dot/macho
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

clean code

Browse Source
This commit is contained in:
nganhkhoa 2024-01-10 14:50:53 +07:00
parent a8ffae5202
commit 9a8ab15d88
4 changed files with 41 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
macho-go/internal/wrapper/cli.go
View File

@ -308,7 +308,7 @@ func bcell2header(bfile string, header string) {
fmt.Fprintf(w, "};\n") fmt.Fprintf(w, "};\n")
fmt.Fprintf(w, "__attribute__((section(\"__DATA,bshield\")))\n") fmt.Fprintf(w, "__attribute__((section(\"__DATA,bshield\")))\n")
fmt.Fprintf(w, "char* special_selectors_name[] = {\n") fmt.Fprintf(w, "const char* special_selectors_name[] = {\n")
for _, selector := range info.GetSpecialSelectors() { for _, selector := range info.GetSpecialSelectors() {
fmt.Fprintf(w, "\"%s\",\n", selector.Name) fmt.Fprintf(w, "\"%s\",\n", selector.Name)
} }

2
research/custom_loader/a.mm
View File

@ -53,7 +53,7 @@ int main(int argc, const char * argv[]) {
NSLog(@"directly call \"bar\" %p through objc_msgSend %p with object foo %p\n", @selector(bar), objc_msgSend, foo); NSLog(@"directly call \"bar\" %p through objc_msgSend %p with object foo %p\n", @selector(bar), objc_msgSend, foo);
typedef void (*barfunc)(id, SEL); typedef void (*barfunc)(id, SEL);
barfunc bar_ = &objc_msgSend; barfunc bar_ = (barfunc)&objc_msgSend;
bar_(foo, @selector(bar)); bar_(foo, @selector(bar));
} }

21
research/custom_loader/b.cc
View File

@ -93,9 +93,7 @@ uint32_t fnv_hash_extend(const char *str, uint32_t h) {
return h; return h;
} }
uint32_t fnv_hash(const char* str) { uint32_t fnv_hash(const char *str) { return fnv_hash_extend(str, 0x811c9dc5); }
return fnv_hash_extend(str, 0x811c9dc5);
}
// try these hashes // try these hashes
// https://gist.github.com/sgsfak/9ba382a0049f6ee885f68621ae86079b // https://gist.github.com/sgsfak/9ba382a0049f6ee885f68621ae86079b
@ -908,16 +906,16 @@ void build_cache(struct libcache &cache, void *main) {
typedef char *(*dyld_get_image_name_t)(int); typedef char *(*dyld_get_image_name_t)(int);
typedef void *(*dyld_get_image_header_t)(int); typedef void *(*dyld_get_image_header_t)(int);
char* dyld_image_count_s = "__dyld_image_count"; char *dyld_image_count_s = (char*)"__dyld_image_count";
int (*dyld_image_count_func)(void) = (dyld_image_count_t)find_in_export_trie( int (*dyld_image_count_func)(void) = (dyld_image_count_t)find_in_export_trie(
libdyld, libdyld_export_trie, dyld_image_count_s); libdyld, libdyld_export_trie, dyld_image_count_s);
char* dyld_get_image_header_s = "__dyld_get_image_header"; char *dyld_get_image_header_s = (char*)"__dyld_get_image_header";
void *(*dyld_get_image_header_func)(int) = void *(*dyld_get_image_header_func)(int) =
(dyld_get_image_header_t)find_in_export_trie(libdyld, libdyld_export_trie, (dyld_get_image_header_t)find_in_export_trie(libdyld, libdyld_export_trie,
dyld_get_image_header_s); dyld_get_image_header_s);
char* dyld_get_image_name_s = "__dyld_get_image_name"; char *dyld_get_image_name_s = (char*)"__dyld_get_image_name";
char *(*dyld_get_image_name_func)(int) = char *(*dyld_get_image_name_func)(int) =
(dyld_get_image_name_t)find_in_export_trie(libdyld, libdyld_export_trie, (dyld_get_image_name_t)find_in_export_trie(libdyld, libdyld_export_trie,
dyld_get_image_name_s); dyld_get_image_name_s);
@ -950,7 +948,8 @@ void find_all_rpath(struct libcache &cache, void *header) {
for (uint32_t i = 0; i < ncmds; i++) { for (uint32_t i = 0; i < ncmds; i++) {
const uint32_t cmd = *((uint32_t *)ptr + 0); const uint32_t cmd = *((uint32_t *)ptr + 0);
const uint32_t cmdsize = *((uint32_t *)ptr + 1); const uint32_t cmdsize = *((uint32_t *)ptr + 1);
if (cmd == LC_RPATH) cache.nrpath++; if (cmd == LC_RPATH)
cache.nrpath++;
ptr += cmdsize; ptr += cmdsize;
} }
uint32_t idx = 0; uint32_t idx = 0;
@ -1333,16 +1332,18 @@ void fix_objc(struct libcache_item *libfixing, struct libcache &cache) {
uint64_t *data_ptr = (uint64_t *)(addr + slide); uint64_t *data_ptr = (uint64_t *)(addr + slide);
uint32_t trie_size; uint32_t trie_size;
char* symbol = (char*)"__dyld_get_objc_selector";
void *libdyld = cache.libdyld; void *libdyld = cache.libdyld;
void *libdyld_export_trie = get_export_trie(libdyld, trie_size); void *libdyld_export_trie = get_export_trie(libdyld, trie_size);
typedef void *(*dyld_get_objc_selector_t)(const char *); typedef void *(*dyld_get_objc_selector_t)(const char *);
dyld_get_objc_selector_t dyld_get_objc_selector_func = (dyld_get_objc_selector_t)find_in_export_trie( dyld_get_objc_selector_t dyld_get_objc_selector_func =
libdyld, libdyld_export_trie, "__dyld_get_objc_selector"); (dyld_get_objc_selector_t)find_in_export_trie(
libdyld, libdyld_export_trie, symbol);
// resolve method names that cached in the dyld // resolve method names that cached in the dyld
for (int i = 0; i < bshield_data::n_selectors; i++) { for (int i = 0; i < bshield_data::n_selectors; i++) {
uint32_t idx = bshield_data::special_selectors_idx[i]; uint32_t idx = bshield_data::special_selectors_idx[i];
char* name = bshield_data::special_selectors_name[i]; const char *name = bshield_data::special_selectors_name[i];
data_ptr[idx] = (uint64_t)dyld_get_objc_selector_func(name); data_ptr[idx] = (uint64_t)dyld_get_objc_selector_func(name);
} }
} }

15
research/custom_loader/build.sh
View File

@ -14,6 +14,21 @@ else
echo "Resulting binary uses LEGACY symbol resolver" echo "Resulting binary uses LEGACY symbol resolver"
fi fi
cat <<'fly'
______
_\ _~-\___
= = ==(____AA____D
\_____\___________________,-~~~~~~~`-.._
/ o O o o o o O O o o o o o o O o |\_
`~-.__ ___..----.. )
`---~~\___________/------------`````
= ===(_________D
fly
# this is a joke for those who knows
# https://www.blackhat.com/presentations/bh-dc-09/Iozzo/BlackHat-DC-09-Iozzo-let-your-mach0-fly-whitepaper.pdf
echo "make your Mach-O fly"
if [[ $LOGIC -eq 0 ]] if [[ $LOGIC -eq 0 ]]
then then