参考：#

为源码添加注释#

源码代码量不大，建议直接对照源码查看。
1
// Copyright (c) 2013, Facebook, Inc.
2
// All rights reserved.
3
// Redistribution and use in source and binary forms, with or without
4
// modification, are permitted provided that the following conditions are met:
5
//   * Redistributions of source code must retain the above copyright notice,
6
//     this list of conditions and the following disclaimer.
7
//   * Redistributions in binary form must reproduce the above copyright notice,
8
//     this list of conditions and the following disclaimer in the documentation
9
//     and/or other materials provided with the distribution.
10
//   * Neither the name Facebook nor the names of its contributors may be used to
11
//     endorse or promote products derived from this software without specific
12
//     prior written permission.
13
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
14
// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15
// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
16
// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
17
// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18
// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
19
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
20
// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
21
// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
22
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23

24
#include "fishhook.h"
25

26
#include <dlfcn.h>
27
#include <stdbool.h>
28
#include <stdlib.h>
29
#include <string.h>
30
#include <sys/mman.h>
31
#include <sys/types.h>
32
#include <mach/mach.h>
33
#include <mach/vm_map.h>
34
#include <mach/vm_region.h>
35
#include <mach-o/dyld.h>
36
#include <mach-o/loader.h>
37
#include <mach-o/nlist.h>
38

39
#ifdef __LP64__
40
typedef struct mach_header_64 mach_header_t;
41
typedef struct segment_command_64 segment_command_t;
42
typedef struct section_64 section_t;
43
typedef struct nlist_64 nlist_t;
44
#define LC_SEGMENT_ARCH_DEPENDENT LC_SEGMENT_64
45
#else
46
typedef struct mach_header mach_header_t;
47
typedef struct segment_command segment_command_t;
48
typedef struct section section_t;
49
typedef struct nlist nlist_t;
50
#define LC_SEGMENT_ARCH_DEPENDENT LC_SEGMENT
51
#endif
52

53
#ifndef SEG_DATA_CONST
54
#define SEG_DATA_CONST  "__DATA_CONST"
55
#endif
56

57
struct rebindings_entry {
58
  struct rebinding *rebindings;
59
  size_t rebindings_nel;
60
  struct rebindings_entry *next;
61
};
62

63
static struct rebindings_entry *_rebindings_head;
64

65
static int prepend_rebindings(struct rebindings_entry **rebindings_head,
66
                              struct rebinding rebindings[],
67
                              size_t nel) {
68
  struct rebindings_entry *new_entry = (struct rebindings_entry *) malloc(sizeof(struct rebindings_entry));
69
  if (!new_entry) {
70
    return -1;
71
  }
72
  new_entry->rebindings = (struct rebinding *) malloc(sizeof(struct rebinding) * nel);
73
  if (!new_entry->rebindings) {
74
    free(new_entry);
75
    return -1;
76
  }
77
  memcpy(new_entry->rebindings, rebindings, sizeof(struct rebinding) * nel);
78
  new_entry->rebindings_nel = nel;
79
  new_entry->next = *rebindings_head;
80
  *rebindings_head = new_entry;
81
  return 0;
82
}
83

84
static vm_prot_t get_protection(void *sectionStart) {
85
  mach_port_t task = mach_task_self();
86
  vm_size_t size = 0;
87
  vm_address_t address = (vm_address_t)sectionStart;
88
  memory_object_name_t object;
89
#if __LP64__
90
  mach_msg_type_number_t count = VM_REGION_BASIC_INFO_COUNT_64;
91
  vm_region_basic_info_data_64_t info;
92
  kern_return_t info_ret = vm_region_64(
93
      task, &address, &size, VM_REGION_BASIC_INFO_64, (vm_region_info_64_t)&info, &count, &object);
94
#else
95
  mach_msg_type_number_t count = VM_REGION_BASIC_INFO_COUNT;
96
  vm_region_basic_info_data_t info;
97
  kern_return_t info_ret = vm_region(task, &address, &size, VM_REGION_BASIC_INFO, (vm_region_info_t)&info, &count, &object);
98
#endif
99
  if (info_ret == KERN_SUCCESS) {
100
    return info.protection;
101
  } else {
102
    return VM_PROT_READ;
103
  }
104
}
105

