Ptrace 已经hook,寄存器也给设置好。 依然错误码 status=45(0x0000002d)


#1

反调试,直接debug -a 连接错误是:Segmentation fault: 11。 如果用debugserver -x auto启动则错误码:Process 2478 exited with status = 45 (0x0000002d)
然后:
1.我把ptrace打断点,寄存器改值,依然是45错误。
2.用monkeyApp启动,日志显示为下图。但是仍然不允许调试。


然后:
我在lldb启动时候打断点, 一直ni下去,最后崩溃日志为:

  • thread #1, queue = ‘com.apple.main-thread’, stop reason = instruction step over
    frame #0: 0x0000000182b975c8 libobjc.A.dylibload_images + 80 libobjc.A.dylibload_images:
    -> 0x182b975c8 <+80>: add x0, x0, #0xf48 ; =0xf48
    0x182b975cc <+84>: ldp x29, x30, [sp, #0x10]
    0x182b975d0 <+88>: ldp x20, x19, [sp], #0x20
    0x182b975d4 <+92>: b 0x182b9fba4 ; recursive_mutex_tt::unlock()
    Target 0: (WeChat) stopped.
    (lldb)
    Process 2478 stopped
  • thread #1, queue = ‘com.apple.main-thread’, stop reason = instruction step over
    frame #0: 0x0000000182b975cc libobjc.A.dylibload_images + 84 libobjc.A.dylibload_images:
    -> 0x182b975cc <+84>: ldp x29, x30, [sp, #0x10]
    0x182b975d0 <+88>: ldp x20, x19, [sp], #0x20
    0x182b975d4 <+92>: b 0x182b9fba4 ; recursive_mutex_tt::unlock()
    0x182b975d8 <+96>: ldp x29, x30, [sp, #0x10]
    Target 0: (WeChat) stopped.
    (lldb)
    Process 2478 stopped
  • thread #1, queue = ‘com.apple.main-thread’, stop reason = instruction step over
    frame #0: 0x0000000182b975d0 libobjc.A.dylibload_images + 88 libobjc.A.dylibload_images:
    -> 0x182b975d0 <+88>: ldp x20, x19, [sp], #0x20
    0x182b975d4 <+92>: b 0x182b9fba4 ; recursive_mutex_tt::unlock()
    0x182b975d8 <+96>: ldp x29, x30, [sp, #0x10]
    0x182b975dc <+100>: ldp x20, x19, [sp], #0x20
    Target 0: (WeChat) stopped.
    (lldb)
    Process 2478 stopped
  • thread #1, queue = ‘com.apple.main-thread’, stop reason = instruction step over
    frame #0: 0x0000000182b975d4 libobjc.A.dylibload_images + 92 libobjc.A.dylibload_images:
    -> 0x182b975d4 <+92>: b 0x182b9fba4 ; recursive_mutex_tt::unlock()
    0x182b975d8 <+96>: ldp x29, x30, [sp, #0x10]
    0x182b975dc <+100>: ldp x20, x19, [sp], #0x20
    0x182b975e0 <+104>: ret
    Target 0: (WeChat) stopped.
    (lldb)
    Process 2478 stopped
  • thread #1, queue = ‘com.apple.main-thread’, stop reason = instruction step over
    frame #0: 0x0000000104ae8f18 dyldImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 348 dyldImageLoader::recursiveInitialization:
    -> 0x104ae8f18 <+348>: ldr x8, [x19]
    0x104ae8f1c <+352>: ldr x8, [x8, #0x2c8]
    0x104ae8f20 <+356>: mov x0, x19
    0x104ae8f24 <+360>: mov x1, x21
    Target 0: (WeChat) stopped.
    (lldb)
    Process 2478 stopped
  • thread #1, queue = ‘com.apple.main-thread’, stop reason = instruction step over
    frame #0: 0x0000000104ae8f1c dyldImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 352 dyldImageLoader::recursiveInitialization:
    -> 0x104ae8f1c <+352>: ldr x8, [x8, #0x2c8]
    0x104ae8f20 <+356>: mov x0, x19
    0x104ae8f24 <+360>: mov x1, x21
    0x104ae8f28 <+364>: blr x8
    Target 0: (WeChat) stopped.
    (lldb) register read
    General Purpose Registers:
    x0 = 0x000000000000001e
    x1 = 0x0000000104b14c5b dyldinitialPoolContent + 37515 x2 = 0x00000000bdc23169 x3 = 0x000000000000001e x4 = 0x0000000000000057 x5 = 0x0000000000000039 x6 = 0x0000000000000000 x7 = 0x00000000000003a0 x8 = 0x0000000104b08d80 dyldvtable for ImageLoaderMachOCompressed + 16
    x9 = 0x0000000000000025
    x10 = 0x0000000000000250
    x11 = 0x0000000000000000
    x12 = 0x0000120000001303
    x13 = 0x0000000000000000
    x14 = 0x0000130000001300
    x15 = 0x0000000000000000
    x16 = 0x0000000000001300
    x17 = 0x0000000000000080
    x18 = 0x0000000000000000
    x19 = 0x0000000104b14b08 dyldinitialPoolContent + 37176 x20 = 0x000000016fda8bc0 x21 = 0x0000000104b09838 dyld::gLinkContext x22 = 0x00000094e99b2228 x23 = 0x0000000000000403 x24 = 0x000000000000000c x25 = 0x0000000104b30290 dyldinitialPoolContent + 149696
    x26 = 0x0000000035180c28
    x27 = 0x0000000104ae8dbc dyldImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) x28 = 0x0000000104b09000 dyldvtable for ImageLoaderMachOCompressed + 656
    fp = 0x000000016fda6250
    lr = 0x0000000104ae8f18 dyldImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 348 sp = 0x000000016fda61f0 pc = 0x0000000104ae8f1c dyldImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 352
    cpsr = 0x80000000

