使用MSHookFunction失效，百般怀疑下，决定从头开始试试，找到了这个Demo，但我依然不能hook成功，百思不得其解，来请教各位大牛。
- 我有搜过论坛中有相关帖子，在我的机器上依然不能hook相关函数。
- 我利用Xcode11.3.1 (11C504)编译了Demo中的MyApp的ipa包，然后利用MonkeyDev注入Dylib的方式成功运行到iPhone XsMax 13.5的越狱设备上，
原始函数
void testMethod(void) {
UIAlertView *alert = [[UIAlertView alloc] initWithTitle:@"title" message:@"message" delegate:nil cancelButtonTitle:nil otherButtonTitles:@"other", nil];
[alert show];
}
反编译代码
sub_1000067ec:
00000001000067ec sub sp, sp, #0x30 ; CODE XREF=-[ViewController btnClick]
00000001000067f0 stp x20, x19, [sp, #0x10]
00000001000067f4 stp x29, x30, [sp, #0x20]
00000001000067f8 add x29, sp, #0x20
00000001000067fc nop
0000000100006800 ldr x0, =_OBJC_CLASS_$_UIAlertView ; _OBJC_CLASS_$_UIAlertView
0000000100006804 bl imp___stubs__objc_alloc ; objc_alloc
0000000100006808 nop
000000010000680c ldr x1, =aInitwithtitlem ; "initWithTitle:message:delegate:cancelButtonTitle:otherButtonTitles:",@selector(initWithTitle:message:delegate:cancelButtonTitle:otherButtonTitles:)
0000000100006810 adr x2, #0x100008058 ; @"title"
0000000100006814 nop
0000000100006818 str xzr, [sp, #0x20 + var_20]
000000010000681c adr x3, #0x100008078 ; @"message"
0000000100006820 nop
0000000100006824 adr x6, #0x100008098 ; @"other"
0000000100006828 nop
000000010000682c movz x4, #0x0
0000000100006830 movz x5, #0x0 ; argument "instance" for method imp___stubs__objc_msgSend
0000000100006834 bl imp___stubs__objc_msgSend ; objc_msgSend
0000000100006838 mov x19, x0
000000010000683c nop
0000000100006840 ldr x1, =aShow ; "show",@selector(show)
0000000100006844 bl imp___stubs__objc_msgSend ; objc_msgSend
0000000100006848 mov x0, x19
000000010000684c ldp x29, x30, [sp, #0x20]
0000000100006850 ldp x20, x19, [sp, #0x10]
0000000100006854 add sp, sp, #0x30
0000000100006858 b imp___stubs__objc_release ; objc_release
hook代码如下
intptr_t g_slide;
//保存模块偏移基地址的值
static void _register_func_for_add_image(const struct mach_header *header, intptr_t slide) {
Dl_info image_info;
int result = dladdr(header, &image_info);
if (result == 0) {
NSLog(@"load mach_header failed");
return;
}
//获取当前的可执行文件路径
NSString *execName = [[[NSBundle mainBundle] infoDictionary] objectForKey:@"CFBundleExecutable"];
NSString *execPath = [[[NSBundle mainBundle] bundlePath] stringByAppendingFormat:@"/%@", execName];
if (strcmp([execPath UTF8String], image_info.dli_fname) == 0) {
g_slide = slide;
}
}
void (*orig_testMethod)(void);
void hook_testMethod(void);
void hook_testMethod() {
UIAlertView *alert = [[UIAlertView alloc] initWithTitle:@"hook了我" message:@"message" delegate:nil cancelButtonTitle:nil otherButtonTitles:@"other", nil];
[alert show];
}
static void __attribute__((constructor)) __init__() {
_dyld_register_func_for_add_image(_register_func_for_add_image);
NSLog(@"[kinglog] slide ptr:%p",(g_slide+0x1000067ec));
MSHookFunction((void *)(g_slide+0x1000067ec), (void *)hook_testMethod, (void **)&orig_testMethod);
}
疑问
- 0x1000067ec此地址就是我编译出来的ipa包中的方法地址，kinglog打印的地址减去基地址（image list -o -f获取的）也是0x1000067ec（所以看起来地址貌似没问题）
- hook前后的函数的开头的指令（x/5i命令获取的）是一致的（没有hook成功），是MSHookFunction不支持iOS13吗？好奇怪。
- 折腾了一下午，依然没有进展，抽了一包烟都没看出问题在哪。我迷茫了。。。
很久了， 今天开发又遇到了这个问题才想起来还没解决