iOS小技能：分析dyld的信息

公众号iOS逆向

发布于 2022-08-22 11:02:07

8980

文章被收录于专栏：iOS逆向与安全iOS逆向与安全

引言

dylb 的加载流程
分析二进制信息，判断当前机器是否越狱。

I 查看和分析二进制信息

1.1 查看Mach-O文件的签名信息

使用jtool 获取sig/entitlements

➜ ~ jtool -arch arm64 -v –sig tmp.arm64

➜  ~ jtool -arch arm64 -v --sig tmp.arm64
Blob at offset: 480800 (16192 bytes) is an embedded signature of 11820 bytes, and 5 blobs
 Blob 0: Type: 0 @52: Code Directory (2534 bytes)
  Version:     20200
  Flags:       none (0x0)
  CodeLimit:   0x75620

jtool -arch arm64 –ent tmp.arm64

➜  ~ jtool -arch arm64 --ent tmp_64.dylib
tmp_64.dylib apparently does not contain any entitlements
➜  ~ jtool -arch arm64 --ent tmp.arm64   
<?xml version="1.0" encoding="UTF-8"?>

1.2 通过 otool 找到所需加载的库

otool -l tmp.arm64

Load command 13
          cmd LC_LOAD_DYLIB
      cmdsize 80
         name /System/Library/Frameworks/Security.framework/Security (offset 24)

name /usr/lib/libSystem.B.dylib (offset 24)

libdispatch：GCD
libsystem_c：C语言库
libsystem_blocks：Block
libcommonCrypto：加密，比如md5

1.3 通过DYLD_PRINT_LIBRARIES变量打印什么库被加载了

  ➜  ~ export DYLD_PRINT_LIBRARIES=;/Users/devzkn/Downloads/kevinsoftware/ios-Reverse_Engineering/llvm-3.9.0.src/build/CMakeFiles/3.10.0-rc4/CompilerIdCXX/a.out 
  dyld: loaded: /Users/devzkn/Downloads/kevinsoftware/ios-Reverse_Engineering/llvm-3.9.0.src/build/CMakeFiles/3.10.0-rc4/CompilerIdCXX/a.out
  dyld: loaded: /usr/lib/libc++.1.dylib
  dyld: loaded: /usr/lib/libSystem.B.dylib
  dyld: loaded: /usr/lib/libc++abi.dylib
  dyld: loaded: /usr/lib/system/libcache.dylib
  dyld: loaded: /usr/lib/system/libcommonCrypto.dylib
  dyld: loaded: /usr/lib/system/libcompiler_rt.dylib
  dyld: loaded: /usr/lib/system/libcopyfile.dylib
  dyld: loaded: /usr/lib/system/libcorecrypto.dylib
  dyld: loaded: /usr/lib/system/libdispatch.dylib
  dyld: loaded: /usr/lib/system/libdyld.dylib
  dyld: loaded: /usr/lib/system/libkeymgr.dylib
  dyld: loaded: /usr/lib/system/liblaunch.dylib
  dyld: loaded: /usr/lib/system/libmacho.dylib
  dyld: loaded: /usr/lib/system/libquarantine.dylib
  dyld: loaded: /usr/lib/system/libremovefile.dylib
  dyld: loaded: /usr/lib/system/libsystem_asl.dylib
  dyld: loaded: /usr/lib/system/libsystem_blocks.dylib
  dyld: loaded: /usr/lib/system/libsystem_c.dylib
  dyld: loaded: /usr/lib/system/libsystem_configuration.dylib
  dyld: loaded: /usr/lib/system/libsystem_coreservices.dylib
  dyld: loaded: /usr/lib/system/libsystem_darwin.dylib
  dyld: loaded: /usr/lib/system/libsystem_dnssd.dylib
  dyld: loaded: /usr/lib/system/libsystem_info.dylib
  dyld: loaded: /usr/lib/system/libsystem_m.dylib
  dyld: loaded: /usr/lib/system/libsystem_malloc.dylib
  dyld: loaded: /usr/lib/system/libsystem_network.dylib
  dyld: loaded: /usr/lib/system/libsystem_networkextension.dylib
  dyld: loaded: /usr/lib/system/libsystem_notify.dylib
  dyld: loaded: /usr/lib/system/libsystem_sandbox.dylib
  dyld: loaded: /usr/lib/system/libsystem_secinit.dylib
  dyld: loaded: /usr/lib/system/libsystem_kernel.dylib
  dyld: loaded: /usr/lib/system/libsystem_platform.dylib
  dyld: loaded: /usr/lib/system/libsystem_pthread.dylib
  dyld: loaded: /usr/lib/system/libsystem_symptoms.dylib
  dyld: loaded: /usr/lib/system/libsystem_trace.dylib
  dyld: loaded: /usr/lib/system/libunwind.dylib
  dyld: loaded: /usr/lib/system/libxpc.dylib
  dyld: loaded: /usr/lib/closure/libclosured.dylib
  dyld: loaded: /usr/lib/libobjc.A.dylib

