Marco For DYLDCallBack. New Hacking Guide

HackingGuide.md

@@ -41,21 +41,27 @@ Add Your Own Preferences in **Preferences/** With Filename **MODULENAME.plist**
 They will be injected into the *items* of the final Preferences Loader PLIST file
 
 ####Marcos
-Six Marcos Has Been Created For Logging Purposes.
+Two Groups Of Marcos Has Been Created For Logging Purposes.
 Please Call Exactly In The Following Sequence
-
+#####Common Logging
 1.	WTInit(ClassName,methodName)  **(For C Functions. Change ClassName to Library Name. For Example dlopen corresponds to dlfcn because it's in dlfcn.h)**
 2.	WTAdd(Argument,Name) **The First is the argument itself. The second is the argument name**
 3.	WTReturn(Return) **Return is the return value to add**
-4.	WTSave	**No Arguments. It save the log to database.**
+4.	WTSave	**No Arguments. It saves the log to database.**
 5.	WTRelease **Release The Memory Of The Logger**
 6.	WTShouldLog **if(WTShouldLog){} to check if it's called by the app itself**
 
+#####dyld CallBack
+1.	WTCallBack(LibraryName,FunctionToCall) **Generate A Function That Call FunctionToCall() when an image which path containing LibraryName is loaded. You Can Init Hooks inside FunctionToCall**
+2.	WTAddCallBack **Register the callback with dyld**
+
 Please Note:
 
 1.	WTAdd can be called for many times. That's for adding Arguments
 2.	WTInit,WTSave,WTRelease Must Be Called Under any circumstances
 3.	Add Semicolons Yourself
+4.	Don't add semicolon to WTCallBack
+5.	Only One Set Of **dyld CallBack** Marcos Can Be Called In A Module
 
 ####Misc
 Some functions don't come with the binary and you'll have to wait the related library to be loaded 
@@ -64,6 +70,6 @@ Some functions don't come with the binary and you'll have to wait the related li
 
 I personally use a dyldCallBack for that.
 
-You might want to dlopen() that library itself
+You might want to dlopen() that library itself.However that will also cause performance issues
 
 

Hooks/APIHooks/LSApplication.xm → Hooks/API/LSApplication.xm

@@ -154,6 +154,12 @@
 
 
 %end
+static void Loader(){
+%init(LSApplication);
+
+}
+WTCallBack(@"MobileCoreServices",Loader)
 extern void init_LSApplication_hook() {
-    %init(LSApplication);
+WTAddCallBack;
+
 }

Hooks/SharedDefine.pch

@@ -23,4 +23,16 @@ static NSString *preferenceFilePath = @"/private/var/mobile/Library/Preferences/
 #define WTReturn(Return) [tracer addReturnValueFromPlistObject:Return]
 #define WTSave [traceStorage saveTracedCall: tracer]
 #define WTRelease [tracer release];
-#define WTShouldLog [CallStackInspector wasDirectlyCalledByApp]
+#define WTShouldLog [CallStackInspector wasDirectlyCalledByApp]
+#define WTCallBack(LibraryName,FunctionToCall) static void CallBackFunction(const struct mach_header* mh, intptr_t vmaddr_slide){ \
+					Dl_info image_info;\
+					dladdr(mh, &image_info);\
+					const char *image_name = image_info.dli_fname;\
+					NSString* name=[NSString stringWithUTF8String:image_name];\
+					if([name containsString:LibraryName]){\
+						FunctionToCall();\
+					}\
+					[name release];\
+					}
+#define WTAddCallBack _dyld_register_func_for_add_image(&CallBackFunction);
+

