汽车之家APP基于Mach-O的探索与实践

NSBundle *bundle = [NSBundle bundleForClass:objClass];

NSArray<NSNumber *> *callAddresses = [NSThread callStackReturnAddresses];
long long callStackAddress = [callAddresses[i] longLongValue];
Dl_info info = {0};
dladdr((void *)callStackAddress, &info); //获取堆栈地址对应的可执行文件信息
NSString *dliFname = [NSString stringWithFormat:@"%s",info.dli_fname]; //取出库名

mach_header_64 mhHeader;
//读取头部信息
[fileData getBytes:&mhHeader range:NSMakeRange(0, sizeof(mach_header_64))];
for (int i = 0; i < mhHeader.ncmds; i++) {
    load_command* cmd = (load_command *)malloc(sizeof(load_command));
    //读取Load_command
    [fileData getBytes:cmd range:NSMakeRange(currentLcLocation, sizeof(load_command))];
    if (cmd->cmd == LC_SEGMENT_64) {
      segment_command_64 segmentCommand;
      [fileData getBytes:&segmentCommand range:NSMakeRange(currentLcLocation, sizeof(segment_command_64))];
      NSString *segName = [NSString stringWithFormat:@"%s",segmentCommand.segname];
      //提取汇编代码 __TEXT
      if ([segName isEqualToString:SEGMENT_TEXT] || [segName isEqualToString:SEGMENT_BD_TEXT]) {
         section_64 sectionHeader;
         [fileData getBytes:§ionHeader range:NSMakeRange(currentSecLocation, sizeof(section_64))];
         NSString *secName = [[NSString alloc] initWithUTF8String:sectionHeader.sectname];
      }else if ([segName isEqualToString:SEGMENT_DATA]) {
         //提取指定DATA sectionHeader信息
         unsigned long long currentSecLocation = currentLcLocation + sizeof(segment_command_64);
      }
    //符号表
    }else if (cmd->cmd ==LC_SYMTAB){
       symtab_command  tsymtabcommand;
       [fileData getBytes:&tsymtabcommand range:NSMakeRange(currentLcLocation, sizeof(segment_command_64))];
       symtabcommand = tsymtabcommand;
    }else if(cmd->cmd == LC_FUNCTION_STARTS){
       [fileData getBytes:&funcStartHeader range:NSMakeRange(currentLcLocation, sizeof(linkedit_data_command))];
    }
}

NSString *imageName = [[NSString alloc] initWithUTF8String:_dyld_get_image_name(i)];
//找到APP主二进制
if (_dyld_get_image_header(i)->filetype == MH_EXECUTE &&
[imageName containsString:mainBundle.executablePath]) {
  mainExecuteAddress = _dyld_get_image_vmaddr_slide(i);
    break;
}
uintptr_t os = (uintptr_t)objClass;
//计算出类的偏移地址
uintptr_t classInBundleAddress = os-mainExcuteAddress;
NSDictionary *classMap = [self pluginAllAddressWithClass];
for (NSString * key in classMap.allKeys) {
    NSDictionary *addressDic =  classMap[key];
    if (addressDic && [addressDic[@"end"] longLongValue]>classInBundleAddress && classInBundleAddress>=[addressDic[@"start"] longLongValue]) {
        return key;
    }
}

NSBundle *mainBundle = [NSBundle mainBundle];
Dl_info info = {0};
//获取堆栈地址对应的插件信息
dladdr((void *)callStackAddress, &info);
//获取二进制名
NSString *dliFname = [NSString stringWithFormat:@"%s",info.dli_fname];
//获取偏移量
uintptr_t callStackBundleAddress = callStackAddress-[self mainStartAddress];
NSDictionary *textMap = [self pluginAllAddressWithText];
for (NSString * key in textMap.allKeys) {
NSDictionary *addressDic = textMap[key];
//查找所属静态库
   if ([addressDic[@"end"] longLongValue]>callStackBundleAddress &&callStackBundleAddress>=[addressDic[@"start"] longLongValue]) 
    {
         return key;
    }     
}

vm:(unsigned long long)vm {
   mach_header_64 mhHeader;
   //解析头部
   [fileData getBytes:&mhHeader range:NSMakeRange(0, sizeof(mach_header_64))];
   // 获取汇编代码的偏移地址和大小
   char *ot_sect = (char *)[fileData bytes] + begin;
   uint64_t ot_addr = vm + begin;
   csh cs_handle = 0;
   cs_insn *cs_insn = NULL;
   cs_err cserr;
   if ((cserr = cs_open(CS_ARCH_ARM64, CS_MODE_ARM, &cs_handle)) != CS_ERR_OK ) {
       NSLog(@"未能初始化: %d, %s.", cserr, cs_strerror(cs_errno(cs_handle)));
       return NULL;
   }
   // 设置解析模式
   cs_option(cs_handle, CS_OPT_DETAIL, CS_OPT_ON);
   cs_option(cs_handle, CS_OPT_SKIPDATA, CS_OPT_ON);
   // 反汇编
   size_t disasm_count = cs_disasm(cs_handle, (const uint8_t *)ot_sect, size, ot_addr, 0, &cs_insn);
   if (disasm_count < 1 ) {
       NSLog(@"汇编指令解析不符合预期！");
       return NULL;
   }
   return cs_insn;
}

//检索方法偏移范围
do {
       @autoreleasepool {
           unsigned long long index = (end - textList.addr) / 4;
           char *dataStr = s_cs_insn[index].mnemonic;
           //查找是否是函数跳转指令，记录方法的开始和结束地址
           if (strcmp(dataStr, "b")== 0|| strcmp(dataStr, "ret")==0) {
               unsigned long long nextSymoble = end + 4;
               MethodHelper *nextMethodHelper = [objectSymbolMap objectForKey:[NSNumber numberWithUnsignedLong:nextSymoble]];
               if (nextMethodHelper && ![nextMethodHelper.className isEqualToString:className]){
                   //找到类的最后一个函数地址作为类的结束地址
                   callClassHelper.end = end;
                   return callClassHelper;
               }
           }
           end += 4;
       }
   } while (end <= textList.addr + textList.size);