Hook installd中的方法


#1

需求: hook installd中的方法
比如 [MIClientConnection _doInstallationForURL:withOptions:completion:]这个方法 , 打印方法中参数内容

操作步骤:

  1. 用ida分析 /usr/libexec/installd,看到 [MIClientConnection _doInstallationForURL:withOptions:completion:]这个方法

  2. 通过oslog看日志,配合LLDB查看,安装App的时候会执行_doInstallationForURL:withOptions:completion:这个方法

  3. 对installd写tweak(MSHookFunction 或者 Logos),然后通过oslog看日志,发现没有执行hook方法

日志:

Jan  3 15:12:50 test installd[647] <Notice>: 0x16dfc7000 -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/var/mobile/Library/Caches/com.apple.appstored/AppPlaceholders/-6680498241233546627.app" type Placeholder (LSInstallType = 1) requested by lsd (pid 78)

代码:

Tweak.xm(MSHookFunction)

void * (*old_symbol1)(void *, void *, void *);

void * new_symbol1(void * arg0, void * arg1, void * arg2) {
    NSLog(@"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
    NSLog(@"Hook!!!!!!!!!    %@", arg1);
    return old_symbol1(arg0, arg1, arg2);
}

void (*old_symbol2)(void *, void *, void *);

void new_symbol2(void * arg0, void * arg1, void * arg2) {
    NSLog(@"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
    NSLog(@"Hook!!!!!!!!!    %@", arg1);
    old_symbol2(arg0, arg1, arg2);
}

%ctor
{
    @autoreleasepool {
	    NSLog(@"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
	    MSImageRef image = MSGetImageByName("/usr/libexec/installd");
	    // void *symbol1 = MSFindSymbol(image, "__MIInstaller_initWithURL_options_forClient__");
	    void *symbol1 = MSFindSymbol(image, "initWithURL:options:forClient:");
	    if (symbol1) NSLog(@"Hook __MIInstaller_initWithURL_options_forClient__ !!!!!!!!!!");
	    MSHookFunction((void *)symbol1, (void *)&new_symbol1, (void **)&old_symbol1);
	
	    // void *symbol2 = MSFindSymbol(image, "__MIClientConnection__doInstallationForURL_withOptions_completion__");
	    void *symbol2 = MSFindSymbol(image, "_doInstallationForURL:withOptions:completion:");
	    if (symbol2) NSLog(@"Hook __MIClientConnection__doInstallationForURL_withOptions_completion__ !!!!!!!!!!");
	    MSHookFunction((void *)symbol2, (void *)&new_symbol2, (void **)&old_symbol2);
    }
}

Tweak.xm(Logos)

%hook MIClientConnection
- (void)_doInstallationForURL:(NSURL *)url withOptions:(NSDictionary *)options completion:(id)block {
    %orig;
    %log((NSString *)@"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
    %log((NSString *)@"iOSRE: MIClientConnection _doInstallationForURL", options);
}
%end

Makefile

include $(THEOS)/makefiles/common.mk

TWEAK_NAME = installTweak
installTweak_FILES = Tweak.xm
installTweak_CFLAGS += -fvisibility=hidden
isntallTweak_LIBRARIES = substrate
include $(THEOS_MAKE_PATH)/tweak.mk

after-install::
    install.exec "killall -9 installd"

installTweak.plist

{ Filter = { Executables = ( "installd" ); }; }

#2

我估计你还是没看懂appsync的注入方法


#3

用LLDB看,是注入成功的

[ 94] 0x00000001002ec000 /Library/MobileSubstrate/DynamicLibraries/installTweak.dylib(0x00000001002ec000)

我看了 AppSyncUnified.x,感觉差不多,都是先加载image,然后MSHookFunction


#4

注入成功就好办,慢慢调,日志可以输出到文件


#5

终于看到日志了。。。不过 hook 失败了。。。


#6

大佬,想问问deb安装之后运行就被Killed,签名什么都给了,还有什么原因吗


#7

不要随便一个帖子抓着就乱问好吧


#8

大佬,我想问下函数名的symbol怎么找,书上关于MobileSubstrate的例子里用IDA找的是

__ZN8CPPClass11CPPFunctionEPKc, _CFunction, _ShortCFunction 

我用IDA找的symbol是

__MIInstaller_initWithURL_options_forClient__

但是提示我 hook 失败了

image


#9

这是oc method, 你需要看源码理解一下MSFindSymbol原理

logos 编译出来的 bin 你 IDA 打开看下, 他是怎么实现的


#10

确实搞混了,用Logos来 hook oc method 能成功 hook

还是要去看看原理多了解一些

非常感谢大佬的指导,有思路之后好办多了 :grinning: