Everett — personal blog

Building a JavaScript Runtime with deno_core (Translation)

Sun, 31 Jul 2022 00:00:00 +0000

Chinese adaptation by Everett. Original by Bartek Iwańczuk · 2022-07-29 · Roll your own JavaScript runtime

Historical note: The July 2022 tutorial using Rust 1.62, deno_core 0.142.0, and tokio 1.19.2. Not revalidated against current versions.

This is a Chinese translation and adaptation of Bartek Iwańczuk’s Deno tutorial, with a short personal introduction. For the English tutorial, use the original linked above. The Chinese text preserves the July 2022 examples.

Breakpoint Every UIPasteboard Method with LLDB

Thu, 25 Jun 2020 00:00:00 +0000

iOS 14 added a privacy feature: when an app reads content that another app copied to the clipboard, a brief banner is shown. Like this:

You can inspect every clipboard-related behavior in an app by setting a breakpoint on all UIPasteboard methods.

To break on every method of UIPasteboard, use the following command:

breakpoint set -r '\[UIPasteboard .*\]$'

Break at main first, then type the command above in the LLDB console.

(The screenshot above only captures part of the UIPasteboard methods.)

Summary

Give it a try — you’ll notice that, besides our own calls, the system itself occasionally triggers UIPasteboard-related calls too.

Pretty interesting :)

How to Quickly List All +load Methods in an App

Tue, 28 Apr 2020 00:00:00 +0000

The Objective-C +load method is both magical and evil.

When a beginner discovers it, they marvel at its magic.
When an expert discovers it, they get addicted and can’t let go.
When a veteran discovers it, they are terrified by its evil.

Most large apps have already, or are trying to, get rid of it. So how do you quickly see how many +load methods your app has — and how deep the poison runs?

Picture this scenario:

One day you’re happily debugging in Xcode.

You open Xcode and press F5.

Suddenly, you want to know how many +load methods are in the app.

Hit Pause, then enter:

br s -r "\+\[.+ load\]$"

Then enter:

br list

You might be surprised to find just how many (or how few) +load methods your app actually has.

How it works

It uses LLDB’s breakpoint command.

br s -r "regex"
is just
breakpoint set -r "regex"

It sets breakpoints by matching symbols with a regular expression.

A small question

So think about it: if the code in these +load methods crashes, can your crash monitoring (Bugly, etc.) catch it?

90% of the time, the answer you’ll get is: “It won’t crash.”

It reminds me of something Trump said: My “code” is perfect.

Haha :)

Summary

Pretty fun :)

Sigh, I’m such a noob — time to go study “Full Method Hooking Based on Trampolines”.

http://satanwoo.github.io/2020/04/26/TrampolineHookOpenSource/

If you enjoyed this, follow my WeChat official account to show some encouragement:

LLDB: How to Set a Breakpoint at a Function's return

Thu, 23 Apr 2020 00:00:00 +0000

You have a complex function with lots of lines and many returns inside. Single-stepping through it is slow — how can you quickly find which line it returns from?

For example, this code:

void foo() {
    int i = arc4random() %100;
    
    if (i > 30) {
        if (i < 40) {
            return;
        }
        if (i > 77) {
            return;
        }
        if (i < 66) {
            return;
        }
    }
    
    switch (i) {
        case 0:
            return;
        case 1:
            return;
        case 2:
            return;
        case 3:
            return;
        case 4:
            return;
        default:
            return;
    }
}

int main(int argc, const char * argv[]) {
    foo();
    return 0;
}

Suppose foo is a very long, very complex function with many returns. How do you know which line it returned from?

You can use an lldb breakpoint:

breakpoint set -p return
或者
br set -p return

First add a breakpoint on the first line of foo.

Once the breakpoint triggers, type br set -p return in the console.

Then continue, and it will break at the line where the function returns.

Pretty interesting~

When Does an Objective-C Object Held by a C++ Class Get dealloc'd?

Fri, 17 Apr 2020 00:00:00 +0000

When using Objective-C++, you can store Objective-C objects in a C++ struct or class.

For example:

struct CppStruct {
    MyObject *obj;
};

So I suddenly wondered: if CppStruct is destructed, will MyObject be dealloc’d? No need to overthink it — of course it will. But how is that achieved?

Let’s write some code to verify it:

@interface MyObject : NSObject
@end
@implementation MyObject
- (instancetype)init {
    self = [super init];
    if (self) {
        NSLog(@"MyObject init");
    }
    return self;
}
- (void)dealloc {
    NSLog(@"MyObject dealloc");
}
@end

struct CppStruct {
    MyObject *obj;
    CppStruct() {
        NSLog(@"CppStruct constructor");
    }
    ~CppStruct() {
        NSLog(@"CppStruct destructor");
    }
};

CppStruct * CreateStruct() {
    CppStruct * s = new CppStruct();
    s->obj = [[MyObject alloc] init];
    return s;
}

void FreeStruct(CppStruct *s) {
    delete s;
}

int main(int argc, const char * argv[]) {
    @autoreleasepool {
        CppStruct *s = CreateStruct();
        FreeStruct(s);
    }
    return 0;
}

It produces the following output:

As you can see, MyObject indeed got dealloc’d.

