comex / inject_and_interpose Goto Github PK
View Code? Open in Web Editor NEWlike mach_inject
like mach_inject
Now deprecated in favor of Substitute: https://github.com/comex/substitute In particular: https://github.com/comex/substitute/blob/master/lib/darwin/inject.c https://github.com/comex/substitute/blob/master/lib/darwin/interpose.c
Hello Comex,
I am new to git so I emailed you directly. Sorry, I was not aware of process.
I had few observations. Thought I should share it with you. This injection system is working nice with all applications (like, itunes, firefox, skype, finder, dock.. etc) but it fails to inject in "launchd" process. Another observation is if I run injection on terminal in bash, it cannot inject in bash and if I run it in sh, it cannot inject in sh.
While debugging, it appears to fail in following line when during start of 3rd loop for exception.
TRY(mach_msg_overwrite(NULL, MACH_RCV_MSG, 0, sizeof(msg), exc, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL, (void *) &msg, sizeof(msg)));
Thank you,
Rahul
If application in which we are injecting has following settings on 10.8 OSX Garbage Collection Work Queue will crash.
ARCHS = $(ARCHS_STANDARD_64_BIT)
GCC_VERSION = com.apple.compilers.llvmgcc42
GCC_ENABLE_OBJC_GC = required //user defined setting.
On crash it will generate following message,
malloc: Thread::suspend(): unable to suspend a thread: err = 268435459, Thread 0x111000000: _pthread = 0x108129000, _thread = 0x8b07, _stack_base = 0x108129000, enlivening on, 0 local blocks
It will even when injected library has exactly same configuration as of the application in which we are injecting. After injecting play a little bit with application, like for 5-10 seconds.
Hello Comex,I am huge fan of you and your code inject.c.
I wanted to try out interposing by myself,I read through few of apple documents regarding Mach-O file and Mike Ash blog about dynamic loading. But still concepts are not clear for me.Can you please suggest some blogs or documents so which have detailed explanation of Mach-O file and dynamic loading. My aim is to understand interpose.c and make use of it..
Thanks
Hello there,
If you modify puts() in file testputs.c for using callback mechanism then function hooking does not work.
Below is the source code to test it.
<stdio.h>
<unistd.h>
int main() {
typeof(puts) *putting = puts;
while(1) {
putting("Hi!\n");
sleep(1);
}
}
Very strangely, interpose.c stopped working on some symbols on iOS 9, but only on arm64. For example, try hooking _SSLHandshake
called from CFNetwork -- SocketStream::_PerformSecurityHandshake_NoLock
. If we add logging to the hook insertion routine, you'll see the interposition gets installed on CFNetwork imports, but it is never invoked when SSLHandshake is called.
OTOH, if we try a hook on _open
we see it gets invoked consistently when calling [NSString stringWithContentsOfFile:]
via Foundation -- _NSReadBytesFromFileWithExtendedAttributes
for example.
Also, both seem to work just fine on armv7 and even on arm64 on iOS 8.
Hello there,
In file, Inject.c
static kern_return_t get_stuff(task_t task, cpu_type_t *cputype, struct addr_bundle *addrs) {
...
// Try to guess whether the process is 64-bit,
bool proc64 = info.all_image_info_addr > 0;
bool proc64 = false;
mach_vm_address_t dyldImageLoadAddress = proc64 ? u.data64.dyldImageLoadAddress : u.data.dyldImageLoadAddress;
...
}
Above code gives wrong result and thus injection fails at mach_vm_read_overwrite();
I think check for #if defined(i386) || defined(x86_64) || defined(ppc)
is wrong as it will check whether injection process is 64 bit or 32 bit or ppc. It wont check whether task(injectee process) is 32 bit or 64 bit.
"Interpose" be used in my app. I want put this app on AppStore, would it be rejected?
because i used "interpose" to call private API
interpose.c:102
return true; //should be result?