1.5 环境变量 EnvironmentVariables

// state of all environment variables dyld uses
//
struct EnvironmentVariables {
 const char* const *   DYLD_FRAMEWORK_PATH;
 const char* const *   DYLD_FALLBACK_FRAMEWORK_PATH;
 const char* const *   DYLD_LIBRARY_PATH;
 const char* const *   DYLD_FALLBACK_LIBRARY_PATH;
 const char* const *   DYLD_INSERT_LIBRARIES;
 const char* const *   LD_LIBRARY_PATH;   // for unix conformance
 const char* const *   DYLD_VERSIONED_LIBRARY_PATH;
 const char* const *   DYLD_VERSIONED_FRAMEWORK_PATH;
 bool      DYLD_PRINT_LIBRARIES_POST_LAUNCH;
 bool      DYLD_BIND_AT_LAUNCH;
 bool      DYLD_PRINT_STATISTICS;
 bool      DYLD_PRINT_STATISTICS_DETAILS;
 bool      DYLD_PRINT_OPTS;
 bool      DYLD_PRINT_ENV;
 bool      DYLD_DISABLE_DOFS;
 bool      DYLD_PRINT_CS_NOTIFICATIONS;
                            //  DYLD_SHARED_CACHE_DONT_VALIDATE ==> sSharedCacheIgnoreInodeAndTimeStamp
                            //  DYLD_SHARED_CACHE_DIR           ==> sSharedCacheDir
       // DYLD_ROOT_PATH     ==> gLinkContext.rootPaths
       // DYLD_IMAGE_SUFFIX    ==> gLinkContext.imageSuffix
       // DYLD_PRINT_OPTS     ==> gLinkContext.verboseOpts
       // DYLD_PRINT_ENV     ==> gLinkContext.verboseEnv
       // DYLD_FORCE_FLAT_NAMESPACE  ==> gLinkContext.bindFlat
       // DYLD_PRINT_INITIALIZERS   ==> gLinkContext.verboseInit
       // DYLD_PRINT_SEGMENTS    ==> gLinkContext.verboseMapping
       // DYLD_PRINT_BINDINGS    ==> gLinkContext.verboseBind
       //  DYLD_PRINT_WEAK_BINDINGS  ==> gLinkContext.verboseWeakBind
       // DYLD_PRINT_REBASINGS   ==> gLinkContext.verboseRebase
       // DYLD_PRINT_DOFS     ==> gLinkContext.verboseDOF
       // DYLD_PRINT_APIS     ==> gLogAPIs
       // DYLD_IGNORE_PREBINDING   ==> gLinkContext.prebindUsage
       // DYLD_PREBIND_DEBUG    ==> gLinkContext.verbosePrebinding
       // DYLD_NEW_LOCAL_SHARED_REGIONS ==> gLinkContext.sharedRegionMode
       // DYLD_SHARED_REGION    ==> gLinkContext.sharedRegionMode
       // DYLD_PRINT_WARNINGS    ==> gLinkContext.verboseWarnings
       // DYLD_PRINT_RPATHS    ==> gLinkContext.verboseRPaths
       // DYLD_PRINT_INTERPOSING   ==> gLinkContext.verboseInterposing
       //  DYLD_PRINT_LIBRARIES   ==> gLinkContext.verboseLoading
};

