MSHookFunction not work in arm64?


#1

RootViewController.mm

class CPPClass
{
public:
  void CPPFuntion(const char *);
};
void CPPClass::CPPFuntion(const char* arg)
{
  int a = 10;
  int b = 20;
  int c = 30;
  b += a;
  c += b;
  for (int i = 0; i< 10; i++)
  {
    u_int32_t randomNumber;
    if(i%3 == 0 ) randomNumber = arc4random_uniform(i);
    NSProcessInfo *processInfo = [NSProcessInfo processInfo];
    NSString *hostName = processInfo.hostName;
    int pid = processInfo.processIdentifier;
    NSLog(@"%d %@",pid,hostName);

    c += b;
    c *= b;
    c -=a;
    c *=a;
    c *=b; c += b;
    c *= b;
    c -=a;
    c *=a;
    c *=b; c += b;
    c *= b;
    c -=a;
    c *=a;
    c *=b; c += b;
    c *= b;
    c -=a;
    c *=a;
    c *=b; c += b;
    c *= b;
    c -=a;
    c *=a;
    c *=b; c += b;
    c *= b;
    c -=a;
    c *=a;
    c *=b;
  }
  NSLog(@"CPPFuntion:%s",arg);
}

- (void)viewDidLoad
{
  [super viewDidLoad];

  NSLog(@"viewDidLoad");
    CPPClass cppClass;
    cppClass.CPPFuntion("doesn't tweak");

    CFunction("doesn't tweak");
}

Tweak.xm

%hook RootViewController
- (void)viewDidLoad
{
  %orig;
  NSLog(@"hook viewDidLoad success");
  old_CFunction("old_CFunction in viewDidLoad");
  new_CFunction("xxxxxxxx");
}
%end

%ctor
{
  NSLog(@"walk in ctor");
  @autoreleasepool
  {
    MSImageRef image = MSGetImageByName("/Applications/Test.app/Test");
    void *__CPPFunctionSymbol = MSFindSymbol(image, "__ZN8CPPClass10CPPFuntionEPKc");
    if(__CPPFunctionSymbol)
    {
      NSLog(@" found CPPFuntion");
      MSHookFunction(__CPPFunctionSymbol,(void *)&new_CPPFunction,(void **)&old_CPPFunction);
      NSLog(@"cppSymbol is %p function is %p  old_funtion is %p",__CPPFunctionSymbol,new_CPPFunction,old_CPPFunction);
    }

    void *__CFunctionSymbol = MSFindSymbol(image, "_CFunction");
    if(__CFunctionSymbol)
    {
      NSLog(@" found CFuntion");
      MSHookFunction(__CFunctionSymbol,(void*)&new_CFunction,(void**)&old_CFunction);
      NSLog(@"CSymbol is %p function is %p  old_funtion is %p",__CFunctionSymbol,new_CFunction,old_CFunction);
      //new_CFunction("new hello world");
      //old_CFunction("old hello world");
    }

    /*
    void *__CShortFunctionSymbol = MSFindSymbol(image, "_CShortFunction");
    if(__CShortFunctionSymbol)
    {
      NSLog(@" found CShortFuntion");
      MSHookFunction(__CShortFunctionSymbol,(void*)&new_CShortFunction,(void**)&old_CShortFunction);
    }
    */

