macOS Function Hooking

Jifunze na zoezi la AWS Hacking:Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE) Jifunze na zoezi la GCP Hacking: Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)

Aunga mkono HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 Kikundi cha Discord au kikundi cha telegram au tufuate kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud github repos.

Kuingilia Kazi

Tengeneza dylib na sehemu ya __interpose (__DATA___interpose) (au sehemu iliyofungwa na S_INTERPOSING) inayojumuisha jozi za pointa za kazi zinazorejelea kazi za awali na kazi mbadala.

Kisha, ingiza dylib na DYLD_INSERT_LIBRARIES (kuingilia kazi kunahitaji kutokea kabla ya programu kuu kuanza). Kwa dhahiri vizuizi vilivyowekwa kwa matumizi ya DYLD_INSERT_LIBRARIES vinatumika hapa pia.

Kuingilia printf

interpose.c

interpose.c

// gcc -dynamiclib interpose.c -o interpose.dylib
#include <stdio.h>
#include <stdarg.h>

int my_printf(const char *format, ...) {
//va_list args;
//va_start(args, format);
//int ret = vprintf(format, args);
//va_end(args);

int ret = printf("Hello from interpose\n");
return ret;
}

__attribute__((used)) static struct { const void *replacement; const void *replacee; } _interpose_printf
__attribute__ ((section ("__DATA,__interpose"))) = { (const void *)(unsigned long)&my_printf, (const void *)(unsigned long)&printf };

hello.c

//gcc hello.c -o hello
#include <stdio.h>

int main() {
printf("Hello World!\n");
return 0;
}

interpose2.c

// Just another way to define an interpose
// gcc -dynamiclib interpose2.c -o interpose2.dylib

#include <stdio.h>

#define DYLD_INTERPOSE(_replacement, _replacee) \
__attribute__((used)) static struct { \
const void* replacement; \
const void* replacee; \
} _interpose_##_replacee __attribute__ ((section("__DATA, __interpose"))) = { \
(const void*) (unsigned long) &_replacement, \
(const void*) (unsigned long) &_replacee \
};

int my_printf(const char *format, ...)
{
int ret = printf("Hello from interpose\n");
return ret;
}

DYLD_INTERPOSE(my_printf,printf);

DYLD_INSERT_LIBRARIES=./interpose.dylib ./hello
Hello from interpose

DYLD_INSERT_LIBRARIES=./interpose2.dylib ./hello
Hello from interpose

Chaguo la mazingira la DYLD_PRINT_INTERPOSTING linaweza kutumika kwa kusudi la kudekta interposing na litachapisha mchakato wa interpose.

Pia elewa kwamba interposing hutokea kati ya mchakato na maktaba zilizopakiwa, haitafanyi kazi na hifadhi ya maktaba iliyoshirikiwa.

Interposing ya Kisasa

Sasa pia ni iwezekanavyo kuingiza kazi kwa njia ya kisasa kwa kutumia kazi ya dyld_dynamic_interpose. Hii inaruhusu kuingiza kazi kwa njia ya programu wakati wa muda wa uendeshaji badala ya kufanya hivyo tu kutoka mwanzoni.

Inahitajika tu kuonyesha tuples ya kazi ya kuchukua nafasi na kazi mbadala.

struct dyld_interpose_tuple {
const void* replacement;
const void* replacee;
};
extern void dyld_dynamic_interpose(const struct mach_header* mh,
const struct dyld_interpose_tuple array[], size_t count);

Kufunga Njia

Katika ObjectiveC hivi ndivyo njia inavyoitwa: [myClassInstance nameOfTheMethodFirstParam:param1 secondParam:param2]

Inahitajika kitu, njia na vipimo. Na wakati njia inaitwa msg inatumwa kutumia kazi objc_msgSend: int i = ((int (*)(id, SEL, NSString *, NSString *))objc_msgSend)(someObject, @selector(method1p1:p2:), value1, value2);

Kitu ni someObject, njia ni @selector(method1p1:p2:) na hoja ni value1, value2.

Kufuatia miundo ya vitu, ni rahisi kufikia orodha ya njia ambapo majina na pointi kwa msimbo wa njia zinapatikana.

Tafadhali kumbuka kwamba kwa sababu njia na madarasa vinapata kulingana na majina yao, habari hii imehifadhiwa kwenye binary, hivyo ni rahisi kuipata kwa kutumia otool -ov </path/bin> au class-dump </path/bin>

Kufikia njia za asili

Inawezekana kupata habari za njia kama jina, idadi ya vipimo au anwani kama ilivyo katika mfano ufuatao:

// gcc -framework Foundation test.m -o test

#import <Foundation/Foundation.h>
#import <objc/runtime.h>
#import <objc/message.h>

int main() {
// Get class of the variable
NSString* str = @"This is an example";
Class strClass = [str class];
NSLog(@"str's Class name: %s", class_getName(strClass));

// Get parent class of a class
Class strSuper = class_getSuperclass(strClass);
NSLog(@"Superclass name: %@",NSStringFromClass(strSuper));

// Get information about a method
SEL sel = @selector(length);
NSLog(@"Selector name: %@", NSStringFromSelector(sel));
Method m = class_getInstanceMethod(strClass,sel);
NSLog(@"Number of arguments: %d", method_getNumberOfArguments(m));
NSLog(@"Implementation address: 0x%lx", (unsigned long)method_getImplementation(m));

// Iterate through the class hierarchy
NSLog(@"Listing methods:");
Class currentClass = strClass;
while (currentClass != NULL) {
unsigned int inheritedMethodCount = 0;
Method* inheritedMethods = class_copyMethodList(currentClass, &inheritedMethodCount);

NSLog(@"Number of inherited methods in %s: %u", class_getName(currentClass), inheritedMethodCount);

for (unsigned int i = 0; i < inheritedMethodCount; i++) {
Method method = inheritedMethods[i];
SEL selector = method_getName(method);
const char* methodName = sel_getName(selector);
unsigned long address = (unsigned long)method_getImplementation(m);
NSLog(@"Inherited method name: %s (0x%lx)", methodName, address);
}

// Free the memory allocated by class_copyMethodList
free(inheritedMethods);
currentClass = class_getSuperclass(currentClass);
}

// Other ways to call uppercaseString method
if([str respondsToSelector:@selector(uppercaseString)]) {
NSString *uppercaseString = [str performSelector:@selector(uppercaseString)];
NSLog(@"Uppercase string: %@", uppercaseString);
}

// Using objc_msgSend directly
NSString *uppercaseString2 = ((NSString *(*)(id, SEL))objc_msgSend)(str, @selector(uppercaseString));
NSLog(@"Uppercase string: %@", uppercaseString2);

// Calling the address directly
IMP imp = method_getImplementation(class_getInstanceMethod(strClass, @selector(uppercaseString))); // Get the function address
NSString *(*callImp)(id,SEL) = (typeof(callImp))imp; // Generates a function capable to method from imp
NSString *uppercaseString3 = callImp(str,@selector(uppercaseString)); // Call the method
NSLog(@"Uppercase string: %@", uppercaseString3);

return 0;
}

Marejeo

• https://nshipster.com/method-swizzling/

Jifunze na zoezi la Udukuzi wa AWS:Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE) Jifunze na zoezi la Udukuzi wa GCP: Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 Kikundi cha Discord au kikundi cha telegram au tufuate kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud github repos.