106

107
/// 终点：执行重绑定
108
/// @param rebindings 链表头
109
/// @param section -
110
/// @param slide aslr
111
/// @param symtab 符号表
112
/// @param strtab String表
113
/// @param indirect_symtab 间接符号表
114
static void perform_rebinding_with_section(struct rebindings_entry *rebindings,
115
                                           section_t *section,
116
                                           intptr_t slide,
117
                                           nlist_t *symtab,
118
                                           char *strtab,
119
                                           uint32_t *indirect_symtab) {
120
  const bool isDataConst = strcmp(section->segname, SEG_DATA_CONST) == 0;
121

122
    /**
123
     nl_symbol_ptr 和 la_symbol_ptresction 中的 reserved1 字段指明对应的 indirect symbol table 起始的 index
124
     */
125
  uint32_t *indirect_symbol_indices = indirect_symtab + section->reserved1;
126

127
    /**
128
     slide + section->addr 就是符号对应的存放函数的数组，相应的 __nl_symbol_ptr 和 __la_symbol_ptr 相应的函数指针都在这里面了，所以可以去寻找到函数的地址
129
     */
130
  void **indirect_symbol_bindings = (void **)((uintptr_t)slide + section->addr);
131
  vm_prot_t oldProtection = VM_PROT_READ;
132
  if (isDataConst) {
133
    oldProtection = get_protection(rebindings);
134
    mprotect(indirect_symbol_bindings, section->size, PROT_READ | PROT_WRITE);
135
  }
136
    // 遍历section里面的每一个符号
137
  for (uint i = 0; i < section->size / sizeof(void *); i++) {
138
      // 找到符号在Indirect symbol table 表中的值
139
      // 读取 indirect table 中的数据
140
    uint32_t symtab_index = indirect_symbol_indices[i];
141
    if (symtab_index == INDIRECT_SYMBOL_ABS || symtab_index == INDIRECT_SYMBOL_LOCAL ||
142
        symtab_index == (INDIRECT_SYMBOL_LOCAL   | INDIRECT_SYMBOL_ABS)) {
143
      continue;
144
    }
145
      // 以 symtab_index 作为下标，访问 symbol table
146
    uint32_t strtab_offset = symtab[symtab_index].n_un.n_strx;
147
      // 获取到 symbol_name
148
    char *symbol_name = strtab + strtab_offset;
149
      // 判断是否函数的名称是否有两个字符，因为函数前面有个"_"，所以方法名至少两个
150
    bool symbol_name_longer_than_1 = symbol_name[0] && symbol_name[1];
151
      // 遍历最初的链表，来进行hook
152
    struct rebindings_entry *cur = rebindings;
153
    while (cur) {
154
      for (uint j = 0; j < cur->rebindings_nel; j++) {
155

156
          // 判断 symbol_name[1]开始，两个函数的名字是否一致
157
        if (symbol_name_longer_than_1 &&
158
            strcmp(&symbol_name[1], cur->rebindings[j].name) == 0) {
159

160
            // 判断replaced的地址不为null以及我方法的实现和rebindings[j].replacement 的方法不一致
161
          if (cur->rebindings[j].replaced != NULL &&
162
              indirect_symbol_bindings[i] != cur->rebindings[j].replacement) {
163
              // 让 rebindings[j].replaced 保存 indirect_symbol_bindings[i] 的函数地址
164
            *(cur->rebindings[j].replaced) = indirect_symbol_bindings[i];
165
          }
166
            // 将替换后的方法给原先的方法，也就是替换内容为自定义函数地址
167
          indirect_symbol_bindings[i] = cur->rebindings[j].replacement;
168
          goto symbol_loop;
169
        }
170
      }
171
      cur = cur->next;
172
    }
173
  symbol_loop:;
174
  }
175
  if (isDataConst) {
176
    int protection = 0;
177
    if (oldProtection & VM_PROT_READ) {
178
      protection |= PROT_READ;
179
    }
180
    if (oldProtection & VM_PROT_WRITE) {
181
      protection |= PROT_WRITE;
182
    }
183
    if (oldProtection & VM_PROT_EXECUTE) {
184
      protection |= PROT_EXEC;
185
    }
186
    mprotect(indirect_symbol_bindings, section->size, protection);
187
  }
188
}
189