重要的环境变量

 //如果设置了DYLD_PRINT_OPTS环境变量打印参数
 //如果设置了DYLD_PRINT_ENV环境变量打印环境变量

在xocode 中设置环境变量:DYLD_PRINT_STATISTICS、DYLD_PRINT_STATISTICS_DETAILS，打印各阶段消耗的时间

在这里插入图片描述

 // dump info if requested
 //DYLD_PRINT_STATISTICS
 if ( sEnv.DYLD_PRINT_STATISTICS )
  ImageLoader::printStatistics((unsigned int)allImagesCount(), initializerTimes[0]);
 //DYLD_PRINT_STATISTICS_DETAILS
 if ( sEnv.DYLD_PRINT_STATISTICS_DETAILS )
  ImageLoaderMachO::printStatisticsDetails((unsigned int)allImagesCount(), initializerTimes[0]);

getenv

char * getenv(const char *name) {
  static void *handle;      // 1
  static char * (*real_getenv)(const char *); // 2
  static dispatch_once_t onceToken;
  dispatch_once(&onceToken, ^{  // 3
    handle = dlopen("/usr/lib/system/libsystem_c.dylib", RTLD_NOW);
    assert(handle);
    real_getenv = dlsym(handle, "getenv");
});
  if (strcmp(name, "HOME") == 0) { // 4
return "/"; }
  return real_getenv(name); // 5
}

1.6 越狱检测

_dyld_get_image_name:获得名字，然后遍历他们的名字，看看有没有 “MobileSubstrate” 关键字，有的话就是越狱的

#import <mach-o/dyld.h>  
  
int count = _dyld_image_count();//获得加载的动态库的数量
for (int i=0; i<count; i++) {
    printf("%s", _dyld_get_image_name(i));//获得名字，然后遍历他们的名字，看看有没有 “MobileSubstrate” 关键字，有的话就是越狱的
    // 如果 _dyld_get_image_name() 里面包含 MobileSubstrate 就是越狱了
}

II 符号表

每个函数，全局变量和类都是通过符号的形式来定义和使用的，当把目标文件（.o）链接成一个执行文件(.out)时，链接器在目标文件和动态库之间对符号做解析处理.

链接器通过动态库解析成符号会记录是通过哪个动态库解析的，路径也会一起记录

➜  ~ nm -nm tmp.arm64
0000000000006e80 (__TEXT,__text) non-external -[ASSwitchIPOperation initWithTimeOut:Operation:tryTimes:]
(undefined) external _CFDataCreate (from CoreFoundation)

undefined 符号表示该文件类未实现的，所以在目标文件和 Fundation framework 动态库做链接处理时，链接器会尝试解析所有的 undefined 符号

本文参与腾讯云自媒体同步曝光计划，分享自微信公众号。

原始发表：2022-01-23，如有侵权请联系 cloudcommunity@tencent.com 删除

c++

linux

本文分享自 iOS逆向微信公众号，前往查看

如有侵权，请联系 cloudcommunity@tencent.com 删除。

本文参与腾讯云自媒体同步曝光计划，欢迎热爱写作的你一起参与！

c++

linux

登录后参与评论

0 条评论

热度

iOS小技能：分析dyld的信息

iOS小技能：分析dyld的信息

引言

I 查看和分析二进制信息

1.1 查看Mach-O文件的签名信息

1.2 通过 otool 找到所需加载的库

1.3 通过DYLD_PRINT_LIBRARIES变量打印什么库被加载了

1.5 环境变量 EnvironmentVariables

1.6 越狱检测

II 符号表

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