在介绍fishhook原理之前，我们先看两个例子
demo 1
- (void)viewDidLoad {
[super viewDidLoad];
//rebinding结构体
struct rebinding nslog;
nslog.name = "NSLog";
nslog.replacement = myNslog;
nslog.replaced = (void *)&sys_nslog;
//rebinding结构体数组
struct rebinding rebs[1] = {nslog};
/**
* 存放rebinding结构体的数组
* 数组的长度
*/
rebind_symbols(rebs, 1);
}
//---------------------------------更改NSLog-----------
//函数指针
static void(*sys_nslog)(NSString * format,...);
//定义一个新的函数
void myNslog(NSString * format,...){
format = [format stringByAppendingString:@"勾上了！\n"];
//调用原始的
sys_nslog(format);
}
-(void)touchesBegan:(NSSet<UITouch *> *)touches withEvent:(UIEvent *)event
{
NSLog(@"点击了屏幕！！");
}
Snip20200428_17.png
发现hook住了
demo2
void func(const char * str){
NSLog(@"%s",str);
}
- (void)viewDidLoad {
[super viewDidLoad];
//rebinding结构体
struct rebinding nslog;
nslog.name = "func";
nslog.replacement = new_func;
nslog.replaced = (void *)&old_func;
//rebinding结构体数组
struct rebinding rebs[1] = {nslog};
/**
* 存放rebinding结构体的数组
* 数组的长度
*/
rebind_symbols(rebs, 1);
}
//---------------------------------更改NSLog-----------
//函数指针
static void(*old_func)(const char * str);
//定义一个新的函数
void new_func(const char * str){
NSLog(@"%s + 1",str);
}
-(void)touchesBegan:(NSSet<UITouch *> *)touches withEvent:(UIEvent *)event
{
func("哈哈");
}
Snip20200428_19.png
发现没有hook住
两者之间的区别是啥呢？为什么一个能hook住一个不可以么，这个时候就需要了解hook的原理了
官方对fishhook的原理介绍
dyld binds lazy and non-lazy symbols by updating pointers in particular
sections of the __DATA segment of a Mach-O binary. fishhook re-binds these
symbols by determining the locations to update for each of the symbol
names passed to rebind_symbols and then writing out the corresponding
replacements.
For a given image, the __DATA segment may contain two sections that are
relevant for dynamic symbol bindings: __nl_symbol_ptr and __la_symbol_ptr.
__nl_symbol_ptr is an array of pointers to non-lazily bound data (these are
bound at the time a library is loaded) and __la_symbol_ptr is an array of
pointers to imported functions that is generally filled by a routine called
dyld_stub_binder during the first call to that symbol (it's also possible to tell
dyld to bind these at launch). In order to find the name of the symbol that
corresponds to a particular location in one of these sections, we have to jump
through several layers of indirection. For the two relevant sections, the
section headers (struct sections from <mach-o/loader.h>) provide an offset
(in the reserved1 field) into what is known as the indirect symbol table. The
indirect symbol table, which is located in the __LINKEDIT segment of the
binary, is just an array of indexes into the symbol table (also in __LINKEDIT)
whose order is identical to that of the pointers in the non-lazy and lazy
symbol sections. So, given struct section nl_symbol_ptr, the corresponding
index in the symbol table of the first address in that section is
indirect_symbol_table[nl_symbol_ptr->reserved1]. The symbol table itself is
an array of struct nlists (see <mach-o/nlist.h>), and each nlist contains an
index into the string table in __LINKEDIT which where the actual symbol
names are stored. So, for each pointer __nl_symbol_ptr and
__la_symbol_ptr, we are able to find the corresponding symbol and then the
corresponding string to compare against the requested symbol names, and if
there is a match, we replace the pointer in the section with the replacement.
The process of looking up the name of a given entry in the lazy or non-lazy
pointer tables looks like this:
fishhook.png
