越狱设备代码注入原理及防护

越狱的设备上，在应用运行的时候插入动态库
划重点----DYLD_INSERT_LIBRARIES

DYLD源码分析

dyld.cpp-插入任意的libraries

_main(const macho_header* mainExecutableMH, uintptr_t mainExecutableSlide, 
        int argc, const char* argv[], const char* envp[], const char* apple[], 
        uintptr_t* startGlue){
  ...
#if __MAC_OS_X_VERSION_MIN_REQUIRED
    //当allowEnvVarsPrint、allowEnvVarsPath、allowEnvVarsSharedCache全为false时
    if ( !gLinkContext.allowEnvVarsPrint && !gLinkContext.allowEnvVarsPath && !gLinkContext.allowEnvVarsSharedCache ) {
                //移除插入的环境变量，执行这个方法后面的插入就会失败
        pruneEnvironmentVariables(envp, &apple);
        // set again because envp and apple may have changed or moved
        setContext(mainExecutableMH, argc, argv, envp, apple);
    }
    else
#endif
  ...
    // load any inserted libraries
    if  ( sEnv.DYLD_INSERT_LIBRARIES != NULL ) {
        for (const char* const* lib = sEnv.DYLD_INSERT_LIBRARIES; *lib != NULL; ++lib) 
            loadInsertedDylib(*lib);
    }
  ...
  return result;  
}

如何才能让allowEnvVarsPrint、allowEnvVarsPath、allowEnvVarsSharedCache全为false呢
dyld.cpp

static void configureProcessRestrictions(const macho_header* mainExecutableMH)
{
  ...
        bool isRestricted = false;
        bool libraryValidation = false;
        // any processes with setuid or setgid bit set or with __RESTRICT segment is restricted
                //issetugid无法改变，所以只有看hasRestrictedSegment什么时候为true
        if ( issetugid() || hasRestrictedSegment(mainExecutableMH) ) {
            isRestricted = true;
        }
        bool usingSIP = (csr_check(CSR_ALLOW_TASK_FOR_PID) != 0);
        uint32_t flags;
        if ( csops(0, CS_OPS_STATUS, &flags, sizeof(flags)) != -1 ) {
            // On OS X CS_RESTRICT means the program was signed with entitlements
            if ( ((flags & CS_RESTRICT) == CS_RESTRICT) && usingSIP ) {
                isRestricted = true;
            }
            // Library Validation loosens searching but requires everything to be code signed
            if ( flags & CS_REQUIRE_LV ) {
                isRestricted = false;
                libraryValidation = true;
            }
        }
        //当isRestricted为true时
    gLinkContext.allowAtPaths                = !isRestricted;
    gLinkContext.allowEnvVarsPrint           = !isRestricted;
    gLinkContext.allowEnvVarsPath            = !isRestricted;
  ...
}

//
// Look for a special segment in the mach header. 
// Its presences means that the binary wants to have DYLD ignore
// DYLD_ environment variables.
//
#if __MAC_OS_X_VERSION_MIN_REQUIRED
//mh为MachO文件的头
static bool hasRestrictedSegment(const macho_header* mh)
{
    const uint32_t cmd_count = mh->ncmds;
         //cmds为commands
    const struct load_command* const cmds = (struct load_command*)(((char*)mh)+sizeof(macho_header));
    const struct load_command* cmd = cmds;
    for (uint32_t i = 0; i < cmd_count; ++i) {
        switch (cmd->cmd) {
            case LC_SEGMENT_COMMAND:
            {
                                //取出SEGMENT
                const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
                
                //dyld::log("seg name: %s\n", seg->segname);
                                //是否存在segment的那么为__RESTRICT
                if (strcmp(seg->segname, "__RESTRICT") == 0) {
                    const struct macho_section* const sectionsStart = (struct macho_section*)((char*)seg + sizeof(struct macho_segment_command));
                    const struct macho_section* const sectionsEnd = &sectionsStart[seg->nsects];
                    for (const struct macho_section* sect=sectionsStart; sect < sectionsEnd; ++sect) {
                                                //是否存在segment的value为__restrict
                        if (strcmp(sect->sectname, "__restrict") == 0) 
                            return true;
                    }
                }
            }
            break;
        }
        cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
    }
        
    return false;
}
#endif

总结
通过在Mach-O文件中，增加segname为__RESTRICT，value为__restrict的值，可以使isRestricted返回YES，然后后gLinkContext.allowAtPaths、gLinkContext.allowEnvVarsPrint、gLinkContext.allowEnvVarsPath值就为false，进而执行pruneEnvironmentVariables方法，移除插入的环境变量，最终是的插入失败

越狱防护

Build Setting -> Other Linker Flags 中新增内容

-Wl,-sectcreate,__RESTRICT,__restrict,/dev/null

这个设置可以在Mach-O文件中增加segname为__RESTRICT，value为__restrict的段，以达到防护的效果！！！

生活如此美好，今天就点到为止。。。