So, let’s set a breakpoint on dealloc and see how it gets called.

In the image above there are two ~CppStruct(), one of which calls objc_storeStrong, and objc_storeStrong in turn triggers MyObject’s dealloc.

From the image above, it must be the compiler that generated the code calling objc_storeStrong.

Looking at the Disassembly, it indeed generated the objc_storeStrong call code.

Solid confirmation.

As for how LLVM generates this logic — I won’t dig into that here.

References

The debugging above used a compilable objc runtime. There are many on GitHub; you can just search for the corresponding objc version like this:

https://github.com/search?q=objc+779.1 https://github.com/LGCooci/objc4_debug

Summary

From now on you can boldly use C++ structs to store Objective-C objects.

Pretty interesting :)

Exploring the Hidden Character (LRM) in WhatsApp's App Name

Mon, 30 Mar 2020 00:00:00 +0000

Welcome to this episode of “Approaching Science: The Mysterious Symbol of WhatsApp”~

The Crime Scene

About half a year ago, maybe even longer, while using frida-ios-dump, I accidentally noticed that the WhatsApp app’s name looked a bit odd.

frida-ios-dump is a tool for decrypting (de-shelling) apps on jailbroken iOS (it can also list iOS apps). Link: https://github.com/AloneMonkey/frida-ios-dump

Take a close look at WhatsApp in the image below:

WhatsApp’s name is aligned on the left differently from the other apps.

… how many times have I hurried past it … how many times have I treated it as if it didn’t exist …

Until today, I finally got curious for once and wanted to see why it wasn’t aligned here.

Getting Started

De-shell it, let’s de-shell it and try.

python dump.py net.whatsapp.WhatsApp

After de-shelling, it looks like the image below. There’s a question mark. ?WhatsApp.ipa — what is that question mark?

I was about to mv it to another folder to study it, and at that very moment…

The mysterious character \342\200\216 appeared. Just as I was getting curious…

A Quick Search

Did a casual search … and actually found it :)

https://graphemica.com/200E

Opening it up, it actually has a meaning~ left-to-right mark

The Truth Revealed

Wikipedia also explains it:

The left-to-right mark (LRM) is a control character (an invisible formatting character) used in computerized typesetting (including word processing in a program like Microsoft Word) of text that contains a mixture of left-to-right text (such as English or Russian) and right-to-left text (such as Arabic, Persian or Hebrew). It is used to set the way adjacent characters are grouped with respect to text direction.

https://en.wikipedia.org/wiki/Left-to-right_mark

Here’s a translation:

The left-to-right mark (LRM) is a control character, or an invisible typesetting character. It is used in computerized bidirectional document typesetting.

Let me put it even more plainly. The left-to-right mark is an invisible character used to include left-to-right text within a right-to-left typesetting language (such as Arabic).

The example in the image below makes it clearer: after using the LRM, the displayed C++ (left-to-right) is included within Arabic (right-to-left).

Going Further

Pulling out WhatsApp’s Info.plist file and taking a look, there doesn’t seem to be anything special.

Let’s look at it with a binary editor.

\342\200\216 is 0xE2 0x80 0x8E (e2808e)

This way, when the code fetches CFBundleDisplayName and concatenates it with other localized languages, it can ensure WhatsApp’s order is left-to-right.

Pretty interesting :)

Running Android on an iPhone: My Experience

Fri, 06 Mar 2020 00:00:00 +0000

Historical note: Project Sandcastle on an iPhone 7 in March 2020. Not revalidated against current versions.

For the first time in history, the Android system can run on an iPhone. The current version (as of March 6, 2020) only supports the iPhone 7 / 7 Plus. (No requirement on the iOS version.)

Project Sandcastle: Android for the iPhone Project page: https://projectsandcastle.org/

I happened to have an iPhone 7 on hand, so I gave it a try. Let me briefly summarize the steps and share them with everyone. Ideally the steps are as follows, but due to macOS’s security mechanisms, steps 2 and 3 aren’t quite so smooth and pleasant.

Jailbreak using checkra1n
Run start_mac.sh
Run setup_mac.sh

Jailbreak

Download https://checkra.in/ and jailbreak by following the steps. (Connect the iPhone to the Mac via USB.)

After jailbreaking, boot into iOS.

Download the Android Build

Download the Android Build at https://projectsandcastle.org/status.

Unzip the downloaded file.

setup_mac.sh

Connect the iPhone to the Mac via USB. Ideally, you just run ./setup_mac.sh on macOS. But it didn’t go smoothly for me. The bundled iproxy and the two dynamic libraries’ signatures still need to be trusted on first run. But since the functionality is really just iproxy’s functionality, let’s manually run the steps inside setup_mac.sh below.

