1
.section__TEXT,__text,regular,pure_instructions
2
.build_version macos, 15, 0sdk_version 15, 4
3
.p2align2                               ; -- Begin function -[MyClass sayHello]
4
"-[MyClass sayHello]":                  ; @"\\01-[MyClass sayHello]"
5
.cfi_startproc
6
; %bb.0:
7
subsp, sp, #32
8
stpx29, x30, [sp, #16]             ; 16-byte Folded Spill
9
addx29, sp, #16
10
.cfi_def_cfa w29, 16
11
.cfi_offset w30, -8
12
.cfi_offset w29, -16
13
strx0, [sp, #8]
14
strx1, [sp]
15
adrpx0, l_.str@PAGE
16
addx0, x0, l_.str@PAGEOFF
17
bl_printf
18
ldpx29, x30, [sp, #16]             ; 16-byte Folded Reload
19
addsp, sp, #32
20
ret
21
.cfi_endproc
22
                                        ; -- End function
23
.globl_main                           ; -- Begin function main
24
.p2align2
25
_main:                                  ; @main
26
.cfi_startproc
27
; %bb.0:
28
subsp, sp, #32
29
stpx29, x30, [sp, #16]             ; 16-byte Folded Spill
30
addx29, sp, #16
31
.cfi_def_cfa w29, 16
32
.cfi_offset w30, -8
33
.cfi_offset w29, -16
34
                                        ; implicit-def: $x8
35
adrpx8, _OBJC_CLASSLIST_REFERENCES_$_@PAGE
36
ldrx0, [x8, _OBJC_CLASSLIST_REFERENCES_$_@PAGEOFF]
37
bl_objc_alloc
38
ldrx1, [sp]                        ; 8-byte Folded Reload
39
strx0, [sp, #8]
40
ldrx0, [sp, #8]
41
bl_objc_msgSend$init
42
ldrx1, [sp]                        ; 8-byte Folded Reload
43
strx0, [sp, #8]
44
ldrx0, [sp, #8]
45
bl_objc_msgSend$sayHello
46
movw0, #0                          ; =0x0
47
ldpx29, x30, [sp, #16]             ; 16-byte Folded Reload
48
addsp, sp, #32
49
ret
50
.cfi_endproc
51
                                        ; -- End function
52
.section__TEXT,__cstring,cstring_literals
53
l_.str:                                 ; @.str
54
.asciz"Hello world!"
55

56
.section__DATA,__objc_data
57
.globl_OBJC_CLASS_$_MyClass           ; @"OBJC_CLASS_$_MyClass"
58
.p2align3, 0x0
59
_OBJC_CLASS_$_MyClass:
60
.quad_OBJC_METACLASS_$_MyClass
61
.quad0
62
.quad__objc_empty_cache
63
.quad0
64
.quad__OBJC_CLASS_RO_$_MyClass
65

66
.globl_OBJC_METACLASS_$_MyClass       ; @"OBJC_METACLASS_$_MyClass"
67
.p2align3, 0x0
68
_OBJC_METACLASS_$_MyClass:
69
.quad_OBJC_METACLASS_$_MyClass
70
.quad_OBJC_CLASS_$_MyClass
71
.quad__objc_empty_cache
72
.quad0
73
.quad__OBJC_METACLASS_RO_$_MyClass
74

75
.section__TEXT,__objc_classname,cstring_literals
76
l_OBJC_CLASS_NAME_:                     ; @OBJC_CLASS_NAME_
77
.asciz"MyClass"
78

79
.section__DATA,__objc_const
80
.p2align3, 0x0                          ; @"_OBJC_METACLASS_RO_$_MyClass"
81
__OBJC_METACLASS_RO_$_MyClass:
82
.long3                               ; 0x3
83
.long40                              ; 0x28
84
.long40                              ; 0x28
85
.space4
86
.quad0
87
.quadl_OBJC_CLASS_NAME_
88
.quad0
89
.quad0
90
.quad0
91
.quad0
92
.quad0
93

94
.section__TEXT,__objc_methname,cstring_literals
95
l_OBJC_METH_VAR_NAME_:                  ; @OBJC_METH_VAR_NAME_
96
.asciz"sayHello"
97

