writing
Exploring the Hidden Character (LRM) in WhatsApp's App Name探索 WhatsApp 应用名称中的隐藏字符（LRM）
· Debugging & reverse engineering
Translated from Chinese — .
On this page
Welcome to this episode of “Approaching Science: The Mysterious Symbol of WhatsApp”~
The Crime Scene
About half a year ago, maybe even longer, while using frida-ios-dump, I accidentally noticed that the WhatsApp app’s name looked a bit odd.
frida-ios-dump is a tool for decrypting (de-shelling) apps on jailbroken iOS (it can also list iOS apps). Link: https://github.com/AloneMonkey/frida-ios-dump
Take a close look at WhatsApp in the image below:
WhatsApp’s name is aligned on the left differently from the other apps.
… how many times have I hurried past it … how many times have I treated it as if it didn’t exist …
Until today, I finally got curious for once and wanted to see why it wasn’t aligned here.
Getting Started
De-shell it, let’s de-shell it and try.
python dump.py net.whatsapp.WhatsApp
After de-shelling, it looks like the image below. There’s a question mark. ?WhatsApp.ipa — what is that question mark?
I was about to mv it to another folder to study it, and at that very moment…
The mysterious character \342\200\216 appeared. Just as I was getting curious…
A Quick Search
Did a casual search … and actually found it :)
https://graphemica.com/200E
Opening it up, it actually has a meaning~ left-to-right mark
The Truth Revealed
Wikipedia also explains it:
The left-to-right mark (LRM) is a control character (an invisible formatting character) used in computerized typesetting (including word processing in a program like Microsoft Word) of text that contains a mixture of left-to-right text (such as English or Russian) and right-to-left text (such as Arabic, Persian or Hebrew). It is used to set the way adjacent characters are grouped with respect to text direction.
https://en.wikipedia.org/wiki/Left-to-right_mark
Here’s a translation:
The left-to-right mark (LRM) is a control character, or an invisible typesetting character. It is used in computerized bidirectional document typesetting.
Let me put it even more plainly. The left-to-right mark is an invisible character used to include left-to-right text within a right-to-left typesetting language (such as Arabic).
The example in the image below makes it clearer: after using the LRM, the displayed C++ (left-to-right) is included within Arabic (right-to-left).
Further Reading
There’s a Left-to-right mark, and there’s also a Right-to-left mark.
https://en.wikipedia.org/wiki/Right-to-left_mark
Going Further
Pulling out WhatsApp’s Info.plist file and taking a look, there doesn’t seem to be anything special.
Let’s look at it with a binary editor.
\342\200\216 is 0xE2 0x80 0x8E (e2808e)
This way, when the code fetches CFBundleDisplayName and concatenates it with other localized languages, it can ensure WhatsApp’s order is left-to-right.
Pretty interesting :)
欢迎大家观看这期的“走近科学之WhatsApp神秘符号”～
案发现场
大概半年甚至更久之前，在使用frida-ios-dump时，偶然发现WhatsApp这个应用的名称有点奇怪。
frida-ios-dump 是一款越狱iOS上的App砸壳工具（也可以列出iOS的应用列表）。 地址：https://github.com/AloneMonkey/frida-ios-dump
仔细看下图的WhatsApp：
WhatsApp的名称左侧对齐与其他App不同。
… 多少次匆匆擦肩而过 … 多少次视如不存在 …
直到今天我终于好奇了一次，想看看这里为什么没有对齐。
开始
砸，砸一下试试。
python dump.py net.whatsapp.WhatsApp
砸完，如下图。出现个问号。?WhatsApp.ipa，问号是什么。
准备mv到其他文件夹研究下，就在此刻…
神秘字符\342\200\216出现了，正好奇着…
一搜
随手一搜 … 还真搜到了 :)
https://graphemica.com/200E
打开一看，还真有含义咧～ left-to-right mark
真相大白
Wikipedia也有解释
The left-to-right mark (LRM) is a control character (an invisible formatting character) used in computerized typesetting (including word processing in a program like Microsoft Word) of text that contains a mixture of left-to-right text (such as English or Russian) and right-to-left text (such as Arabic, Persian or Hebrew). It is used to set the way adjacent characters are grouped with respect to text direction.
https://en.wikipedia.org/wiki/Left-to-right_mark
贴个翻译：
左至右符号（Left-to-right mark,LRM）是一种控制字符，或者说是不可见的排版符号。用于计算机的双向文稿排版中。
我再大白话说一句。Left-to-right mark 是个不可见的符号，用来在 从右向左的排版语言（例如阿拉伯语）中包含从左向右的文字。
下图的例子就比较清晰了：在使用了LRM符号后，阿拉伯语（从右向左）中包含了显示的C++（从左向右）。
扩展阅读
有 Left-to-right mark，也有 Right-to-left mark。
https://en.wikipedia.org/wiki/Right-to-left_mark
进一步
把WhatsApp的Info.plist文件拿出来看一眼，似乎没什么特别。
用二进制编辑器看一下。
\342\200\216 就是 0xE2 0x80 0x8E (e2808e)
这样在代码中获取 CFBundleDisplayName 并与其他本地化的语言拼接后，就能保证WhatsApp的顺序从左至右了。
很有趣 :)