请教MSHookFunction闪退问题

技能讨论
1

按照这个帖子http://www.iosre.com/t/7-2-0-ios/770的方式hook一个sub_xxx函数，app启动闪退，crashlog显示EXC_BAD_ACCESS，请问可能是哪里出了问题
需求：hook一个hopper反编译得到的一个sub_xxx函数
操作步骤：编写tweak，安装，启动app

代码：
void (*old_sub_ACF0)(void *);
void new_sub_ACF0(void *hiddenThis)
{
NSLog(@“iOSRE: anti-anti-debugging”);
old_sub_ACF0(hiddenThis);
}

%ctor
{
@autoreleasepool
{
unsigned long _sub_ACF0 = (_dyld_get_image_vmaddr_slide(0) + 0x1867c) | 0x1;
if (_sub_ACF0) NSLog(@“iOSRE: Found sub_ACF0!”);
MSHookFunction((void *)_sub_ACF0, (void *)&new_sub_ACF0, (void **)&old_sub_ACF0);
}
}

闪退日志：
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x000000000007867d
Termination Signal: Segmentation fault: 11
Termination Reason: Namespace SIGNAL, Code 0xb
Terminating Process: exc handler [0]
Triggered by Thread: 0

Filtered syslog:
None found

Thread 0 name: Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0 CydiaSubstrate 0x0000000101c40350 0x101c2c000 + 82768
1 TestTweak.dylib 0x0000000101c23ee0 0x101c20000 + 16096
2 dyld 0x0000000101af995c ImageLoaderMachO::doModInitFunctions+ 88412 (ImageLoader::LinkContext const&) + 372
3 dyld 0x0000000101af9b84 ImageLoaderMachO::doInitialization+ 88964 (ImageLoader::LinkContext const&) + 36
4 dyld 0x0000000101af4f2c ImageLoader::recursiveInitialization+ 69420 (ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 368
5 dyld 0x0000000101af3f50 ImageLoader::processInitializers+ 65360 (ImageLoader::LinkContext const&, unsigned int, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 140
6 dyld 0x0000000101af4004 ImageLoader::runInitializers+ 65540 (ImageLoader::LinkContext const&, ImageLoader::InitializerTimingList&) + 84
7 dyld 0x0000000101ae97dc dyld::runInitializers+ 22492 (ImageLoader*) + 88
8 dyld 0x0000000101aee888 dlopen + 1032
9 libdyld.dylib 0x000000018c0bad5c dlopen + 76
10 SubstrateLoader.dylib 0x0000000101bb5acc 0x101bb4000 + 6860
11 dyld 0x0000000101af995c ImageLoaderMachO::doModInitFunctions+ 88412 (ImageLoader::LinkContext const&) + 372
12 dyld 0x0000000101af9b84 ImageLoaderMachO::doInitialization+ 88964 (ImageLoader::LinkContext const&) + 36
13 dyld 0x0000000101af4f2c ImageLoader::recursiveInitialization+ 69420 (ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 368
14 dyld 0x0000000101af3f50 ImageLoader::processInitializers+ 65360 (ImageLoader::LinkContext const&, unsigned int, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 140
15 dyld 0x0000000101af4004 ImageLoader::runInitializers+ 65540 (ImageLoader::LinkContext const&, ImageLoader::InitializerTimingList&) + 84
16 dyld 0x0000000101ae97dc dyld::runInitializers+ 22492 (ImageLoader*) + 88
17 dyld 0x0000000101aee888 dlopen + 1032
18 libdyld.dylib 0x000000018c0bad5c dlopen + 76
19 dyld 0x0000000101af995c ImageLoaderMachO::doModInitFunctions+ 88412 (ImageLoader::LinkContext const&) + 372
20 dyld 0x0000000101af9b84 ImageLoaderMachO::doInitialization+ 88964 (ImageLoader::LinkContext const&) + 36
21 dyld 0x0000000101af4f2c ImageLoader::recursiveInitialization+ 69420 (ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 368
22 dyld 0x0000000101af3f50 ImageLoader::processInitializers+ 65360 (ImageLoader::LinkContext const&, unsigned int, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 140
23 dyld 0x0000000101af4004 ImageLoader::runInitializers+ 65540 (ImageLoader::LinkContext const&, ImageLoader::InitializerTimingList&) + 84
24 dyld 0x0000000101ae6438 dyld::initializeMainExecutable+ 9272 () + 140
25 dyld 0x0000000101aea8f4 dyld::_main+ 26868 (macho_header const*, unsigned long, int, char const**, char const**, char const**, unsigned long*) + 3892
26 dyld 0x0000000101ae5044 _dyld_start + 68

2

把那个神奇的 | 0x01 去掉看看呢，或者 debugserver 挂上去，dis -a 反汇编一下那个地址看看是不是 sub 函数的真实位置。

3

函数地址是从hopper找到的，一部分代码如下，回复不能贴图，不知道为啥
sub_1867c:
0001867c push {r4, r5, r6, r7, lr} ; CODE XREF=sub_18b34
0001867e add r7, sp, #0xc
00018680 push.w {r8, sl, fp}
00018684 sub.w r4, sp, #0x40
00018688 bfc r4, #0x0, #0x4
0001868c mov sp, r4
0001868e vst1.64 {d8, d9, d10, d11}, [r4, #0x80]!
00018692 vst1.64 {d12, d13, d14, d15}, [r4, #0x80]
00018696 sub sp, #0xa0
00018698 movw r1, #0xb966 ; :lower16:(0x15f400c - 0x186a6)
0001869c movt r1, #0x15d ; :upper16:(0x15f400c - 0x186a6)
000186a0 str r0, [sp, #0xb8 + var_A0] ; DATA XREF=sub_61663c+152, sub_6183c0+416, sub_6183c0+2182, sub_61b27a+30, sub_61b27a+84, sub_61b27a+1254, sub_61b27a+1356
000186a2 add r1, pc ; 0x15f400c
000186a4 ldr r0, [sp, #0xb8 + var_A0]
000186a6 ldr r1, [r1] ; 0x15f400c,0x16879f0
000186a8 str r1, [r0]

4

0x01试过去掉了一样启动app闪退

5

你是 32 位机器还是 64 位的，如果是后者这个虚拟地址看起来少了 0x100000000

1 个赞
6

厉害了，确实是64位执行环境，从iPhone4s导出的32位可执行文件找到的函数地址0x1867c，我把tweak放到iPhone5s的64位环境执行了