98
.section__TEXT,__objc_methtype,cstring_literals
99
l_OBJC_METH_VAR_TYPE_:                  ; @OBJC_METH_VAR_TYPE_
100
.asciz"v16@0:8"
101

102
.section__DATA,__objc_const
103
.p2align3, 0x0                          ; @"_OBJC_$_INSTANCE_METHODS_MyClass"
104
__OBJC_$_INSTANCE_METHODS_MyClass:
105
.long24                              ; 0x18
106
.long1                               ; 0x1
107
.quadl_OBJC_METH_VAR_NAME_
108
.quadl_OBJC_METH_VAR_TYPE_
109
.quad"-[MyClass sayHello]"
110

111
.p2align3, 0x0                          ; @"_OBJC_CLASS_RO_$_MyClass"
112
__OBJC_CLASS_RO_$_MyClass:
113
.long2                               ; 0x2
114
.long0                               ; 0x0
115
.long0                               ; 0x0
116
.space4
117
.quad0
118
.quadl_OBJC_CLASS_NAME_
119
.quad__OBJC_$_INSTANCE_METHODS_MyClass
120
.quad0
121
.quad0
122
.quad0
123
.quad0
124

125
.section__DATA,__objc_classrefs,regular,no_dead_strip
126
.p2align3, 0x0                          ; @"OBJC_CLASSLIST_REFERENCES_$_"
127
_OBJC_CLASSLIST_REFERENCES_$_:
128
.quad_OBJC_CLASS_$_MyClass
129

130
.section__DATA,__objc_classlist,regular,no_dead_strip
131
.p2align3, 0x0                          ; @"OBJC_LABEL_CLASS_$"
132
l_OBJC_LABEL_CLASS_$:
133
.quad_OBJC_CLASS_$_MyClass
134

135
.section__DATA,__objc_imageinfo,regular,no_dead_strip
136
L_OBJC_IMAGE_INFO:
137
.long0
138
.long64
139

140
.subsections_via_symbols

1
...
2
adrp x1, [selector sayHello地址]
3
ldr x1, [x1, selector sayHello地址]
4
bl _objc_msgSend
5
...

1
...
2
bl _objc_msgSend$sayHello
3
...
4

5
_objc_msgSend$sayHello:
6
adrp x1, [selector sayHello地址]
7
ldr x1, [x1, selector sayHello地址]
8
bl _objc_msgSend

1
.section__DATA,__objc_const
2
.p2align3, 0x0                          ; @"_OBJC_$_INSTANCE_METHODS_MyClass"
3
__OBJC_$_INSTANCE_METHODS_MyClass:
4
.long24                              ; 0x18
5
.long1                               ; 0x1
6
.quadl_OBJC_METH_VAR_NAME_
7
.quadl_OBJC_METH_VAR_TYPE_
8
.quad"-[MyClass sayHello]"

1
struct bigSigned {
2
        SEL __ptrauth_objc_sel name;
3
        const char * ptrauth_method_list_types types;
4
        MethodListIMP imp;
5
    };

1
struct small {
2
        // The name field either refers to a selector (in the shared
3
        // cache) or a selref (everywhere else).
4
        RelativePointer<const void *, /*isNullable*/false> name;
5
        RelativePointer<const char *> types;
6
        RelativePointer<IMP, /*isNullable*/false> imp;
7
    };
8

9
struct RelativePointer: nocopy_t {
10
    int32_t offset;
11
    ...
12
}

1
// make __DATA_CONST read-only (kernel maps it r/w)
2
    const Header* dyldMH = (const Header*)dyldMA;
3
    dyldMH->forEachSegment(^(const Header::SegmentInfo& segInfo, bool& stop) {
4
        if ( segInfo.readOnlyData() ) {
5
            const uint8_t* start = (uint8_t*)(segInfo.vmaddr + slide);
6
            size_t         size  = (size_t)segInfo.vmsize;
7
            sSyscallDelegate.mprotect((void*)start, size, PROT_READ);
8
        }
9
    });

1
74AUE_MPROTECTALL{ int mprotect(caddr_ut addr, size_ut len, int prot) NO_SYSCALL_STUB; }