190

191
/// 绑定的核心函数
192
/// @param rebindings 链表头
193
/// @param header image的头
194
/// @param slide ASLR
195
static void rebind_symbols_for_image(struct rebindings_entry *rebindings,
196
                                     const struct mach_header *header,
197
                                     intptr_t slide) {
198
    /**
199
     dladdr() 这个函数就是在程序里面找header
200

201
     可确定指定的address，是否位于构成进程的地址空间的其中一个加载模块（可执行文件或共享库）内。
202

203
     如果某个地址，位于在其上面映射加载模块的基址，和为该加载模块映射的最高虚拟地址之间（包括两端），则认为改地址在加载模块的范围内。
204

205
     如果某个加载模块复合这个条件，则会搜索其动态符号表，以查找指定的address最接近的符号。
206
     最接近符号是指其值等于，或最为接近但小于指定address的符号
207

208
     如果指定的address不再其中一个模块的加载范围内的话，返回0，且不修改Dl_info结构的内容。否则将返回一个非零值，同时设置Dl_info结构的字段。
209

210
     如果在包含address的加载模块内，找不到其值小于或等于address的符号，则dlisname、dli_saddr和dli_size字段将设置为0，dli_bind字段设置为STB_LOCAL，dli_typs字段设置为STT_NOTYPE。
211

212
     */
213
  Dl_info info;
214
  if (dladdr(header, &info) == 0) {
215
    return;
216
  }
217
// 准备从macho里面去找
218
  segment_command_t *cur_seg_cmd;
219
  segment_command_t *linkedit_segment = NULL;
220
  struct symtab_command* symtab_cmd = NULL;
221
  struct dysymtab_command* dysymtab_cmd = NULL;
222
// 跳过header的大小，找到loadCommand
223
  uintptr_t cur = (uintptr_t)header + sizeof(mach_header_t);
224
  for (uint i = 0; i < header->ncmds; i++, cur += cur_seg_cmd->cmdsize) {
225
    cur_seg_cmd = (segment_command_t *)cur;
226
    if (cur_seg_cmd->cmd == LC_SEGMENT_ARCH_DEPENDENT) {
227
      if (strcmp(cur_seg_cmd->segname, SEG_LINKEDIT) == 0) {
228
        linkedit_segment = cur_seg_cmd;
229
      }
230
    } else if (cur_seg_cmd->cmd == LC_SYMTAB) {
231
      symtab_cmd = (struct symtab_command*)cur_seg_cmd;
232
    } else if (cur_seg_cmd->cmd == LC_DYSYMTAB) {
233
      dysymtab_cmd = (struct dysymtab_command*)cur_seg_cmd;
234
    }
235
  }
236
// 如果刚才获取的，有一项为空就直接返回
237
  if (!symtab_cmd || !dysymtab_cmd || !linkedit_segment ||
238
      !dysymtab_cmd->nindirectsyms) {
239
    return;
240
  }
241

242
    // 链接时程序的基址 = __LINKEDEDIT.VM_Address - __LINKEDIT.File_Offset + silde
243
  // Find base symbol/string table addresses
244
  uintptr_t linkedit_base = (uintptr_t)slide + linkedit_segment->vmaddr - linkedit_segment->fileoff;
245
  nlist_t *symtab = (nlist_t *)(linkedit_base + symtab_cmd->symoff);
246
  char *strtab = (char *)(linkedit_base + symtab_cmd->stroff);
247

248
    // 间接（动态）符号表的地址 = 基址 + 符号表偏移量
249
  // Get indirect symbol table (array of uint32_t indices into symbol table)
250
  uint32_t *indirect_symtab = (uint32_t *)(linkedit_base + dysymtab_cmd->indirectsymoff);
251

