iOS 13 砸壳,dlopen 加载重签后动态库失败,报错 `mremap_encrypted() => -1, errno=22 for xxx.dylib`
Opened this issue · 0 comments
jiaxw32 commented
动态库已重新签名,使用 codesign
验证签名如果如下:
% codesign -vv Scope.dylib
Scope.dylib: valid on disk
Scope.dylib: satisfies its Designated Requirement
dlopen
加载动态库失败,测试代码:
NSString * dylibName = @"Scope";
NSString * path = [[NSBundle mainBundle] pathForResource:dylibName ofType:@"dylib"];
if (dlopen(path.UTF8String, RTLD_NOW) == NULL){
NSLog(@"dlopen failed ,error %s", dlerror());
return;
};
报错 no suitable image found.
, mremap_encrypted() => -1, errno=22
,具体信息如下:
dlopen failed ,error dlopen(/private/var/containers/Bundle/Application/BA9CF7C0-4DD6-46ED-A37A-FDF43E4F5649/MagicAppEx.app/Scope.dylib, 2): no suitable image found.
Did find: /private/var/containers/Bundle/Application/BA9CF7C0-4DD6-46ED-A37A-FDF43E4F5649/MagicAppEx.app/Scope.dylib: mremap_encrypted() => -1, errno=22 for /private/var/containers/Bundle/Application/BA9CF7C0-4DD6-46ED-A37A-FDF43E4F5649/MagicAppEx.app/Scope.dylib
==========================================================================
做了进一步尝试,整理如下:
- Ad Hoc 包转换为动态库后,可以正常加载
- iOS 13 越狱机,AppStore 包砸壳,转换为动态库,加载失败,错误信息如上所示:
- iOS 10 越狱机,AppStore 包砸壳,转换为动态库,iOS 10、iOS 13、iOS 14 均可以正常加载转换后的动态库。
手头无 iOS 12 越狱机,有兴趣的可以试下!
猜测 iOS 13 中,Mach-O 文件加密内容发生了变化,app2dylib
转换过程中,有些内容未处理,dyld 加载动态库校验异常,导致加载失败?