dot/macho
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add modifications for ObjC binaries

Browse Source
This commit is contained in:
nganhkhoa 2023-06-21 17:10:05 +07:00
parent ebd52d9acb
commit f5144fec4f
1 changed files with 89 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

97
macho-go/pkg/ios/macho/edit.go
View File

@ -282,7 +282,7 @@ func (mc *MachoContext) RemoveBindSymbols() {
} else {
mc.removeBindSymbolsLegacy()
}
mc.RenameObjcClasslist()
mc.ReworkForObjc()
// due to some limitations when design this tool
// we write the c code to stdout lol
@ -353,7 +353,9 @@ func (mc *MachoContext) removeBindSymbolsLegacy() {
mc.file.WriteAt(make([]byte, size), int64(start))
}
func (mc *MachoContext) RenameObjcClasslist() {
func (mc *MachoContext) ReworkForObjc() {
text_start := 0
ptr := int64(0)
if mc.Is64bit() {
ptr, _ = mc.file.Seek(int64(Header_size_64), io.SeekStart)
@ -368,6 +370,14 @@ func (mc *MachoContext) RenameObjcClasslist() {
}
var segment = cmd.(*Segment64)
if bytes.Compare(bytes.Trim(segment.SegName(), "\x00"), []byte("__TEXT")) == 0 {
for _, section := range segment.Sections() {
if bytes.Compare(bytes.Trim(section.SectName(), "\x00"), []byte("__text")) == 0 {
text_start = int(section.Offset())
break
}
}
}
if bytes.Compare(bytes.Trim(segment.SegName(), "\x00"), []byte("__DATA_CONST")) == 0 {
section_ptr := ptr + 0x40 + 8
for _, section := range segment.Sections() {
@ -380,15 +390,86 @@ func (mc *MachoContext) RenameObjcClasslist() {
section_ptr += 16 * 2 + 8 * 2 + 4 * 8
}
}
// if bytes.Compare(bytes.Trim(segment.SegName(), "\x00"), []byte("__DATA")) == 0 {
// section_ptr := ptr + 0x40 + 8
// for _, section := range segment.Sections() {
// section_ptr += 16 * 2 + 8 * 2 + 4 * 8
// }
// }
if bytes.Compare(bytes.Trim(segment.SegName(), "\x00"), []byte("__DATA")) == 0 {
// section_ptr := ptr + 0x40 + 8
// for _, section := range segment.Sections() {
// section_ptr += 16 * 2 + 8 * 2 + 4 * 8
// }
// end of __DATA segment, should have enough space for a pointer
}
ptr += int64(cmd.Cmdsize())
}
mc.file.Seek(0, io.SeekStart)
// dummy value past the end of __DATA segment (logical size),
// its physical size is still a page
// mc.file.WriteAt([]byte{0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7}, int64(0x81d8))
ins_size_byte := 4
x8_value_offset := text_start - (ins_size_byte * 17) + (ins_size_byte * 2)
main_offset := mc.entryoff
movz_x8_value_offset := uint32(uint32(x8_value_offset)<<5 | uint32(0x694)<<21 | uint32(0x09))
movz_main_offset := uint32(uint32(main_offset)<<5 | uint32(0x694)<<21 | uint32(0x09))
fmt.Printf("// x8_value_offset=%x\n", x8_value_offset)
fmt.Printf("// main_offset=%x\n", main_offset)
fmt.Printf("// x8_value_offset=%x\n", movz_x8_value_offset)
fmt.Printf("// main_offset=%x\n", movz_main_offset)
// sub sp, sp, #0x10
// str x30, [sp]
// adr x8, 0
// movz x9, #0x3d68 ; offset at this point
// sub x8, x8, x9
// str x8, [sp, #8]
// movz x9, #0x81d8
// add x9, x8, x9
// ldr x9, [x9]
// blr x9
// ldr x8, [sp, #8]
// movz x9, #0x3e3c ; offset to original main
// add x9, x8, x9
// blr x9
// ldr x30, [sp]
// add sp, sp, #0x10
// ret
// TODO: fix to work with offset larger than 0xffff
shellcode := []uint32{
0xD10043FF,
0xF90003FE,
0x10000008,
movz_x8_value_offset,
0xCB090108,
0xF90007E8,
0xD2903B09,
0x8B090109,
0xF9400129,
0xD63F0120,
0xF94007E8,
movz_main_offset,
0x8B090109,
0xD63F0120,
0xF94003FE,
0x910043FF,
0xD65F03C0,
}
offset := int64(0x3da4 - len(shellcode) * 4)
{
// fix main to point to our newly created shellcode
bs := make([]byte, 8)
mc.byteorder.PutUint64(bs, uint64(offset))
mc.file.WriteAt(bs, int64(0x870))
}
bs := make([]byte, 4)
for _, ins := range shellcode {
mc.byteorder.PutUint32(bs, ins)
mc.file.WriteAt(bs, offset)
offset += 4
}
}