MSHookFunction Crash
Closed this issue · 4 comments
alidork1 commented
I wrote a tweak that I've ran on checkra1n in iOS 13/14. After porting it to run in rootless theos, all the functionality works except for MSHookFunction
According to the readme, the Substrate API header should be supported.
Example usage:
MSHookFunction((t_voidOne)getAddress(0x032912), n_New, (void **)&o_Old);
tealbathingsuit commented
What happens? Send the crash log if there is one
bingchilling3618 commented
hi @Evelyneee
i got the same issue, here is the stacktrace: (the function i am trying to hook is mach_msg)
Exception: EXC_BAD_ACCESS
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000000
Registers:
x0 = 0x000000016f0310d0 x1 = 0x0000000000000003 x2 = 0x0000000000000018 x3 = 0x0000000000000040
x4 = 0x0000000000000507 x5 = 0x0000000000000000 x6 = 0x0000000000000000 x7 = 0x0000000000000000
x8 = 0x0000000000000000 x9 = 0x0000000000000076 x10 = 0x0000000000000800 x11 = 0x0000000000000000
x12 = 0x0000000000000000 x13 = 0x0000000000000800 x14 = 0x0000000000000739 x15 = 0x0000000000000739
x16 = 0x0000000100f98e6c x17 = 0x0000000000000800 x18 = 0x0000000000000000 x19 = 0x000000010130b410
x20 = 0x000000016f031144 x21 = 0x000000010130b410 x22 = 0x0000000000000001 x23 = 0x00000001f6971424
x24 = 0x000000016f0313d0 x25 = 0xffffffff450aee3b x26 = 0x00000001fc0d67f0 x27 = 0x000000016f031330
x28 = 0x00000001fc0ccc78 x0 = 0x000000016f0310d0 x1 = 0x0000000000000003 x2 = 0x0000000000000018
x3 = 0x0000000000000040 x4 = 0x0000000000000507 x5 = 0x0000000000000000 x6 = 0x0000000000000000
x7 = 0x0000000000000000 x8 = 0x0000000000000000 x9 = 0x0000000000000076 x10 = 0x0000000000000800
x11 = 0x0000000000000000 x12 = 0x0000000000000000 x13 = 0x0000000000000800 x14 = 0x0000000000000739
x15 = 0x0000000000000739 x16 = 0x0000000100f98e6c x17 = 0x0000000000000800 x18 = 0x0000000000000000
x19 = 0x000000010130b410 x20 = 0x000000016f031144 x21 = 0x000000010130b410 x22 = 0x0000000000000001
x23 = 0x00000001f6971424 x24 = 0x000000016f0313d0 x25 = 0xffffffff450aee3b x26 = 0x00000001fc0d67f0
x27 = 0x000000016f031330 x28 = 0x00000001fc0ccc78 lr = 0x0000000100f98ebc cpsr = 0x0000000060000000
fp = 0x000000016f0310c0 sp = 0x000000016f0310a0 esr = 0x0000000082000006 pc = 0x0000000000000000
far = 0x0000000000000000
Frames:
[None] 0x0
[/usr/lib/system/libsystem_kernel.dylib] 0x1bbee9000 + 0x2b60 (task_threads + 0x6c)
[/usr/lib/libellekit.dylib] 0x101198000 + 0xf378 (getAllThreads() + 0x50)
[/usr/lib/libellekit.dylib] 0x101198000 + 0xf42c (stopAllThreads() + 0x24)
[/usr/lib/libellekit.dylib] 0x101198000 + 0x11454 (rawHook(address:code:size:) + 0xd8)
[/usr/lib/libellekit.dylib] 0x101198000 + 0x11948 (closure #1 in hook(_:_:_:) + 0x38)
[/usr/lib/libellekit.dylib] 0x101198000 + 0x112cc (hook(_:_:_:) + 0x6c4)
[/usr/lib/libellekit.dylib] 0x101198000 + 0xe404 (MSHookFunction + 0x18)
[/usr/lib/TweakInject/MyTweak.dylib] 0x100f90000 + 0x7720 (hookF(char const*, char const*, void*, void**) + 0x268)
[/usr/lib/TweakInject/MyTweak.dylib] 0x100f90000 + 0x7ac0 (init(int, char const**) + 0x114)
[/cores/dyld] 0x100ff4000 + 0x8124 (invocation function for block in dyld4::Loader::findAndRunAllInitializers(dyld4::RuntimeState&) const + 0x98)
[/cores/dyld] 0x100ff4000 + 0x37df8 (invocation function for block in dyld3::MachOAnalyzer::forEachInitializer(Diagnostics&, dyld3::MachOAnalyzer::VMAddrConverter const&, void (unsigned int) block_pointer, void const*) const + 0xa0)