  }
}

log

Jul 31 11:00:30 Chans-5s Test[1023] <Warning>: viewDidLoad
Jul 31 11:00:30 Chans-5s Test[1023] <Warning>: hook viewDidLoad success
Jul 31 11:00:30 Chans-5s Test[1023] <Warning>: CFuntion1987:old_CFunction in viewDidLoad
Jul 31 11:00:30 Chans-5s Test[1023] <Warning>: CFuntion1987:hijack CFunction old
Jul 31 11:00:30 Chans-5s Test[1023] <Warning>: Application windows are expected to have a root view controller at the end of application launch
Jul 31 11:00:30 Chans-5s locationd[103] <Notice>: Gesture EnabledForTopCLient: 0, EnabledInDaemonSettings: 0
Jul 31 11:00:31 Chans-5s kernel[0] <Notice>: ART: 30 4d 02 01 00 30 26 02 03 01 66 9c 04 14 6e aa b3 13 72 8f 96 bc 1a f5 dc b5 fb 63 75 b6 f5 f4 51 e0 04 00 04 00 31 05 c0 03 01 5d 99 04 20 f4 fc ba 11 27 e8 0e e2 48 b4 14 32 18 43 e7 b5 20 ed 1e 20 30 f6 a5 74 09 49 90 3c 20 63 bf 1d 
Jul 31 11:00:31 Chans-5s cloudd[588] <Notice>: (Note ) MC: User has completed cloud configuration. Not showing UI again.
Jul 31 11:00:43 Chans-5s locationd[103] <Notice>: NETWORK: no response from server, reachability, 2, queryRetries, 0
Jul 31 11:00:51 Chans-5s kernel[0] <Notice>: 003343.016772 wlan0.A[73] AppleBCMWLANCore::dumpWmeCounters():  per AC tx counters: 8367 6878 103 300, rx counters: 19514 0 0 59 
Jul 31 11:00:51 Chans-5s kernel[0] <Notice>: 003343.016802 wlan0.A[74] AppleBCMWLANCore::dumpWmeCounters():                AWDL: Tx 54 0 0 0      Rx: 175 0 0 0 
Jul 31 11:00:52 Chans-5s locationd[103] <Notice>: NETWORK: requery, 0, 0, 0, 0, 1, items, fQueryRetries, 1, fLastRetryTimestamp, 460004427.0
Jul 31 11:00:52 Chans-5s locationd[103] <Notice>: NETWORK: query, cells, 0, 0, 0, 0, wifis, 1
Jul 31 11:01:05 Chans-5s Test[1023] <Warning>: 1023 Chans-5s
Jul 31 11:01:05 Chans-5s Test[1023] <Warning>: CPPFuntion:doesn't tweak
Jul 31 11:01:05 Chans-5s Test[1023] <Warning>: CFuntion1987:doesn't tweak

观察结果, MSHookFunction(_CPPFunctionSymbol,(void *)&newCPPFunction,(void **)&old_CPPFunction);执行完,app中的old_xxx方法已经找到,但是没有hook上,%ctor已经运行,但原app调用时的还是原方法。

测试环境 iphone5s ios8.4
代码有点多。。。


#2

我也碰到了这个问题,使用MSHookFunction 在arm64的设备上hook sub_xxx类型的函数时总是崩溃,不知道是什么原因造成的,还望狗剩不吝赐教@snakeninny


#3

同样碰到MSHookFunction arm64 测试机上崩溃 有解决的么?


#4

@Young 貌似有解决方案


#5

MSHookFunction 在 ARM64上的地址不需要+0x1 或者 | 0x1


#6

调试起来看看,估计在对C++类的符号处理上有问题,你拿到的不是正确的地址,还有就是LLDB调试,check下你的C++类成员函数地址,check要修改的指令是否在一个短跳转表上,这样就不够空间可以修改跳转,PS:你可以打开MS的日志信息,然后查看下MSHookFunction函数hook失败原因;


#7

今天也遇到了,暂时还不知道怎么解决,mark一下


#8

hook总崩溃啊


#9

我用Young的方式对sub函数进行HOOK,但是好像时而work,时而不work。有人知道原因吗?
@snakeninny @Young 你们遇到过类似的问题吗?


#10

请问。IDA64 上面现实的 函数地址,需要加上 _dyld_get_image_header 偏移吗


#11

运行的是arm64位的 设备。


#13

请问。IDA64 上面现实的 函数地址,需要加上 _dyld_get_image_header 偏移吗,还是直接可以用IDA64地址hook呢


#14

需要加ASLR offset


#15

IDA32位上可以看到伪代码也能看到函数参数个数,和基本类型。现在在64位机子上想hook这个函数。怎么到IDA64上找到32位这个函数的对应地址呢。用IDA64位,打开不能看到伪代码了,然后地址也变了,然后看汇编有点吃力,有啥其他法子可以获取呢。


#16

打工是不可能打工的,这辈子不可能打工的。做生意又不会做,有什么办法可以赚钱呢?


#17

你说的对。解决了我的问题。


#18

我去,整个论坛里都是带 |0x1的代码,完全没有标注到arm64不需要带。哎,这个小问题浪费我一天的时间。。。。。


#19

你如果有认真看帖子,就不会有这疑问🤔️