tobefuturer/app2dylib

iOS 13 砸壳,dlopen 加载重签后动态库失败,报错 `mremap_encrypted() => -1, errno=22 for xxx.dylib`

Opened this issue · 0 comments

动态库已重新签名,使用 codesign 验证签名如果如下:

% codesign -vv Scope.dylib
Scope.dylib: valid on disk
Scope.dylib: satisfies its Designated Requirement

dlopen 加载动态库失败,测试代码:

    NSString * dylibName = @"Scope";
    NSString * path = [[NSBundle mainBundle] pathForResource:dylibName ofType:@"dylib"];
    if (dlopen(path.UTF8String, RTLD_NOW) == NULL){
        NSLog(@"dlopen failed ,error %s", dlerror());
        return;
    };

报错 no suitable image found., mremap_encrypted() => -1, errno=22 ,具体信息如下:

dlopen failed ,error dlopen(/private/var/containers/Bundle/Application/BA9CF7C0-4DD6-46ED-A37A-FDF43E4F5649/MagicAppEx.app/Scope.dylib, 2): no suitable image found.  
Did find: /private/var/containers/Bundle/Application/BA9CF7C0-4DD6-46ED-A37A-FDF43E4F5649/MagicAppEx.app/Scope.dylib: mremap_encrypted() => -1, errno=22 for /private/var/containers/Bundle/Application/BA9CF7C0-4DD6-46ED-A37A-FDF43E4F5649/MagicAppEx.app/Scope.dylib

==========================================================================

做了进一步尝试,整理如下:

  • Ad Hoc 包转换为动态库后,可以正常加载
  • iOS 13 越狱机,AppStore 包砸壳,转换为动态库,加载失败,错误信息如上所示:
  • iOS 10 越狱机,AppStore 包砸壳,转换为动态库,iOS 10、iOS 13、iOS 14 均可以正常加载转换后的动态库。

手头无 iOS 12 越狱机,有兴趣的可以试下!

猜测 iOS 13 中,Mach-O 文件加密内容发生了变化,app2dylib 转换过程中,有些内容未处理,dyld 加载动态库校验异常,导致加载失败?