indirectsym!, slide: slide, symbolName: symbol, newMethod: newMethod, oldMethod: &oldMethod)
for segment in [dataCmd, dataConstCmd] {
guard let segment else { continue }
for tmp in 0..<segment.pointee.nsects {
let curSection = UnsafeMutableRawPointer(segment).advanced(by: MemoryLayout<segment_command_64>.size + MemoryLayout<section_64>.size*Int(tmp)).assumingMemoryBound(to: section_64.self)

// symbol_pointers sections
if curSection.pointee.flags == S_LAZY_SYMBOL_POINTERS {
replaceSymbolPointerAtSection(curSection, symtab: symtab!, strtab: strtab!, indirectsym: indirectsym!, slide: slide, symbolName: symbol, newMethod: newMethod, oldMethod: &oldMethod)
}
if curSection.pointee.flags == S_NON_LAZY_SYMBOL_POINTERS {
replaceSymbolPointerAtSection(curSection, symtab: symtab!, strtab: strtab!, indirectsym: indirectsym!, slide: slide, symbolName: symbol, newMethod: newMethod, oldMethod: &oldMethod)
}
}
}
}
Expand All @@ -116,14 +124,23 @@ private func replaceSymbolPointerAtSection(

for tmp in 0..<Int(section.pointee.size)/MemoryLayout<UnsafeMutableRawPointer>.size {
let curIndirectSym = indirectSymVmAddr.advanced(by: tmp)
if curIndirectSym.pointee == INDIRECT_SYMBOL_ABS || curIndirectSym.pointee == INDIRECT_SYMBOL_LOCAL {
if curIndirectSym.pointee & UInt32(INDIRECT_SYMBOL_ABS) != 0 || curIndirectSym.pointee & ~UInt32(INDIRECT_SYMBOL_ABS) == INDIRECT_SYMBOL_LOCAL {
continue
}
let curStrTabOff = symtab.advanced(by: Int(curIndirectSym.pointee)).pointee.n_un.n_strx
let curSymbolName = strtab.advanced(by: Int(curStrTabOff+1))
if String(cString: curSymbolName) == symbolName {
oldMethod = sectionVmAddr!.advanced(by: tmp).pointee
sectionVmAddr!.advanced(by: tmp).initialize(to: newMethod)
let err = vm_protect(
mach_task_self_,
.init(bitPattern: sectionVmAddr),
numericCast(section.pointee.size),
0,
VM_PROT_READ | VM_PROT_WRITE | VM_PROT_COPY
)
if err == KERN_SUCCESS {
sectionVmAddr!.advanced(by: tmp).initialize(to: newMethod)
}
break
}
}
Expand Down
Loading