Steps:
Crash Log for refenrece:
Process: sjeng.ChessEngine [505]
Path: /Applications/Chess.app/Contents/Resources/sjeng.ChessEngine
Identifier: sjeng.ChessEngine
Version: ??? (???)
Code Type: X86-64 (Native)
Parent Process: Chess [501]
Date/Time: 2012-09-11 10:21:54.386 +0200
OS Version: Mac OS X 10.6.8 (10K549)
Report Version: 6
Exception Type: EXC_BREAKPOINT (SIGTRAP)
Exception Codes: 0x0000000000000002, 0x0000000000000000
Crashed Thread: 1
Thread 0: Dispatch queue: com.apple.main-thread
0 libSystem.B.dylib 0x00007fff82837982 read$NOCANCEL + 10
1 libSystem.B.dylib 0x00007fff828870ef __sread + 16
2 libSystem.B.dylib 0x00007fff8287ee34 _sread + 19
3 libSystem.B.dylib 0x00007fff8287ecca __srefill + 41
4 libSystem.B.dylib 0x00007fff82889e8e __srget + 17
5 libSystem.B.dylib 0x00007fff82889e4a getc + 63
6 sjeng.ChessEngine 0x000000010000455a 0x100000000 + 17754
7 sjeng.ChessEngine 0x00000001000013fc 0x100000000 + 5116
8 sjeng.ChessEngine 0x0000000100000884 0x100000000 + 2180
Thread 1 Crashed:
0 com.apple.CoreFoundation 0x00007fff8038c590 __CFInitialize + 1808
1 dyld 0x00007fff5fc0d5de ImageLoaderMachO::doImageInit(ImageLoader::LinkContext const&) + 138
2 dyld 0x00007fff5fc0d617 ImageLoaderMachO::doInitialization(ImageLoader::LinkContext const&) + 27
3 dyld 0x00007fff5fc0bcfc ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int) + 236
4 dyld 0x00007fff5fc0bcad ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int) + 157
5 dyld 0x00007fff5fc0bcad ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int) + 157
6 dyld 0x00007fff5fc0bcad ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int) + 157
7 dyld 0x00007fff5fc0bcad ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int) + 157
8 dyld 0x00007fff5fc0bcad ImageLoader::recursiveInitialization(ImageLoader::LinkContext const&, unsigned int) + 157
9 dyld 0x00007fff5fc0bdb6 ImageLoader::runInitializers(ImageLoader::LinkContext const&) + 58
10 dyld 0x00007fff5fc08fcf dlopen + 573
11 ??? 0x00000000deadbeef 0 + 3735928559
12 libSystem.B.dylib 0x00007fff8286ee89 thread_start + 13
Thread 1 crashed with X86 Thread State (64-bit):
rax: 0x0000000000000000 rbx: 0x00007fff8038ab58 rcx: 0x00007fff5fbffbe0 rdx: 0x00007fff5fbffb80
rdi: 0x0000000000000000 rsi: 0x00007fff5fbffb68 rbp: 0x0000000100398be0 rsp: 0x0000000100398390
r8: 0x00007fff5fc40548 r9: 0x0000000100406480 r10: 0x0000000000000000 r11: 0x0000000000000003
r12: 0x00007fff8038be80 r13: 0x00007fff5fc404a0 r14: 0x0000000000000005 r15: 0x0000000100400810
rip: 0x00007fff8038c590 rfl: 0x0000000000000246 cr2: 0x00007fff700a87e8
Hi there,
I tried to inject in Google Chrome but it failed.
Below are the results..
myserver:tester test$ sudo ./tester 1860 testlib.dylib
Password:
pid=1860 fail on line 233: mach_vm_read_overwrite(task, dyldImageLoadAddress, sizeof(mach_hdr), address_cast(&mach_hdr), &data_size)
fail on line 305: get_stuff(task, &cputype, &addrs)
kr=1
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.