|
| 1 | +// mach_inject_bundle_stub.c semver:1.2.0 |
| 2 | +// Copyright (c) 2003-2012 Jonathan 'Wolf' Rentzsch: http://rentzsch.com |
| 3 | +// Some rights reserved: http://opensource.org/licenses/mit |
| 4 | +// https://github.com/rentzsch/mach_inject |
| 5 | +// |
| 6 | +// Design inspired by SCPatchLoader by Jon Gotow of St. Clair Software: |
| 7 | +// http://www.stclairsoft.com |
| 8 | + |
| 9 | +#include "mach_inject_bundle_stub.h" |
| 10 | +#include "mach_inject.h" // for INJECT_ENTRY |
| 11 | + |
| 12 | +#include <assert.h> |
| 13 | +#include <mach/mach_init.h> |
| 14 | +#include <mach/thread_act.h> |
| 15 | +#include <pthread.h> |
| 16 | +#include <dlfcn.h> |
| 17 | + |
| 18 | +#include <sys/mman.h> |
| 19 | +#include <sys/stat.h> |
| 20 | +#include <unistd.h> |
| 21 | +#include <fcntl.h> |
| 22 | + |
| 23 | +/************************** |
| 24 | +* |
| 25 | +* Funky Protos |
| 26 | +* |
| 27 | +**************************/ |
| 28 | +#pragma mark (Funky Protos) |
| 29 | + |
| 30 | + void |
| 31 | +INJECT_ENTRY( |
| 32 | + ptrdiff_t codeOffset, |
| 33 | + mach_inject_bundle_stub_param *param, |
| 34 | + size_t paramSize, |
| 35 | + char *dummy_pthread_struc ); |
| 36 | + |
| 37 | + void* |
| 38 | +pthread_entry( |
| 39 | + mach_inject_bundle_stub_param *param ); |
| 40 | + |
| 41 | + |
| 42 | +/******************************************************************************* |
| 43 | +* |
| 44 | +* Implementation |
| 45 | +* |
| 46 | +*******************************************************************************/ |
| 47 | +#pragma mark - |
| 48 | +#pragma mark (Implementation) |
| 49 | + |
| 50 | + void |
| 51 | +INJECT_ENTRY( |
| 52 | + ptrdiff_t codeOffset, |
| 53 | + mach_inject_bundle_stub_param *param, |
| 54 | + size_t paramSize, |
| 55 | + char *dummy_pthread_struct ) |
| 56 | +{ |
| 57 | + assert( param ); |
| 58 | + |
| 59 | +#if defined (__i386__) || defined(__x86_64__) |
| 60 | + // On intel, per-pthread data is a zone of data that must be allocated. |
| 61 | + // if not, all function trying to access per-pthread data (all mig functions for instance) |
| 62 | + // will crash. |
| 63 | + extern void _pthread_set_self(char*); |
| 64 | + _pthread_set_self(dummy_pthread_struct); |
| 65 | +#endif |
| 66 | + |
| 67 | +// fprintf(stderr, "mach_inject_bundle: entered in %s, codeOffset: %td, param: %p, paramSize: %lu\n", |
| 68 | +// INJECT_ENTRY_SYMBOL, codeOffset, param, paramSize); |
| 69 | + |
| 70 | + pthread_attr_t attr; |
| 71 | + pthread_attr_init(&attr); |
| 72 | + |
| 73 | + int policy; |
| 74 | + pthread_attr_getschedpolicy( &attr, &policy ); |
| 75 | + pthread_attr_setdetachstate( &attr, PTHREAD_CREATE_DETACHED ); |
| 76 | + pthread_attr_setinheritsched( &attr, PTHREAD_EXPLICIT_SCHED ); |
| 77 | + |
| 78 | + struct sched_param sched; |
| 79 | + sched.sched_priority = sched_get_priority_max( policy ); |
| 80 | + pthread_attr_setschedparam( &attr, &sched ); |
| 81 | + |
| 82 | + pthread_t thread; |
| 83 | + pthread_create( &thread, |
| 84 | + &attr, |
| 85 | + (void* (*)(void*))((long)pthread_entry + codeOffset), |
| 86 | + (void*) param ); |
| 87 | + pthread_attr_destroy(&attr); |
| 88 | + |
| 89 | + thread_suspend(mach_thread_self()); |
| 90 | +} |
| 91 | + |
| 92 | +void* |
| 93 | +pthread_entry( |
| 94 | + mach_inject_bundle_stub_param *param ) { |
| 95 | + |
| 96 | + // The following descent into dark magic is brought to you by: |
| 97 | + // https://en.wikipedia.org/wiki/Address_space_layout_randomization |
| 98 | + // |
| 99 | + // As a start, the first page actually loaded into memory is located. |
| 100 | + // Shortly after this page will be "libdyld" which is itself a dylib. |
| 101 | + // Which page is found using a offset determined in the Helper using "nm" |
| 102 | + // in confunction with the first 16 bytes of the dlopen() machine code |
| 103 | + // which seems to be shared across tested iOS versions (8.4 -> 10.0.) |
| 104 | + // |
| 105 | + // Move along, nothing to see here... |
| 106 | + |
| 107 | + #define VALID_ADDRESS( _addr ) (mincore( _addr, PAGE_SIZE, vec ) == 0 && vec[0] & MINCORE_INCORE) |
| 108 | + |
| 109 | + char *loadAddress = (char *)0x100000000, vec[1]; |
| 110 | + while ( !VALID_ADDRESS( loadAddress ) ) |
| 111 | + loadAddress += PAGE_SIZE; |
| 112 | + |
| 113 | + static unsigned char dlopenInstrux[] = { |
| 114 | + 0x55, 0x48, 0x89, 0xe5, 0x41, 0x56, 0x53, 0x41, |
| 115 | + 0x89, 0xf6, 0x48, 0x89, 0xfb, 0x48}; |
| 116 | + typedef void * (*dlopen_f)(const char * __path, int __mode); |
| 117 | + dlopen_f dlopen_ = NULL; |
| 118 | + |
| 119 | + for ( ; loadAddress < (char *)0x200000000 && VALID_ADDRESS( loadAddress ) ; loadAddress += PAGE_SIZE ) |
| 120 | + if (memcmp(loadAddress + param->dlopenPageOffset, dlopenInstrux, sizeof dlopenInstrux) == 0) { |
| 121 | + dlopen_ = (dlopen_f)(loadAddress + param->dlopenPageOffset); |
| 122 | + break; |
| 123 | + } |
| 124 | + |
| 125 | + const char *error = NULL; |
| 126 | + |
| 127 | + if (!dlopen_) |
| 128 | + error = "Could not locate dlopen()"; |
| 129 | + else if ( dlopen_(param->bundleExecutableFileSystemRepresentation, RTLD_NOW) == NULL ) |
| 130 | + error = ((const char *(*)(void))(loadAddress + param->dlerrorPageOffset))(); |
| 131 | + |
| 132 | + if (error) { |
| 133 | + int log = open(HELPER_LOGFILE, O_CREAT|O_WRONLY|O_APPEND, 0666); |
| 134 | + write(log, error, strlen(error)); |
| 135 | + write(log, "\n", 1); |
| 136 | + close(log); |
| 137 | + } |
| 138 | + |
| 139 | + return NULL; |
| 140 | +} |
| 141 | + |
0 commit comments