1
/*
2
 *vm_map_protect:
3
 *
4
 *Sets the protection of the specified address
5
 *region in the target map.  If "set_max" is
6
 *specified, the maximum protection is to be set;
7
 *otherwise, only the current protection is affected.
8
 */
9
kern_return_t
10
vm_map_protect(
11
vm_map_t                map,
12
vm_map_offset_ut        start_u,
13
vm_map_offset_ut        end_u,
14
boolean_t               set_max,
15
vm_prot_ut              new_prot_u)
16
{
17
...
18
if (current->is_sub_map && current->use_pmap) {
19
pmap_protect(VME_SUBMAP(current)->pmap,
20
    current->vme_start,
21
    current->vme_end,
22
    prot);
23
} else {
24
pmap_protect_options(map->pmap,
25
    current->vme_start,
26
    current->vme_end,
27
    prot,
28
    pmap_options,
29
    NULL);
30
}
31
}

1
MARK_AS_PMAP_TEXT vm_map_address_t
2
pmap_protect_options_internal(
3
pmap_t pmap,
4
vm_map_address_t start,
5
vm_map_address_t end,
6
vm_prot_t prot,
7
unsigned int options,
8
__unused void *args)
9
{
10
...
11
{
12
/* Determine the new protection. */
13
switch (prot) {
14
case VM_PROT_EXECUTE:
15
set_XO = TRUE;
16
OS_FALLTHROUGH;
17
case VM_PROT_READ:
18
case VM_PROT_READ  VM_PROT_EXECUTE:
19
break;
20
case VM_PROT_READ  VM_PROT_WRITE:
21
case VM_PROT_ALL:
22
return end;         /* nothing to do */
23
default:
24
should_have_removed = TRUE;
25
}
26
}
27
...
28
/*
29
 * XXX Removing "NX" would
30
 * grant "execute" access
31
 * immediately, bypassing any
32
 * checks VM might want to do
33
 * in its soft fault path.
34
 * pmap_protect() and co. are
35
 * not allowed to increase
36
 * access permissions.
37
 */
38
if (set_NX) {
39
tmplate = pt_attr_leaf_xn(pt_attr);
40
} else {
41
if (pmap == kernel_pmap) {
42
/* do NOT clear "PNX"! */
43
tmplate = ARM_PTE_NX;
44
} else {
45
/* do NOT clear "NX"! */
46
tmplate = pt_attr_leaf_x(pt_attr);
47
if (set_XO) {
48
tmplate &= ~ARM_PTE_APMASK;
49
tmplate = pt_attr_leaf_rona(pt_attr);
50
}
51
}
52
}
53
...
54
write_pte_fast(pte_p, tmplate);
55
...
56
}

1
#include <stdio.h>
2
#import <Foundation/Foundation.h>
3

4
@implementation MyClass: NSObject
5
+ (void)load {
6
    printf("loaded!");
7
}
8
@end
9

10
int main() {
11
}

1
// This recusively walks the image graph.  There is the potential for cycles.  To break cycles, if the image is delayed, we
2
// use the visitedDelayed set to track if the image was already visited.  If the image is not delayed, we use
3
// beginInitializers() to mark the image visited.
4
// We have to recurse into delayed dylibs because they may need to be initialized because they have weak-defs or interposing tuples.
5
void Loader::runInitializersBottomUp(RuntimeState& state, Array<const Loader*>& danglingUpwards, Array<const Loader*>& visitedDelayed) const
6
{
7
    // don't run initializers in images that are in delayInit state
8
    // but continue down graph and run initializers in children if needed
9
    const bool delayed = this->isDelayInit(state) ;
10

11
    // do nothing if already visited
12
    if ( delayed ) {
13
        if ( visitedDelayed.contains(this) )
14
            return;
15
        // use 'visitedDelayed' to mark we have already handled his image
16
        visitedDelayed.push_back(this);
17
    }
18
    else {
19
        // marks visited
20
        if ( (const_cast<Loader*>(this))->beginInitializers(state) )
21
            return;
22
    }
23

