[iOS逆向工程] 在汇编语言调试中获取当前实例句柄

﹏ヽ暗。殇╰゛Y 2022-05-10 16:10 29阅读 0赞

在分析Safari行为的时候想到要用objective-c的特性随时可以语义化的查看一下UIView的各种状态，比如在UIView方法内部设了个断点，想看一下当前视图结构。只要得到当前实例的句柄就可以了。查了一些资料，记录一下。

## 函数参数的传递 ##

iOS Simulator里应用是跑在32bits模式下的(在Activity Monitor可以看到)，依据<<Mac OS Debug Magic>>里关于Intel 32bits参数传递的 [定义][Link 1] :

**Table 2 : **Accessing parameters on Intel 32-bit

(64bits是先使用通用寄存器来传递参数，不足时再使用其它方式)

<table style="border-top-width:1px; border-top-style:solid; border-top-color:rgb(155,179,205); border-left-width:1px; border-left-style:solid; border-left-color:rgb(155,179,205); margin-bottom:4em; font-family:'Lucida Grande',Geneva,Verdana,Arial,Helvetica,sans-serif"> 
 <tbody> 
  <tr> 
   <th style="font-size:12.727272033691406px; vertical-align:top; padding:0.333em 0.667em; background-color:rgb(147,165,187); border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205); color:rgb(255,255,255)"> <strong>What</strong></th> 
   <th style="font-size:12.727272033691406px; vertical-align:top; padding:0.333em 0.667em; background-color:rgb(147,165,187); border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205); color:rgb(255,255,255)"> <strong>GDB Syntax</strong></th> 
  </tr> 
  <tr> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> return address</td> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> *(int*)$esp</td> 
  </tr> 
  <tr> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> first parameter</td> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> *(int*)($esp+4)</td> 
  </tr> 
  <tr> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> second parameter</td> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> *(int*)($esp+8)</td> 
  </tr> 
  <tr> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> ... and so on</td> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> &nbsp;</td> 
  </tr> 
 </tbody> 
</table>

如果已经进入到函数体，也就是过函数参数处理部分(开场位置, prologue), 参数就要到调用帧寄存器(frame register)ebp中去获取了。

**Table 3 : **Accessing parameters after the prologue

<table style="border-top-width:1px; border-top-style:solid; border-top-color:rgb(155,179,205); border-left-width:1px; border-left-style:solid; border-left-color:rgb(155,179,205); margin-bottom:4em; font-family:'Lucida Grande',Geneva,Verdana,Arial,Helvetica,sans-serif"> 
 <tbody> 
  <tr> 
   <th style="font-size:12.727272033691406px; vertical-align:top; padding:0.333em 0.667em; background-color:rgb(147,165,187); border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205); color:rgb(255,255,255)"> <strong>What</strong></th> 
   <th style="font-size:12.727272033691406px; vertical-align:top; padding:0.333em 0.667em; background-color:rgb(147,165,187); border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205); color:rgb(255,255,255)"> <strong>GDB Syntax</strong></th> 
  </tr> 
  <tr> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> previous frame</td> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> *(int*)$ebp</td> 
  </tr> 
  <tr> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> return address</td> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> *(int*)($ebp+4)</td> 
  </tr> 
  <tr> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> first parameter</td> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> *(int*)($ebp+8)</td> 
  </tr> 
  <tr> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> second parameter</td> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> *(int*)($ebp+12)</td> 
  </tr> 
  <tr> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> ... and so on</td> 
   <td style="font-size:12.727272033691406px; padding:0.667em; vertical-align:middle; border-bottom-width:1px; border-bottom-style:solid; border-bottom-color:rgb(155,179,205); border-right-width:1px; border-right-style:solid; border-right-color:rgb(155,179,205)"> &nbsp;</td> 
  </tr> 
 </tbody> 
</table>

**返回值存放在EAX寄存器中。**

既然知道参数是如何存储的，那C++和Objective-C是如何传递当前实例的句柄的呢？

答案在同一份文档的[这里][Link 2]:

