Anti-Anti dylib（反 反-dylib钩子（Anti-tweak））

版主提供了 anti dylib 的文章，http://bbs.chinapyg.com/thread-76158-1-1.html
原理很简单，看下面源代码即可~ 　　　　

在Build Settings中找到“Other Linker Flags”
在其中加上

-Wl,-sectcreate,__RESTRICT,__restrict,/dev/null

用IDA 载入 /usr/lib/dyld 分析 -- 我的版本是ios7.1.2
结合源代码观看 http://www.opensource.apple.com/source/dyld/dyld-353.2.1/src/dyld.cpp

下面是我拎出来的相关片段：

//
// Look for a special segment in the mach header.
// Its presences means that the binary wants to have DYLD ignore
// DYLD_ environment variables.
//

// 检测目标bin中是否存在 __RESTRICT 或 __restrict 节
static bool hasRestrictedSegment(const macho_header* mh)
{
const uint32_t cmd_count = mh->ncmds;
const struct load_command* const cmds = (struct load_command*)(((char*)mh)+sizeof(macho_header));
const struct load_command* cmd = cmds;
for (uint32_t i = 0; i < cmd_count; ++i) {
switch (cmd->cmd) {
case LC_SEGMENT_COMMAND:
{
const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;

//dyld::log("seg name: %s\n", seg->segname);
if (strcmp(seg->segname, "__RESTRICT") == 0) {
const struct macho_section* const sectionsStart = (struct macho_section*)((char*)seg + sizeof(struct macho_segment_command));
const struct macho_section* const sectionsEnd = &sectionsStart[seg->nsects];
for (const struct macho_section* sect=sectionsStart; sect < sectionsEnd; ++sect) {
if (strcmp(sect->sectname, "__restrict") == 0)
return true;
}
}
}
break;
}
cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
}

return false;
}

static bool processRestricted(const macho_header* mainExecutableMH)
{
#if __MAC_OS_X_VERSION_MIN_REQUIRED
// ask kernel if code signature of program makes it restricted
uint32_t flags;
if ( csops(0, CS_OPS_STATUS, &flags, sizeof(flags)) != -1 ) {
if ( flags & CS_ENFORCEMENT ) {
gLinkContext.codeSigningEnforced = true;
}
}
if (flags & CS_RESTRICT) {
sRestrictedReason = restrictedByEntitlements;
return true;
}
#else
gLinkContext.codeSigningEnforced = true;
#endif

// all processes with setuid or setgid bit set are restricted
if ( issetugid() ) {
sRestrictedReason = restrictedBySetGUid;
return true;
}

// <rdar://problem/13158444&13245742> Respect __RESTRICT,__restrict section for root processes
if ( hasRestrictedSegment(mainExecutableMH) ) {
// existence of __RESTRICT/__restrict section make process restricted
sRestrictedReason = restrictedBySegment;
return true;
}
return false;
}

IDA逆向 ：
dyld::_main(macho_header const*, unsigned long, int, char const**, char const**, char const**, unsigned long *)
<ignore_js_op>

Anti-Anti-dylib.png (38.25 KB, 下载次数: 0)

下载附件

昨天 18:35 上传

 

patch方案：
1.不要改变原有规则，即对__RESTRICT 区段的检测还是保留，我们可以在 macho 文件里面插入特殊标记，比如（P.Y.G），然后进行检测，如果找到 特殊标记，则进行patch，否则走原始流程，这样在开发tweak的时候，按照我们预先定义的特殊标记即可成功挂载！
2.使用KMP定位到patch点即可！
3.game over！！