24
    //state.log("runInitializersBottomUp(%s)\\n", this->path());
25

26
    // make sure everything below this image is initialized before running my initializers
27
    const uint32_t depCount = this->dependentCount();
28
    for ( uint32_t i = 0; i < depCount; ++i ) {
29
        LinkedDylibAttributes childAttrs;
30
        if ( Loader* child = this->dependent(state, i, &childAttrs) ) {
31
            if ( childAttrs.upward ) {
32
                // add upwards to list to process later
33
                if ( !danglingUpwards.contains(child) )
34
                    danglingUpwards.push_back(child);
35
            }
36
            else {
37
                child->runInitializersBottomUp(state, danglingUpwards, visitedDelayed);
38
            }
39
        }
40
    }
41

42
    if ( !delayed ) {
43
        // tell objc to run any +load methods in this image (done before C++ initializers)
44
        state.notifyObjCInit(this);
45

46
        // run initializers for this image
47
        this->runInitializers(state);
48
    }
49
}

1
#include <stdio.h>
2
#include <stdint.h>
3
#include <ptrauth.h>
4

5
static int a = 99999;
6
int main(int argc, const char * argv[]) {
7
    void *raw_var_ptr = &a;
8
    void *signed_ptr = ptrauth_sign_unauthenticated(raw_var_ptr, ptrauth_key_process_dependent_data, 10);
9
// signed_ptr = rawVar;
10
    void *authed_ptr = ptrauth_auth_data(signed_ptr, ptrauth_key_process_dependent_data, 10);
11
    printf("raw_var_ptr=%p signed_ptr=%p authed_ptr=%p", raw_var_ptr, signed_ptr, authed_ptr);
12
}

1
raw_var_ptr=0x102e61428 signed_ptr=0x77230102e61428 authed_ptr=0x102e61428

1
#import <Foundation/Foundation.h>
2

3
@implementation HackClass: NSObject
4
- (void)sayHello {
5
    printf("hacker sayHello");
6
}
7
@end
8

9
@implementation SuperClass: NSObject
10
- (void)sayHello {
11
    printf("super sayHello");
12
}
13
@end
14

15
@implementation MyClass: SuperClass
16
- (void)sayHello {
17
    printf("sayHello");
18
}
19
@end
20

21
struct isa_raw {
22
    Class isa;
23
};
24

25
int main(int argc, const char * argv[]) {
26
    MyClass *obj = [[MyClass alloc] init];
27
    struct isa_raw *obj2 = (__bridge struct isa_raw *)obj;
28
    // 模拟isa指针变化
29
    obj2->isa = HackClass.class;
30
    [obj sayHello];
31
}

1
#include <Foundation/Foundation.h>
2

3
int main(int argc, const char * argv[]) {
4
    NSNumber *num1 = [NSNumber numberWithInt:15];
5
    NSNumber *num2 = [[NSNumber alloc] initWithInt:15];
6
    NSNumber *num3 = @(15);
7
    __asm__("brk 0x0");
8
}

1
#include <Foundation/Foundation.h>
2

3
int main(int argc, const char * argv[]) {
4
    __weak NSNumber *num;
5
    __weak NSMutableArray *array;
6
    @autoreleasepool {
7
        num = [NSNumber numberWithInt:15];
8
        array = [NSMutableArray array];
9
    }
10
    NSLog(@"num=%@, array=%@", num, array);
11
}

1
num=15, array=(null)

1
// 以下代码会有Runtime Error
2
#include <Foundation/Foundation.h>
3

4
int main(int argc, const char * argv[]) {
5
    dispatch_queue_t q = dispatch_get_global_queue(0, 0);
6
    __block NSString *name;
7
    for (int i = 0; i < 1000; ++i) {
8
        dispatch_async(q, ^{
9
            name = [NSString stringWithFormat:@"FFFFFFFFFFFFF"];
10
        });
11
    }
12
}
13

14
// 以下代码不会有Runtime Error
15
#include <Foundation/Foundation.h>
16

17
int main(int argc, const char * argv[]) {
18
    dispatch_queue_t q = dispatch_get_global_queue(0, 0);
19
    __block NSString *name;
20
    for (int i = 0; i < 1000; ++i) {
21
        dispatch_async(q, ^{
22
            name = [NSString stringWithFormat:@"FF"];
23
        });
24
    }
25
}