**当在汇编语言下调试Cocoa代码，请记住以下运行时特性：**

*  The Objective-C compiler adds two implicit parameters to each method, the first of which is a pointer to the object being called (`self`).
 *  The second implicit parameter is the method selector (`_cmd`). In Objective-C this is of type `SEL`; in GDB you can print this as a C string.
 *  The Objective-C runtime dispatches methods via a family of C function. The most commonly seen is `objc_msgSend`, but some architectures use `objc_msgSend_stret` for methods which returns structures, and some architectures use`objc_msgSend_fpret` for methods that return floating point values. There are also equivalent functions for calling `super` (`objc_msgSendSuper` and so on).
 *  The first word of any Objective-C object (the `isa` field) is a pointer to the object's class.

就是函数调用时第一个参数就是操作对应的对象(如果自己的方法，就是self了), 第二参数就是selector method.

## **实战** ##

分析一下CALayer::addSublayer中的执行情况,

![1355850471_7412.png][]

![Image 1][]

在这里使用lldb memory指令:

**(lldb)** me read -s4 -fx -c4 \`$esp\`  
0xb01dd28c: 0x0000a07c **0x0929e170 0x04e7aad3** 0x1386d750

再调用一个检查一下句柄:

**(lldb)** **po \[0x0929e170 description\] 或者**

**(lldb) ****po \[\`\*(int\*)($esp\+4)\` description\]**  
(id) $102 = 0x0929e210 <CALayer: 0x929e170>

* (\*注意, \`不是单引号!  如果这个对象是UIView, 使用recursiveDescription你就知道它的威力了! )*

**(lldb)** **po \[\*(0x0929e170) isHidden\]**  
(id) $105 = 0x00000001 \[no Objective-C description available\]

这样就可以调用其它方法进行操作了。

再次验证一下第二个参数:

**(lldb)** **me read -s4 -fs 0x4e7aad3 **

**或者 **

**(lldb) ****me read -s4 -fs \`\*(int\*)($esp+8)\`**

0x04e7aad3: "addSublayer:"

0x04e7aae0: NULL

用一个检查UIView层次的实例来展示它的强大:

**(lldb)** **po \[\[\`\*(int\*)($esp+4)\` superview\] recursiveDescription\]**

(id) $7 = 0x0719f940 <UIWebSelectionView: 0x107d74e0; frame = (0 0; 0 0); layer = <CALayer: 0x107d7620>>

| <UIView: 0x107d7770; frame = (0 0; 0 0); userInteractionEnabled = NO; layer = <CALayer: 0x107d77d0>>

| <UIWebSelectionOutline: 0x759b340; frame = (-2 -2; 4 4); userInteractionEnabled = NO; layer = <CALayer: 0x75963e0>>

|    | <UIView: 0x759b3f0; frame = (0 0; 0 0); layer = <CALayer: 0x759d580>>

|    | <UIView: 0x759da60; frame = (0 0; 0 0); layer = <CALayer: 0x759bfb0>>

|    | <UIView: 0x759be40; frame = (0 0; 0 0); layer = <CALayer: 0x759db30>>

|    | <UIView: 0x718d150; frame = (0 0; 0 0); layer = <CALayer: 0x719f650>>

**附注:**

\*如果是C++, 则第一个参数就是this，所以也很方便查。而函数返回值放在EAX中，在ret位置设个断点，也可以很方便查看。

\*这个调试过程最好使用LLDB, 它对Objective-C的支持要好很多。

**Reference**:

[iOS Debug Magic][]

[Mac OS Debug Magic][]

转载请注明出处: http://blog.csdn.net/horkychen

[Link 1]: http://developer.apple.com/library/ios/technotes/tn2004/tn2124.html#TABINTEL32
[Link 2]: http://developer.apple.com/library/ios/#technotes/tn2004/tn2124.html#SECOBJECTIVEC
[1355850471_7412.png]: https://img-my.csdn.net/uploads/201212/19/1355850471_7412.png
[Image 1]: 
[iOS Debug Magic]: http://developer.apple.com/library/ios/#technotes/tn2239/_index.html
[Mac OS Debug Magic]: http://developer.apple.com/library/ios/#technotes/tn2004/tn2124.html