【移動(dòng)應(yīng)用開發(fā)技術(shù)】iOS安全防護(hù)之重簽名防護(hù)與sysctl反調(diào)試的示例分析

【移動(dòng)應(yīng)用開發(fā)技術(shù)】iOS安全防護(hù)之重簽名防護(hù)與sysctl反調(diào)試的示例分析

一重簽名防護(hù)1、查看證明組織單位/upload/information/20200623/126/119310.png2、利用簽名信息進(jìn)行重簽名防護(hù)void

checkCodesign(NSString

*id){

//

描述文件路徑

NSString

*embeddedPath

=

[[NSBundle

mainBundle]

pathForResource:@"embedded"

ofType:@"mobileprovision"];

//

讀取application-identifier

注意描述文件的編碼要使用:NSASCIIStringEncoding

NSString

*embeddedProvisioning

=

[NSString

stringWithContentsOfFile:embeddedPath

encoding:NSASCIIStringEncoding

error:nil];

NSArray

*embeddedProvisioningLines

=

[embeddedProvisioning

componentsSeparatedByCharactersInSet:[NSCharacterSet

newlineCharacterSet]];

for

(int

i

=

0;

i

<

embeddedProvisioningLines.count;

i++)

{

if

([embeddedProvisioningLines[i]

rangeOfString:@"application-identifier"].location

!=

NSNotFound)

{

NSInteger

fromPosition

=

[embeddedProvisioningLines[i+1]

rangeOfString:@"<string>"].location+8;

NSInteger

toPosition

=

[embeddedProvisioningLines[i+1]

rangeOfString:@"</string>"].location;

NSRange

range;

range.location

=

fromPosition;

range.length

=

toPosition

-

fromPosition;

NSString

*fullIdentifier

=

[embeddedProvisioningLines[i+1]

substringWithRange:range];

NSArray

*identifierComponents

=

[fullIdentifier

componentsSeparatedByString:@"."];

NSString

*appIdentifier

=

[identifierComponents

firstObject];

//

對比簽名ID

if

(![appIdentifier

isEqual:id])

{

//exit

asm(

"mov

X0,#0\n"

"mov

w16,#1\n"

"svc

#0x80"

);

}

break;

}

}

}二sysctl檢測是否被調(diào)試#import

<sys/sysctl.h>

bool

checkDebugger(){

//控制碼

int

name[4];//放字節(jié)碼-查詢信息

name[0]

=

CTL_KERN;//內(nèi)核查看

name[1]

=

KERN_PROC;//查詢進(jìn)程

name[2]

=

KERN_PROC_PID;

//通過進(jìn)程id查進(jìn)程

name[3]

=

getpid();//拿到自己進(jìn)程的id

//查詢結(jié)果

struct

kinfo_proc

info;//進(jìn)程查詢信息結(jié)果

size_t

info_size

=

sizeof(info);//結(jié)構(gòu)體大小

int

error

=

sysctl(name,

sizeof(name)/sizeof(*name),

&info,

&info_size,

0,

0);

assert(error

==

0);//0就是沒有錯(cuò)誤

//結(jié)果解析

p_flag的第12位為1就是有調(diào)試

//p_flag

與

P_TRACED

=0

就是有調(diào)試

return

((info.kp_proc.p_flag

&

P_TRACED)

!=0);

}if

(checkDebugger())

{

asm("mov

X0,#0\n"

"mov

w16,#1\n"

"svc

#0x80"

);

}三針對二破解sysctl//原始函數(shù)的地址

int

(*sysctl_p)(int

*,

u_int,

void

*,

size_t

*,

void

*,

size_t);

//自定義函數(shù)

int

mySysctl(int

*name,

u_int

namelen,

void

*info,

size_t

*infosize,

void

*newinfo,

size_t

newinfosize){

if

(namelen

==

4

&&

name[0]

==

CTL_KERN

&&

name[1]

==

KERN_PROC

&&

name[2]

==

KERN_PROC_PID

&&

info

&&

(int)*infosize

==

sizeof(struct

kinfo_proc))

{

int

err

=

sysctl_p(name,

namelen,

info,

infosize,

newinfo,

newinfosize);

//拿出info做判斷

struct

kinfo_proc

*

myInfo

=

(struct

kinfo_proc

*)info;

if((myInfo->kp_proc.p_flag

&

P_TRACED)

!=

0){

//使用異或取反

myInfo->kp_proc.p_flag

^=

P_TRACED;

}

return

err;

}

return

sysctl_p(name,

namelen,

info,

infosize,

newinfo,

newinfosize);

}

+(void)load

{

//交換

rebind_symbols((str