验证试验 - 探求 fishhook 原理（二）

 
#include <stdio.h>
#include "fishhook.h"
static int (*original_strlen)(const char *_s);
int new_strlen(const char *_s) {
    return 666;
}

int main(int argc, const char * argv[]) {
    struct rebinding strlen_rebinding = { "strlen", new_strlen,
        (void *)&original_strlen };
    rebind_symbols((struct rebinding[1]){ strlen_rebinding }, 1);
    char *str = "hellolazy";
    printf("%d\n", strlen(str));
    return 0;
}

 
...
// 这里直接将 Lazy Symbol Point 的一个内容强转为二阶指针
// 也就是说明每个 Lazy Symbol Point 也是一个指针（当然从命名中也能猜出）
void **indirect_symbol_bindings = (void **)((uintptr_t)slide + section->addr);
...
// 在遍历每一个内容的时候，先拿出其对应的 index
uint32_t symtab_index = indirect_symbol_indices[i];
// 之后直接从符号表中用下标访问的方法来获取信息
uint32_t strtab_offset = symtab[symtab_index].n_un.n_strx;

 
struct nlist_64 {
    union {
        uint32_t  n_strx; /* 符号表中的位置 */
    } n_un;
    uint8_t n_type;        /* 经过掩码处理，表示重定义符号不同的种类 */
    uint8_t n_sect;        /* section 的编号 */
    uint16_t n_desc;       /* 类似于 n_type 经过掩码处理，用来定义一些性质 */
    uint64_t n_value;      /* 记录信息的特殊值 */
};

 
static void perform_rebinding_with_section(struct rebindings_entry *rebindings,
                                           section_t *section,
                                           intptr_t slide,
                                           nlist_t *symtab,
                                           char *strtab,
                                           uint32_t *indirect_symtab) {
    // 在 Indirect Symbol 表中检索到对应位置
    uint32_t *indirect_symbol_indices = indirect_symtab + section->reserved1;
    // 获取 _DATA.__nl_symbol_ptr(或__la_symbol_ptr) Section
    // 已知其 value 是一个指针类型，整段区域用二阶指针来获取
    void **indirect_symbol_bindings = (void **)((uintptr_t)slide + section->addr);
    // 用 size / 一阶指针来计算个数，遍历整个 Section
    for (uint i = 0; i < section->size / sizeof(void *); i++) {
        // 通过下标来获取每一个 Indirect Address 的 Value
        // 这个 Value 也是外层寻址时需要的下标
        uint32_t symtab_index = indirect_symbol_indices[i];
        if (symtab_index == INDIRECT_SYMBOL_ABS || symtab_index == INDIRECT_SYMBOL_LOCAL ||
            symtab_index == (INDIRECT_SYMBOL_LOCAL   | INDIRECT_SYMBOL_ABS)) {
            continue;
        }
        // 获取符号名在字符表中的偏移地址
        uint32_t strtab_offset = symtab[symtab_index].n_un.n_strx;
        // 获取符号名
        char *symbol_name = strtab + strtab_offset;
        // 过滤掉符号名小于 4 位的符号
        if (strnlen(symbol_name, 2) < 2) {
            continue;
        }
        // 取出 rebindings 结构体实例数组，开始遍历链表
        struct rebindings_entry *cur = rebindings;
        while (cur) {
            // 对于链表中每一个 rebindings 数组的每一个 rebinding 实例
            // 依次在 String Table 匹配符号名
            for (uint j = 0; j < cur->rebindings_nel; j++) {
                // 符号名与方法名匹配
                if (strcmp(&symbol_name[1], cur->rebindings[j].name) == 0) {
                    // 如果是第一次对跳转地址进行重写
                    if (cur->rebindings[j].replaced != NULL &&
                        indirect_symbol_bindings[i] != cur->rebindings[j].replacement) {
                        // 记录原始跳转地址
                        *(cur->rebindings[j].replaced) = indirect_symbol_bindings[i];
                    }
                    // 重写跳转地址
                    indirect_symbol_bindings[i] = cur->rebindings[j].replacement;
                    // 完成后不再对当前 Indirect Symbol 处理
                    // 继续迭代到下一个 Indirect Symbol
                    
                    /** 加入调试代码 **/
                    printf("\n\nSymbol Name: %s\n", &symbol_name[1]);
                    printf("Rebinding Name: %s\n", cur->rebindings[j].name);
                    printf("Origin Addr: 0x%X\n", cur->rebindings[j].replaced);
                    printf("Rebinding Addr: 0x%X\n", cur->rebindings[j].replacement);
                    /** 调试代码 END **/
                    goto symbol_loop;
                }
            }
            // 链表遍历
            cur = cur->next;
        }
    symbol_loop:;
    }
}

 
Symbol Name: strlen
Rebinding Name: strlen
Origin Addr: 0x20A0
Rebinding Addr: 0x1DA0
666
Program ended with exit code: 0