jmpews / Dobby

a lightweight, multi-platform, multi-architecture hook framework.
Apache License 2.0
4k stars 833 forks source link

Under iOS13/14`DobbyInstrument` will let application crash #170

Open BoringApp opened 2 years ago

BoringApp commented 2 years ago

Under iOS 13/14 DobbyInstrument will let application crash. I resign my application, all things looks good when I use Xcode start debug my application and DobbyInstrument works well. But when I launch my application from Springboard, my application just crash at DobbyInstrument p.s

  1. enable "near branch trampoline" doesn't help solve this problem.
  2. DobbyGlobalOffsetTableReplace works will.
  3. iPhone doesn't jailbreak, and iOS version is iOS 13 and iOS 14.
  4. Xcode deployment target is iOS 12
  5. Xcode version is 13.0

Here is crash log:

Exception Type:  EXC_BAD_ACCESS (SIGKILL - CODESIGNING)
Exception Subtype: UNKNOWN_0x32 at 0x000000010a8ac000
VM Region Info: 0x10a8ac000 is in 0x10a8ac000-0x10a8b0000;  bytes after start: 0  bytes before end: 16383
      REGION TYPE                 START - END      [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
      shared memory            10a8a8000-10a8ac000 [   16K] r--/r-- SM=SHM  
--->  Memory Tag 255           10a8ac000-10a8b0000 [   16K] r-x/rwx SM=PRV  
      MALLOC_LARGE             10a8b0000-10a8bc000 [   48K] rw-/rwx SM=PRV  

Termination Reason: Namespace CODESIGNING, Code 0x2
Triggered by Thread:  0

请教一下 在 iOS 中使用 DobbyInstrument 会导致应用闪退,这个该怎么处理? 我使用 Xcode 重签了自己的 App,使用 Xcode 调试下启动应用可以正常打开并 DobbyInstrument 正确 hook 方法。 我在 Springboard 上直接打开我的 App,直接就闪退了。iOS 收集的日志是:"Exception Type: EXC_BAD_ACCESS (SIGKILL - CODESIGNING), Termination Reason: Namespace CODESIGNING, Code 0x2"

感觉可能是在写内存的时候崩溃了? p.s

  1. 使用 dobby_enable_near_branch_trampoline 和不使用都一样会在 DobbyInstrument 崩溃;
  2. DobbyGlobalOffsetTableReplace 不会崩溃;
  3. iPhone 没有越狱;
  4. Xcode deployment target 是 iOS 12
  5. Xcode 版本是 13.0