(lldb) ni
Process 2478 stopped

  • thread #1, queue = ‘com.apple.main-thread’, stop reason = instruction step over
    frame #0: 0x0000000104ae8f20 dyldImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 356 dyldImageLoader::recursiveInitialization:
    -> 0x104ae8f20 <+356>: mov x0, x19
    0x104ae8f24 <+360>: mov x1, x21
    0x104ae8f28 <+364>: blr x8
    0x104ae8f2c <+368>: mov x23, x0
    Target 0: (WeChat) stopped.
    (lldb) register read
    General Purpose Registers:
    x0 = 0x000000000000001e
    x1 = 0x0000000104b14c5b dyldinitialPoolContent + 37515 x2 = 0x00000000bdc23169 x3 = 0x000000000000001e x4 = 0x0000000000000057 x5 = 0x0000000000000039 x6 = 0x0000000000000000 x7 = 0x00000000000003a0 x8 = 0x0000000104aedb60 dyldImageLoaderMachO::doInitialization(ImageLoader::LinkContext const&)
    x9 = 0x0000000000000025
    x10 = 0x0000000000000250
    x11 = 0x0000000000000000
    x12 = 0x0000120000001303
    x13 = 0x0000000000000000
    x14 = 0x0000130000001300
    x15 = 0x0000000000000000
    x16 = 0x0000000000001300
    x17 = 0x0000000000000080
    x18 = 0x0000000000000000
    x19 = 0x0000000104b14b08 dyldinitialPoolContent + 37176 x20 = 0x000000016fda8bc0 x21 = 0x0000000104b09838 dyld::gLinkContext x22 = 0x00000094e99b2228 x23 = 0x0000000000000403 x24 = 0x000000000000000c x25 = 0x0000000104b30290 dyldinitialPoolContent + 149696
    x26 = 0x0000000035180c28
    x27 = 0x0000000104ae8dbc dyldImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) x28 = 0x0000000104b09000 dyldvtable for ImageLoaderMachOCompressed + 656
    fp = 0x000000016fda6250
    lr = 0x0000000104ae8f18 dyldImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 348 sp = 0x000000016fda61f0 pc = 0x0000000104ae8f20 dyldImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 356
    cpsr = 0x80000000

