3

I'm having trouble using MobileSubstrate's MSHookFunction() to hook certain library function calls. For example, hooking memcpy and memset causes a crash on app launch however hooking memcmp works fine.

I assume that this is because the hooking code itself uses those function calls?

Is there any way to hook memcpy and memset on iOS?

gigasai
  • 564
  • 4
  • 23
David Kaplan
  • 81
  • 1
  • 6

3 Answers3

0

I got the same situation for memcpy and opendir. iPhone 5, iOS6.1.2

MSHookFunction sometimes returns odd (xxxx3) address as original routine's address. It's nonsense for ARM.

Supercedes
  • 1
  • Just implement your own hooking function. – David Kaplan May 01 '13 at 21:14
  • @DavidKaplan So, first of all, Supercedes's question is confusing, and so more information should be asked after; in this case, what the original function is, what they mean by "returns" (is this the out pointer parameter?)... odd addresses are definitely valid on ARM: they are how you represent the address to a function coded in Thumb. People should be encouraged to work together, to file bug reports, not "just implement your own". If this is a real issue, other people may be running into it; if it isn't, they should be trying to find out what is happening. Either way: you were unhelpful :(. – Jay Freeman -saurik- Apr 28 '15 at 18:37
0

I've encountered this one as well and I think the reason for the failure is that the function that the loader returns as dlsym for memcpy is actually not a real function, but a stub for it. I've dumped the address and the bytes, decached the libsystem_c and verified that this following function is returned to me by dlsym(RTLD_DEFAULT, "memcpy")

; void *memcpy_0(void *, const void *, size_t)
__picsymbolstub4:3947B37C                 EXPORT _memcpy_0
__picsymbolstub4:3947B37C _memcpy_0                               ; CODE XREF: _strlcpy+22p
__picsymbolstub4:3947B37C                                         ; _strlcpy+32p ...
__picsymbolstub4:3947B37C                 LDR             R12, =(_memcpy_ptr - 0x3947B388) ; j__memcpy
__picsymbolstub4:3947B380                 ADD             R12, PC, R12 ; _memcpy_ptr
__picsymbolstub4:3947B384                 LDR             PC, [R12] ; _memcpy
__picsymbolstub4:3947B384 ; End of function _memcpy_0
__picsymbolstub4:3947B388 off_3947B388    DCD _memcpy_ptr - 0x3947B388

As you can see this code is PC relative and this is probably why the MSHook fails. If you try to hook the real function instead, the one that this stub calls - it works.

Moshe Kravchik
  • 2,341
  • 2
  • 16
  • 18
  • Perhaps because the stub is too short for the trampoline MobileSubstrate is doing. An ARM trampoline is only 8 bytes though... – David Kaplan Mar 06 '14 at 14:08
0

I never got to the bottom of this. I was thinking that maybe MobileSubstrate calls functions in the same memory page that I'm trying to hook and therefore the mem protections get all messed up.

I got around this by writing my own hooking function.

David Kaplan
  • 81
  • 1
  • 6
  • Do you have the source for MSHookFunction? I tried downloading the sources for it from saurik git repoistory. but i got killed when trying to compile againts it. All i need is the function MShookFunction not anything else. – Itay Levin Nov 08 '12 at 13:45
  • @David Kaplan Can you help me using this class? It says MSHookfunction() not found http://pastie.org/1882125 – zzzzz Mar 27 '13 at 11:48
  • @DavidKaplan I got referred here because someone came to #substrate on IRC pointing to this StackOverflow post, making it sound like your "correct" answer indicated the only way to solve this problem is to write your own hooking code. It encouraged them to not even bother explaining their problem, acting like the options available were 1) fix it themselves if it were open source or 2) figure out how it works and reimplement it :/. The correct answer here is probably the person who said that the function being hooked is just a stub. I can look into if the stub can be hooked in the general case. – Jay Freeman -saurik- Apr 28 '15 at 18:41