modules depends on HookZz, a hook framework.
bypass anti-debug, such as ptrace
, syscall
, sysctl
and svc #0x80
.
2. AntiDebug
anti-debug tricks.
hook objc_msgSend in a simple way.
hook MGCopyAnswer in a simple way.
modules deps on HookZz framework.
__asm__ volatile(
"mov x0, %[name_ptr]\n"
"mov x1, #4\n"
"mov x2, %[info_ptr]\n"
"mov x3, %[size_ptr]\n"
"mov x4, #0\n"
"mov x5, #0\n"
"mov w16, #202\n"
"svc #0x80\n"
:
:[name_ptr] "r" (&name), [info_ptr] "r" (&info), [size_ptr] "r" (&size)
:"%x1", "%x2", "%x3"
);
这样写,在编译成汇编的时候会出错,偶尔会变成以下指令
mov x0 , ...
mov x1, #4
mov x2, x1
mov x3, x2
...
然后,换成这样写
__asm__ volatile(
"mov x0, %[name_ptr]\n"
"mov x3, %[size_ptr]\n"
"mov x2, %[info_ptr]\n"
"mov x1, #4\n"
"mov x4, #0\n"
"mov x5, #0\n"
"mov w16, #202\n"
"svc #0x80\n"
:
:[name_ptr] "r" (&name), [info_ptr] "r" (&info), [size_ptr] "r" (&size)
:"%x1", "%x2", "%x3"
);
则能够对x0, x2, x3正确赋值。
第一种偶尔不能达到目的,第二种可以。
找到原因了,自问自答一波:
下面是armv7下生成的汇编代码
0x6321c <+88>: str r0, [sp, #0x30]
0x6321e <+90>: add r0, sp, #0x24
0x63220 <+92>: add r1, sp, #0x34
0x63222 <+94>: add r2, sp, #0x20
0x63224 <+96>: mov r0, r0
0x63226 <+98>: mov r3, r2
0x63228 <+100>: mov r2, r1
0x6322a <+102>: mov.w r1, #0x4
0x6322e <+106>: mov.w r4, #0x0
0x63232 <+110>: mov.w r5, #0x0
0x63236 <+114>: mov.w r12, #0xca
0x6323a <+118>: svc #0x80
在内联汇编代码,在我们的指令前会先用r0, r1, r2,存对应的地址,然后如果我们按照r0,r1,r2,r3这样操作寄存器,那么原来的值就会被覆盖了。
ZzBuildHookAddress does not restore all register status
X17
Exception Type: EXC_CRASH (SIGSYS)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Exception Note: EXC_CORPSE_NOTIFY
Triggered by Thread: 0
Filtered syslog:
None found
Thread 0 name: Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0 libsystem_kernel.dylib 0x1c08a3f8 __syscall + 20
1 microvision 0x008bc2ee 0x4000 + 9143022
2 libdispatch.dylib 0x1bf89782 _dispatch_client_callout + 22
3 libdispatch.dylib 0x1bf95154 _dispatch_continuation_pop + 384
4 libdispatch.dylib 0x1bfa014c _dispatch_source_latch_and_call + 166
5 libdispatch.dylib 0x1bf8b284 _dispatch_source_invoke + 794
6 libdispatch.dylib 0x1bf8dbd2 _dispatch_main_queue_callback_4CF + 596
7 CoreFoundation 0x1c877d68 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 8
8 CoreFoundation 0x1c875e18 __CFRunLoopRun + 848
9 CoreFoundation 0x1c7c91ae CFRunLoopRunSpecific + 470
10 CoreFoundation 0x1c7c8fd0 CFRunLoopRunInMode + 104
11 GraphicsServices 0x1df73b40 GSEventRunModal + 80
12 UIKit 0x21b51a52 UIApplicationMain + 150
13 microvision 0x008ba9ee 0x4000 + 9136622
14 libdyld.dylib 0x1bfb64ea start + 2
RT
RT
It seems that this module is ARM64 only?
Platform: 6plus
ios: 10.2
Jailbreak: yalu102
steps:
bt:
Process 5074 stopped
__abort_with_payload + 8 libsystem_kernel.dylib
__abort_with_payload:__abort_with_payload + 8 frame #1: 0x00000001894764c8 libsystem_kernel.dylib
abort_with_payload + 12<redacted> + 260 frame #3: 0x000000018c6ea224 TCC
+ 704<redacted> + 348 frame #5: 0x000000018957efcc libxpc.dylib
+ 80<redacted> + 40 frame #7: 0x00000001893361bc libdispatch.dylib
+ 16<redacted> + 732 frame #9: 0x000000018934634c libdispatch.dylib
+ 572<redacted> + 124 frame #11: 0x000000018953f2a0 libsystem_pthread.dylib
_pthread_wqthread + 1288Hi, thank you for your source.
But how I can use your source code on my Tweak, please?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.