search

comex / inject_and_interpose

like mach_inject
127 stars 53 forks source link

Interposition doesn't work on iOS 9 and arm64 #14

Closed emonti closed 9 years ago

emonti commented 9 years ago

Very strangely, interpose.c stopped working on some symbols on iOS 9, but only on arm64. For example, try hooking _SSLHandshake called from CFNetwork -- SocketStream::_PerformSecurityHandshake_NoLock. If we add logging to the hook insertion routine, you'll see the interposition gets installed on CFNetwork imports, but it is never invoked when SSLHandshake is called.

OTOH, if we try a hook on _open we see it gets invoked consistently when calling [NSString stringWithContentsOfFile:] via Foundation -- _NSReadBytesFromFileWithExtendedAttributes for example.

Also, both seem to work just fine on armv7 and even on arm64 on iOS 8.

comex commented 9 years ago

It's because of an optimization added in iOS 9 - calls from one library in the shared cache to another are now patched at cache build time into direct calls, skipping the dyld stubs. Since the offsets are encoded directly into the signed code, it is no longer possible to hook them on a non-jailbroken device without some relatively drastic measures (e.g. mprotect, hardware breakpoints, re-signing...).

emonti commented 9 years ago

Ah. makes sense. Thanks for the response!