frida / frida-objc-bridge

Objective-C runtime interop from Frida
49 stars 21 forks source link

'parseSignature' will make duplicate `id` for different function #22

Closed gebing closed 5 years ago

gebing commented 5 years ago

'parseSignature' will return object with field id, which is used for looking up objc_msgSend function from cache. But if target function's return's type of arguments' type is a array, such as structure or union, it will make the duplicate id which is same as other function without array, and it will cause the method's invocation will fail for invalid argument value.

For example:

typedef union { uint8_t b; uint16_t s; uint32_t i; uint64_t l; } FridaUnion;
@interface FridaTest2 : NSObject
@end
@implementation FridaTest2
+ (uint64_t)_unsigned_long_long:(uint64_t)x { return x; }
+ (FridaUnion)_union:(FridaUnion)x { return x; }
@end

Function _unsigned_long_long's signature is Q24@0:8Q16, and id is uint64pointerpointeruint64. Function _union's signature is (?=CSIQ)24@0:8(?=CSIQ)16, and id is uint64pointerpointeruint64 too.

This error is because the type's toString is same for primary type and array type. Later i will make a pull request for fixing this bug, and also add some test cases for it.