security

AntiAntiDebug

反反调试：针对ptrace、sysctl、syscall,采用hook函数->判断函数-〉返回结果的流程；hook的方式有越狱环境的hook、非越狱环境的hook以及在lldb的时候采用python脚本自动在目标函数设置条件断点,在断点的回调中改变对应的寄存器。

Posted by kunnan on August 17, 2018

越狱hook

  • AntiAntiDebugTweak.xm

    %ctor{
    MSHookFunction((void *)MSFindSymbol(NULL,"_ptrace"),(void*)my_ptrace,(void**)&orig_ptrace);
    MSHookFunction((void *)sysctl,(void*)my_sysctl,(void**)&orig_sysctl);
    MSHookFunction((void *)syscall,(void*)my_syscall,(void**)&orig_syscall);
    NSLog(@"[AntiAntiDebug] Module loaded!!!");
}

非越狱hook

非越狱hook的原理和越狱hook的一样，只是将hook的工具修改为fishhook.

  • AntiAntiDebug.m

  • AntiAntiDebug.m 此代码已经集成在MonkeyAppLibrary.xctemplate

    __attribute__((constructor)) static void entry(){
    NSLog(@"[AntiAntiDebug Init]");
      
    rebind_symbols(
    (struct rebinding[1])
    {
    {"ptrace", my_ptrace, (void*)&orig_ptrace}
    },1);
      
    rebind_symbols((struct rebinding[1]){
    {"dlsym", my_dlsym, (void*)&orig_dlsym}
    },1);
      
    //some app will crash with _dyld_debugger_notification
    // rebind_symbols((struct rebinding[1]){
    {"sysctl", my_sysctl, (void*)&orig_sysctl}
    },1);
      
    rebind_symbols((struct rebinding[1]){
    {"syscall", my_syscall, (void*)&orig_syscall}
    },1);
}

AntiAntiDebug.py 反反调试脚本;如果有定时器定时检测，建议写tweak(越狱hook、非越狱hook)

See Also

/Users/devzkn/bin//knpost AntiAntiDebug 反反调试：针对ptrace\sysctl\syscall,采用hook函数-》判断函数-〉返回结果的流程；hook的方式有越狱环境的hook、非越狱环境的hook以及在lldb的时候采用python脚本自动在目标函数设置条件断点，在断点的回调中改变对应的寄存器。 -t security
#原来""的参数，需要自己加上""

转载请注明： > AntiAntiDebug

Search
    CATALOG
      FEATURED TAGS
      iOS Debug Open_Source_Framework RunLoop Swift Xcode ReactiveCocoa Runtime Mac Efficiency Terminal Git objc CocoaPods ruby shell iosre Cycript OutlineOfChineseHistory Workplace GoogleMethodology Search CocoaTouchStaticLibrary ReadaBookEveryDay miniprogram es6 internet py Xiang_Shuai_Beida_Finance_Course frida WebScoket note MobileSubstrate security dyld MGCopy Logical_thinking Knowledge_is_power jb How_to_be_a_master_of_network_management hook DeviceInfo Video
      FRIENDS