[/cores/dyld] 0x100ff4000 + 0x5eec (invocation function for block in dyld3::MachOFile::forEachSection(void (dyld3::MachOFile::SectionInfo const&, bool, bool&) block_pointer) const + 0x208)
[/cores/dyld] 0x100ff4000 + 0x5210 (dyld3::MachOFile::forEachLoadCommand(Diagnostics&, void (load_command const*, bool&) block_pointer) const + 0xa0)
[/cores/dyld] 0x100ff4000 + 0x4570 (dyld3::MachOFile::forEachSection(void (dyld3::MachOFile::SectionInfo const&, bool, bool&) block_pointer) const + 0xa4)
[/cores/dyld] 0x100ff4000 + 0x379b4 (dyld3::MachOAnalyzer::forEachInitializerPointerSection(Diagnostics&, void (unsigned int, unsigned int, unsigned char const*, bool&) block_pointer) const + 0x78)
[/cores/dyld] 0x100ff4000 + 0x110b0 (dyld3::MachOAnalyzer::forEachInitializer(Diagnostics&, dyld3::MachOAnalyzer::VMAddrConverter const&, void (unsigned int) block_pointer, void const*) const + 0x144)
[/cores/dyld] 0x100ff4000 + 0xde10 (dyld4::Loader::findAndRunAllInitializers(dyld4::RuntimeState&) const + 0x90)
[/cores/dyld] 0x100ff4000 + 0x9b60 (dyld4::Loader::runInitializersBottomUp(dyld4::RuntimeState&, dyld3::Array<dyld4::Loader const*>&) const + 0xd4)
[/cores/dyld] 0x100ff4000 + 0xf840 (dyld4::Loader::runInitializersBottomUpPlusUpwardLinks(dyld4::RuntimeState&) const + 0x78)
[/cores/dyld] 0x100ff4000 + 0x936c (dyld4::APIs::dlopen_from(char const*, int, void*) + 0x1f0)
[/usr/lib/ellekit/libinjector.dylib] 0x100f64000 + 0x48e4 (injection_init + 0x81c)
[/cores/dyld] 0x100ff4000 + 0x8124 (invocation function for block in dyld4::Loader::findAndRunAllInitializers(dyld4::RuntimeState&) const + 0x98)
[/cores/dyld] 0x100ff4000 + 0x37df8 (invocation function for block in dyld3::MachOAnalyzer::forEachInitializer(Diagnostics&, dyld3::MachOAnalyzer::VMAddrConverter const&, void (unsigned int) block_pointer, void const*) const + 0xa0)
[/cores/dyld] 0x100ff4000 + 0x5eec (invocation function for block in dyld3::MachOFile::forEachSection(void (dyld3::MachOFile::SectionInfo const&, bool, bool&) block_pointer) const + 0x208)
[/cores/dyld] 0x100ff4000 + 0x5210 (dyld3::MachOFile::forEachLoadCommand(Diagnostics&, void (load_command const*, bool&) block_pointer) const + 0xa0)
[/cores/dyld] 0x100ff4000 + 0x4570 (dyld3::MachOFile::forEachSection(void (dyld3::MachOFile::SectionInfo const&, bool, bool&) block_pointer) const + 0xa4)
[/cores/dyld] 0x100ff4000 + 0x379b4 (dyld3::MachOAnalyzer::forEachInitializerPointerSection(Diagnostics&, void (unsigned int, unsigned int, unsigned char const*, bool&) block_pointer) const + 0x78)
[/cores/dyld] 0x100ff4000 + 0x110b0 (dyld3::MachOAnalyzer::forEachInitializer(Diagnostics&, dyld3::MachOAnalyzer::VMAddrConverter const&, void (unsigned int) block_pointer, void const*) const + 0x144)
[/cores/dyld] 0x100ff4000 + 0xde10 (dyld4::Loader::findAndRunAllInitializers(dyld4::RuntimeState&) const + 0x90)
[/cores/dyld] 0x100ff4000 + 0x9b60 (dyld4::Loader::runInitializersBottomUp(dyld4::RuntimeState&, dyld3::Array<dyld4::Loader const*>&) const + 0xd4)
[/cores/dyld] 0x100ff4000 + 0xf840 (dyld4::Loader::runInitializersBottomUpPlusUpwardLinks(dyld4::RuntimeState&) const + 0x78)
[/cores/dyld] 0x100ff4000 + 0x2c94c (dyld4::APIs::runAllInitializersForMain() + 0xf4)
[/cores/dyld] 0x100ff4000 + 0x19c5c (dyld4::prepare(dyld4::APIs&, dyld3::MachOAnalyzer const*) + 0xa3c)
[/cores/dyld] 0x100ff4000 + 0x184b0 (start + 0x19c)
opa334 commented
@Evelyneee you seem to not check the return value of task_threads in getAllThreads, so if it fails it will crash the process
tealbathingsuit commented
Fixed in the latest commit