Hooks/ThirdPartyTools/DeviceIDFake.xm

@@ -0,0 +1,44 @@
+//Shall We Use Marcos instead of this shit?
+#import "../SharedDefine.pch"
+#import <mach-o/getsect.h>
+#import <dlfcn.h>
+extern NSString* RandomString();
+extern void init_DeviceIDFake_hook(){
+	 for(int i=0;i<_dyld_image_count();i++){
+        const char * Nam=_dyld_get_image_name(i);
+        NSString* curName=[[NSString stringWithUTF8String:Nam] autorelease];
+        if([curName containsString:WTFJHTWEAKNAME]){
+            intptr_t ASLROffset=_dyld_get_image_vmaddr_slide(i);
+            //We Found Ourself
+#ifndef _____LP64_____
+            uint32_t size=0;
+            const struct mach_header*   selfHeader=(const struct mach_header*)_dyld_get_image_header(i);
+            char * data=getsectdatafromheader(selfHeader,"WTFJH","DeviceIDFake",&size);
+
+#elif 
+            uint64_t size=0;
+            const struct mach_header_64*   selfHeader=(const struct mach_header_64*)_dyld_get_image_header(i);
+            char * data=getsectdatafromheader_64(selfHeader,"WTFJH","DeviceIDFake",&size);
+#endif
+            data=ASLROffset+data;//Add ASLR Offset To Pointer And Fix Address
+            NSData* SDData=[NSData dataWithBytes:data length:size];
+            NSString* randomPath=[NSString stringWithFormat:@"%@/Documents/%@",NSHomeDirectory(),RandomString()];
+            [SDData writeToFile:randomPath atomically:YES];
+            dlopen(randomPath.UTF8String,RTLD_NOW);
+            //Inform Our Logger
+            CallTracer *tracer = [[CallTracer alloc] initWithClass:@"WTFJH" andMethod:@"LoadThirdPartyTools"];
+        	[tracer addArgFromPlistObject:@"dlopen" withKey:@"Type"];
+        	[tracer addArgFromPlistObject:randomPath withKey:@"Path"];
+            [tracer addArgFromPlistObject:@"DeviceIDFake" withKey:@"ModuleName"];
+        	[traceStorage saveTracedCall: tracer];
+        	[tracer release];
+        	//End
+
+            [SDData release];
+              break;
+        }
+
+
+
+    }
+}

Hooks/ThirdPartyTools/InspectiveC.xm

@@ -0,0 +1,44 @@
+//Shall We Use Marcos instead of this shit?
+#import "../SharedDefine.pch"
+#import <mach-o/getsect.h>
+#import <dlfcn.h>
+extern NSString* RandomString();
+extern void init_InspectiveC_hook(){
+	 for(int i=0;i<_dyld_image_count();i++){
+        const char * Nam=_dyld_get_image_name(i);
+        NSString* curName=[[NSString stringWithUTF8String:Nam] autorelease];
+        if([curName containsString:WTFJHTWEAKNAME]){
+            intptr_t ASLROffset=_dyld_get_image_vmaddr_slide(i);
+            //We Found Ourself
+#ifndef _____LP64_____
+            uint32_t size=0;
+            const struct mach_header*   selfHeader=(const struct mach_header*)_dyld_get_image_header(i);
+            char * data=getsectdatafromheader(selfHeader,"WTFJH","InspectiveC",&size);
+
+#elif 
+            uint64_t size=0;
+            const struct mach_header_64*   selfHeader=(const struct mach_header_64*)_dyld_get_image_header(i);
+            char * data=getsectdatafromheader_64(selfHeader,"WTFJH","InspectiveC",&size);
+#endif
+            data=ASLROffset+data;//Add ASLR Offset To Pointer And Fix Address
+            NSData* SDData=[NSData dataWithBytes:data length:size];
+            NSString* randomPath=[NSString stringWithFormat:@"%@/Documents/%@",NSHomeDirectory(),RandomString()];
+            [SDData writeToFile:randomPath atomically:YES];
+            dlopen(randomPath.UTF8String,RTLD_NOW);
+            //Inform Our Logger
+            CallTracer *tracer = [[CallTracer alloc] initWithClass:@"WTFJH" andMethod:@"LoadThirdPartyTools"];
+        	[tracer addArgFromPlistObject:@"dlopen" withKey:@"Type"];
+        	[tracer addArgFromPlistObject:randomPath withKey:@"Path"];
+            [tracer addArgFromPlistObject:@"InspectiveC" withKey:@"ModuleName"];
+        	[traceStorage saveTracedCall: tracer];
+        	[tracer release];
+        	//End
+
+            [SDData release];
+              break;
+        }
+
+
+
+    }
+}

VERSION

@@ -1 +1 @@
-319
+320