(lldb) ni
Process 2478 stopped

  • thread #1, queue = ‘com.apple.main-thread’, stop reason = instruction step over
    frame #0: 0x0000000104ae8f24 dyldImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 360 dyldImageLoader::recursiveInitialization:
    -> 0x104ae8f24 <+360>: mov x1, x21
    0x104ae8f28 <+364>: blr x8
    0x104ae8f2c <+368>: mov x23, x0
    0x104ae8f30 <+372>: mov w8, #0x32
    Target 0: (WeChat) stopped.
    (lldb) ni
    Process 2478 stopped
  • thread #1, queue = ‘com.apple.main-thread’, stop reason = instruction step over
    frame #0: 0x0000000104ae8f28 dyldImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 364 dyldImageLoader::recursiveInitialization:
    -> 0x104ae8f28 <+364>: blr x8
    0x104ae8f2c <+368>: mov x23, x0
    0x104ae8f30 <+372>: mov w8, #0x32
    0x104ae8f34 <+376>: strb w8, [x19, #0x44]
    Target 0: (WeChat) stopped.
    (lldb) register read
    General Purpose Registers:
    x0 = 0x0000000104b14b08 dyldinitialPoolContent + 37176 x1 = 0x0000000104b09838 dyld::gLinkContext x2 = 0x00000000bdc23169 x3 = 0x000000000000001e x4 = 0x0000000000000057 x5 = 0x0000000000000039 x6 = 0x0000000000000000 x7 = 0x00000000000003a0 x8 = 0x0000000104aedb60 dyldImageLoaderMachO::doInitialization(ImageLoader::LinkContext const&)
    x9 = 0x0000000000000025
    x10 = 0x0000000000000250
    x11 = 0x0000000000000000
    x12 = 0x0000120000001303
    x13 = 0x0000000000000000
    x14 = 0x0000130000001300
    x15 = 0x0000000000000000
    x16 = 0x0000000000001300
    x17 = 0x0000000000000080
    x18 = 0x0000000000000000
    x19 = 0x0000000104b14b08 dyldinitialPoolContent + 37176 x20 = 0x000000016fda8bc0 x21 = 0x0000000104b09838 dyld::gLinkContext x22 = 0x00000094e99b2228 x23 = 0x0000000000000403 x24 = 0x000000000000000c x25 = 0x0000000104b30290 dyldinitialPoolContent + 149696
    x26 = 0x0000000035180c28
    x27 = 0x0000000104ae8dbc dyldImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) x28 = 0x0000000104b09000 dyldvtable for ImageLoaderMachOCompressed + 656
    fp = 0x000000016fda6250
    lr = 0x0000000104ae8f18 dyldImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 348 sp = 0x000000016fda61f0 pc = 0x0000000104ae8f28 dyldImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int, char const*, ImageLoader::InitializerTimingList&, ImageLoader::UninitedUpwards&) + 364
    cpsr = 0x80000000

(lldb) ni
Process 2478 exited with status = 45 (0x0000002d)
环境: iphone6p 10.1 越狱


#2

已经不知道从哪着手了。 调用系统的dyld ImageLoaderMachO::doInitialization(ImageLoader::LinkContext const&)这个,怎么会反调试。还报错ptrace相关的status呢。 麻烦大神给指指路!感谢!