252
  cur = (uintptr_t)header + sizeof(mach_header_t);
253
  for (uint i = 0; i < header->ncmds; i++, cur += cur_seg_cmd->cmdsize) {
254
    cur_seg_cmd = (segment_command_t *)cur;
255
    if (cur_seg_cmd->cmd == LC_SEGMENT_ARCH_DEPENDENT) {
256
        // 找到Data段
257
      if (strcmp(cur_seg_cmd->segname, SEG_DATA) != 0 &&
258
          strcmp(cur_seg_cmd->segname, SEG_DATA_CONST) != 0) {
259
        continue;
260
      }
261
      for (uint j = 0; j < cur_seg_cmd->nsects; j++) {
262
        section_t *sect =
263
          (section_t *)(cur + sizeof(segment_command_t)) + j;
264
          // 找懒加载表
265
        if ((sect->flags & SECTION_TYPE) == S_LAZY_SYMBOL_POINTERS) {
266
          perform_rebinding_with_section(rebindings, sect, slide, symtab, strtab, indirect_symtab);
267
        }
268
          // 非懒加载表
269
        if ((sect->flags & SECTION_TYPE) == S_NON_LAZY_SYMBOL_POINTERS) {
270
          perform_rebinding_with_section(rebindings, sect, slide, symtab, strtab, indirect_symtab);
271
        }
272
      }
273
    }
274
  }
275
}
276

277
static void _rebind_symbols_for_image(const struct mach_header *header,
278
                                      intptr_t slide) {
279
    rebind_symbols_for_image(_rebindings_head, header, slide);
280
}
281

282
// 指定image进行hook
283
int rebind_symbols_image(void *header,
284
                         intptr_t slide,
285
                         struct rebinding rebindings[],
286
                         size_t rebindings_nel) {
287
    struct rebindings_entry *rebindings_head = NULL;
288
    int retval = prepend_rebindings(&rebindings_head, rebindings, rebindings_nel);
289
    // 这里就少了遍历所有image的操作了
290
    rebind_symbols_for_image(rebindings_head, (const struct mach_header *) header, slide);
291
    if (rebindings_head) {
292
      free(rebindings_head->rebindings);
293
    }
294
    free(rebindings_head);
295
    return retval;
296
}
297

298
/// 未指定image进行hook
299
int rebind_symbols(struct rebinding rebindings[], size_t rebindings_nel) {
300
    // prepend_rebindings 的函数会将整个 rebings 数组添加到 _rebindings_head 这个链表的头部
301
    // fishhook 采用链表的方式来存储每一次调用 rebind_sysbols传入的参数，每次调用，就会在链表的头部插入一个节点，链表的头部是：_rebindings_head
302
  int retval = prepend_rebindings(&_rebindings_head, rebindings, rebindings_nel);
303
    // 根据上面的 prepend_rebindings 来做判断，如果小于0的话，直接返回一个错误码回去
304
  if (retval < 0) {
305
    return retval;
306
  }
307
  // If this was the first call, register callback for image additions (which is also invoked for
308
  // existing images, otherwise, just run on existing images
309
    // 判断 _rebindings_head -> next是否为空，来判断是不是第一次调用
310
  if (!_rebindings_head->next) {
311
      // 第一次调用的话调用 _dyld_register_func_for_add_image 注册监听方法
312
      // 已经被 dyld加载的image会立即加入这个回调
313
      // 之后的image会在dyld装在的时候触发回调
314
    _dyld_register_func_for_add_image(_rebind_symbols_for_image);
315
  } else {
316
      // 遍历已经加载的image，进行hook
317
    uint32_t c = _dyld_image_count();
318
    for (uint32_t i = 0; i < c; i++) {
319
      _rebind_symbols_for_image(_dyld_get_image_header(i), _dyld_get_image_vmaddr_slide(i));
320
    }
321
  }
322
  return retval;
323
}
总结#

rebind_symbols
- rebindings数组添加到链表
- 根据链表判断是否第一次调用，这么做的目的是保证注册方法只会调用一次。两种情况都是为了回调_rebind_symbols_for_image
  - 第一次
    - 利用_dyld_register_func_for_add_image注册监听方法：_rebind_symbols_for_image
  - 不是第一次
    - 循环遍历已经加载的iamge，进行 _rebind_symbols_for_image 回调
_rebind_symbols_for_image
- 第一步
  - 拿到三张表在内存中的地址
    - 符号表地址：symtab
    - 字符串表地址：strtab
    - 动态（间接）符号表地址：indirect_symtab
- 第二步
  - 找懒加载和非懒加载表
- 第三部
  - 调用perform_rebinding_with_section
perform_rebinding_with_section
- 1.得到indirect_symn=bol_bindings
- 2.遍历间接符号表，找到符号
- 3.判断是否是需要hook的
- 4.保存函数指针，然后替换懒加载符号表中的函数地址
完成Hook。