关于hook掉sysctl反调试的问题

技能讨论
1

想直接hook掉sysctl函数，在hook函数执行原sysctl函数，再把info.kp_proc.p_flag直接赋值 = 0；但是一直编译不过去：
member reference base type 'void' is not a structure or union
，我应该怎么改呢？(c++弱鸡求指导下。。。)

#include <sys/types.h>
#include <sys/sysctl.h>
#import <substrate.h>


int (*old_sysctlHook)(int *a, u_int mib, void *info, size_t *size, void *e, size_t f);

int sysctlHook(int *a, u_int mib, void *info, size_t *size, void *e, size_t f) {
    printf("--------hooksysctlSuccess-------");

    int value =  old_sysctlHook(a,mib,info,size,e,f);

    info.kp_proc.p_flag = 0;

    return value;
}

%ctor {
    MSHookFunction((int *)MSFindSymbol(NULL,"_sysctl"), (int *)sysctlHook, (int **)&old_sysctlHook);
}
2 
#include <sys/types.h>
#include <sys/sysctl.h>
#import <substrate.h>


int (*old_sysctlHook)(int *a, u_int mib, struct kinfo_proc* info, size_t *size, void *e, size_t f);

int sysctlHook(int *a, u_int mib,  struct kinfo_proc* info, size_t *size, void *e, size_t f) {
    printf("--------hooksysctlSuccess-------");

    int value =  old_sysctlHook(a,mib,info,size,e,f);

    info.kp_proc.p_flag = 0;

    return value;
}

%ctor {
    MSHookFunction((void *)sysctl, (void *)sysctlHook, (void **)&old_sysctlHook);
}
3

这个我尝试过了，编译报错：
member reference type 'struct kinfo_proc *' is a pointer; did you mean to use '->'?
然后我又改成:
info->kp_proc->p_flag = 0;
又报错：
member reference type 'struct extern_proc' is not a pointer; did you mean to use '.'?
好气啊

4

好吧，我智障了，我改成这样编译过了：
info->kp_proc.p_flag = 0;