#3

Inline Ptrace吧,看看有没有svc 0x80指令


#4

全局搜一遍有没有svc 0x80指令。确实搜到了很多svc 0x80。有点没明白原理,既然还是通过中断,最后inline ptrace不还是调用ptrace吗? Monkey的Anti不是已经hook了系统的ptrace吗? 为什么不行? (ps.请问应该怎么办?直接全部nop?那如果作者 使用 svc 实现一个小功能, 之后检测 x0 返回值 呢)


#5

他hook的是用户态的库里的函数。。。不是hook的中断


#6

没太理解,我需要补充点原理知识了。Anti不是hook了系统调用ptrace吗? 就算用inline ptrace,不还是要调用系统的ptrace吗? (请问目前现在搜出来很多svc 0x80,特别多。 应该怎么处理?)


#7

啊?你在说啥?您能不能重新组织自己的语言。现在单纯阅读您的发帖就让我得了癌症


#8

你知道syscall是什么吗。你知道hook原理是什么吗?


#9

简单的说,所有这些函数都是系统调用的封装


#10

这些函数调用syscall这个函数,这个syscall函数是汇编实现的svc 0x80的封装


#11

MonkeyDev只是hook了最外面的函数,但是直接用svc 0x80他并没有处理


#12

对给您带来的不便抱歉。想了解多一些原理,说的有点急。
1.monkeyApp 不是已经hook了ptrace吗?就算是inline ptrace 通过svc 0x80, 难道最后不是调用系统的ptrace吗?比如下图:

,最后不还是调用ptrace吗?为什么没用。

  1. 如果直接把svc x80全部替换成 nop,有时候也不能绕过。比如作者用svc实现一个小功能, 来防止暴力■■svc patch with nop

不知道我说得清楚一点了没,多担待。如有讲得不明白的地方,烦请指出,我巩固一下知识再继续表达。


#13

没事,癌症那段我是开玩笑的。

你理解一下我上面说的话,md只是hook了ptrace这个函数,但这个函数最后是通过svc 0x80来实现它的功能的。你贴的汇编就相当于自己实现了一个汇编级的ptrace 31 0 0 0 ,所以他hook的函数跟这个没关系


#14

是的,所以需要其他的解决方案来判断每个使用svc 0x80的地方是不是反调试,hookzz可以做到这一点


#15

不过,99%的市面上的应用程序猿都只会从网上随便找段你贴的代码粘贴用,所以一般情况下无脑patch成nop就够了


#16

我看了所有的svc 0x80的汇编代码,有一处确实是上面我贴的那个图。如下图:
image
但是有其他五六个,调用的都是不同的系统调用。比如:
image ,还有这样连续的不同svc:image


#17

原理上还是有点迷惑:

  1. md只是hook了ptrace这个函数1,这个函数1不是系统调用里面的ptrace函数2吗? 函数1和函数2不是一个东西?
  2. 所以调用ptrace 和 汇编自己实现一个ptrace 31 0 0 0 ,调用的分别是函数1和函数2?
  3. 函数1和函数2 有什么区别和联系。

ps. 有什么更方便的交流方式吗? 请问您能加我的qq联系方式吗,642090171?


#18

函数2就不存在,或者说不存在于用户态。你的函数2是内核里的一个函数你就没法通过正常途径hook,svc 0x80的作用只是切换到内核让内核执行那个函数而已。


#19

通过dlope、dlysm 调用的ptrace 是函数1? 自己汇编实现的ptrace 31 是让系统内核去执行函数2。 (ptrace 有用户态 和 内核态 两种身份?)
再请教一个问题,我去哪里、哪些书补充这些知识。有推荐吗?(刚看完ios逆向工程 和 ios应用逆向与安全 。 还有什么系统的进阶资料吗? (例如:《编译、链接和执行》,arm架构。。。 )烦请推荐,指点一下。


#20
通过dlope、dlysm 调用的ptrace 是函数1? 自己汇编实现的ptrace 31 是让系统内核去执行函数2。

错,你dlsym出来的那个ptrace也只是通过汇编让内核执行函数2

 (ptrace 有用户态 和 内核态 两种身份?)