writing

Simple iOS Anti-Debugging and Anti-Anti-Debugging in PracticeiOS 简单反调试与反反调试实践

2015-12-28 · Debugging & reverse engineering

Translated from Chinese — .

On this page

ptrace
- Protection
- Removing the Protection
RESTRICT section
- Protection
- Removing the Protection

I recently finished studying the second edition of “iOS App Reverse Engineering” and got busy practicing on a few apps. As a result, I ran into a few apps with anti-debugging code. Let me summarize two simple anti-debugging methods and how to remove them.

ptrace

Protection

You can call ptrace first in the main function.

#import <mach-o/dyld.h>
#import <dlfcn.h>

int main(int argc, char * argv[]) {

#ifndef DEBUG
    typedef int (*ptrace_type)(int request, pid_t pid,caddr_t addr,int data);
    void *handle = dlopen(0, 0xA);
    ptrace_type pt = (ptrace_type)dlsym(handle, "ptrace");
    pt(31,0,0,0);
    dlclose(handle);
#endif

	//...
}	

Removing the Protection

Reference article: https://xnu.app/2015/12/20/amap-ios-client-kill-anti-debugging-protect/

RESTRICT section

After finishing this book, I found cycript is super handy — Objective-C is such a flexible language… But some programs can’t use it.

Protection

Add the following to the project’s Other Linker Flags:

-Wl,-sectcreate,__RESTRICT,__restrict,/dev/null

Removing the Protection

The basic idea is:

ps -e | grep /var to find the AppBinary path
Copy the AppBinary out
Use a binary editor (iHex, etc.) to modify __RESTRICT and __restrict to other values. (For example: __RRRRRRRR and __rrrrrrrr. Just keep the length unchanged.)
ldid -S AppBinary to re-sign.
Install AppSync in Cydia.

This is covered in this article: http://www.iosre.com/t/tweak-app-app-tweak/438

Reference articles:

文章目录

ptrace
- 保护
- 去掉保护
RESTRICT section
- 保护
- 去掉保护

最近学习完了《iOS应用逆向工程》第二版，抓紧实战几个App。结果遇到少数App有反调试的代码，总结两个简单的反调试方法及去掉方法。

ptrace

保护

可以在main函数中先调用ptrace。

#import <mach-o/dyld.h>
#import <dlfcn.h>

int main(int argc, char * argv[]) {

#ifndef DEBUG
    typedef int (*ptrace_type)(int request, pid_t pid,caddr_t addr,int data);
    void *handle = dlopen(0, 0xA);
    ptrace_type pt = (ptrace_type)dlsym(handle, "ptrace");
    pt(31,0,0,0);
    dlclose(handle);
#endif

	//...
}	

去掉保护

参考文章 https://xnu.app/2015/12/20/amap-ios-client-kill-anti-debugging-protect/

RESTRICT section

学习完这本书，发现cycript太好用了，Objective-C这语言太灵活了…… 但，有些程序无法使用。

保护

在Project的 Other Linker Flags 增加

-Wl,-sectcreate,__RESTRICT,__restrict,/dev/null

去掉保护

基本思路就是，

ps -e | grep /var 找到AppBinary路径
把AppBinary复制出
二进制编辑器（iHex等）修改__RESTRICT和__restrict为其他值。（比如：__RRRRRRRR和__rrrrrrrr。保证长度不变就行啦）
ldid -S AppBinary 重签名。
Cydia中安装 AppSync。

在这篇文章中 http://www.iosre.com/t/tweak-app-app-tweak/438

参考文章