Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

iOSOnMac compatibility improvement #10

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

iOSOnMac compatibility improvement #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e90972a
Fix interposing on MacOS 13 and later
vnc0 Feb 12, 2025
85f505e
Load interpose.dylib dynamically at runtime
vnc0 Feb 12, 2025
acc8ba6
Update Makefile: xcrun path resolution, ldid support, clean target
vnc0 Feb 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 25 additions & 10 deletions iOSOnMac/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,28 @@
all : runner main interpose.dylib
CLANG_MACOS := xcrun --sdk macosx -r clang
CLANG_IOS := xcrun --sdk iphoneos -r clang
IOS_SYSROOT := $(shell xcrun --sdk iphoneos --show-sdk-path)
CLANG_IOS_FLAGS := -arch arm64 -isysroot $(IOS_SYSROOT)

interpose.dylib : interpose.c
clang interpose.c -arch arm64 -o interpose.dylib -shared -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk
.PHONY: all clean
all: runner main interpose.dylib

main : main.c interpose.dylib
# Can link against existing frameworks/libraries here by copying them onto ./Frameworks and adding `-F $(PWD)/Frameworks -framework $NAME_OF_FRAMEWORK -Wl,-rpath,$(PWD)/Frameworks
clang main.c -arch arm64 -o main -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk interpose.dylib
interpose.dylib: interpose.c
$(CLANG_IOS) $(CLANG_IOS_FLAGS) -shared -o interpose.dylib interpose.c

runner : runner.c entitlements.xml
clang runner.c -o runner
# Replace this identity, find available certificates usign `security find-identity`
codesign -s "XXXXXXXXXX" --entitlements entitlements.xml --force runner
main: main.c
$(CLANG_IOS) $(CLANG_IOS_FLAGS) -o main main.c

runner: runner.c entitlements.xml
$(CLANG_MACOS) -o runner runner.c
@if [ -n "$(IDENTITY)" ]; then \
codesign -s "$(IDENTITY)" --entitlements entitlements.xml --force runner; \
elif command -v ldid >/dev/null 2>&1; then \
ldid -Sentitlements.xml runner; \
else \
echo "Error: No signing method available. Set IDENTITY or install ldid."; \
echo "Find available certificates using: security find-identity"; \
exit 1; \
fi

clean:
@rm -f runner interpose.dylib main
9 changes: 6 additions & 3 deletions iOSOnMac/runner.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ void instrument(pid_t pid) {
}

printf("[*] _amfi_check_dyld_policy_self at offset 0x%x in /usr/lib/dyld\n", patch_offset);

// Attach to the target process
kr = task_for_pid(mach_task_self(), pid, &task);
if (kr != KERN_SUCCESS) {
Expand Down Expand Up @@ -105,7 +105,7 @@ void instrument(pid_t pid) {
printf("vm_protect failed\n");
return;
}

// MOV X8, 0x5f
// STR X8, [X1]
// RET
Expand All @@ -124,7 +124,7 @@ void instrument(pid_t pid) {
}

puts("[+] Sucessfully patched _amfi_check_dyld_policy_self");
}
}

int run(const char* binary) {
pid_t pid;
Expand All @@ -151,6 +151,8 @@ int run(const char* binary) {

// Can be useful for fuzzing
//setenv("DYLD_INSERT_LIBRARIES", "/usr/lib/libgmalloc.dylib", 1);
setenv("DYLD_IN_CACHE", "0", 1);
setenv("DYLD_INSERT_LIBRARIES", "interpose.dylib", 1);

char* argv[] = {(char*)binary, NULL};
rv = posix_spawn(&pid, binary, NULL, &attr, argv, environ);
Expand All @@ -160,6 +162,7 @@ int run(const char* binary) {
}

unsetenv("DYLD_INSERT_LIBRARIES");
unsetenv("DYLD_IN_CACHE");

printf("[+] Child process created with pid: %i\n", pid);

Expand Down