You can first ssh into iOS to make sure the manual connection works. Then refer to the steps below.

(1)

iproxy 2222 44

(2) Copy isetup to iOS at /tmp/setup.sh

scp -P2222 -o StrictHostKeyChecking=no isetup root@localhost:/tmp/setup.sh

(3) Two approaches:

One, use a VPN. Or, modify the network connectivity test address in setup.sh — for example, test against baidu, which is specifically for checking whether the network works (looks like foreigners use google for the equivalent test).

I recommend the VPN approach, because this script downloads a 470MB file. Without a VPN, downloading this file on my home Wi-Fi is very slow; with a VPN it seemed to finish in a few minutes.

(4) Run /tmp/setup.sh

Entering DFU Mode

Power off the iPhone.
Hold Volume Down + Power simultaneously for 10 seconds (as exactly 10 seconds as possible).
Release the Power button, but keep holding Volume Down.
The phone’s screen will stay black, indicating it has entered DFU mode.

Then in DFU mode, run ./start_mac.sh.

Ideally, you’re done once it finishes running. But reality is harsh — I ran into the dialog below (inwardly, ten thousand alpacas galloped past, terrified I’d brick the phone…). Of course, you click Cancel.

Go to System Preferences -> Security & Privacy -> General, and click Allow Anyway.

This still doesn’t work yet. Just in case, run this once first:

./load-linux.mac

Then you can click Open.

But at this point, re-running start_mac.sh doesn’t seem to “resume” anymore. Inwardly, X#@%$$. The “clever” me took a look at the start_mac.sh code, and it looks like you can run this step.

./load-linux.mac Android.lzma dtbpack

Finally success — Android booted up on the iPhone.

Screenshots

Summary

It runs pretty laggy.
Rebooting restores iOS.

Still pretty interesting. For a video, you can search everettjf on Douyin.

Redirecting iOS Standard Output to a UITextView

Tue, 03 Mar 2020 00:00:00 +0000

Historical note: An iOS stdout experiment from 2020 that accesses C library implementation details. Not revalidated against current versions.

I came across a pretty interesting piece of code: an iOS project that redirects the content printed by printf into a UITextView.

After extracting the code, it’s actually quite simple.

#include <stdlib.h>
#include <stdio.h>

static print_cbk_t gPrintFunc;

static int stdout_redirect(void* prefix, const char* buffer, int size)
{
    if (gPrintFunc)
        gPrintFunc(buffer, size);
    return size;
}

void set_redirect_output(print_cbk_t f)
{
    gPrintFunc = f;

    setvbuf(stdout, 0, _IOLBF, 0); // stdout: line-buffered
    setvbuf(stderr, 0, _IONBF, 0); // stderr: unbuffered

    stdout->_write = stdout_redirect;
    stderr->_write = stdout_redirect;
}

Then you use it in the ViewController roughly like this:

static UITextView *sTextView = nil;

static void current_output(const char* buff, int len) {
    NSString *text = [sTextView text];
    text = [text stringByAppendingFormat:@"%s",buff];
    [sTextView setText:text];
}

@interface ViewController ()
@property (weak, nonatomic) IBOutlet UITextView *textView;

@end

@implementation ViewController

- (void)viewDidLoad {
    [super viewDidLoad];
    // Do any additional setup after loading the view.
    
    sTextView = self.textView;
    
    set_redirect_output(current_output);
        
    printf("hello\n");
    printf("hello\n");
    printf("hello\n");
    printf("hello\n");

}
@end

After running it, printf output goes into the UITextView.

There’s really not much to explain about how it works — the C library provides the support itself.

    setvbuf(stdout, 0, _IOLBF, 0); // stdout: line-buffered
    setvbuf(stderr, 0, _IONBF, 0); // stderr: unbuffered

These two functions set standard output to “line-buffered” and “unbuffered” respectively. In other words, content going into stdout and stderr is output either by line or directly. This way the UITextView receives it in a more timely manner.

Writing fluff pieces is just relaxing and fun~ As long as it’s interesting~

Renaming Symbols with asm

Wed, 19 Feb 2020 00:00:00 +0000

The objc source code contains code like __asm__("_objc_retain"). What is this __asm__ thing?

Discovery

Here it is in the source:

objc source download https://opensource.apple.com/tarballs/objc4/

After some searching, it turns out it can rename a symbol. Let’s write some test code:

#include <stdio.h>
void foo(void) __asm__("_objc_release");
void foo(void)  {
    printf("hello world");
}
int main(int argc, const char * argv[]) {
    foo();
    return 0;
}

Let’s debug it:

As you can see from the image above, the symbol in the callstack is not foo, but _objc_release.

Variables

From the link below, we can also learn that you can rename a variable’s symbol too.

int counter __asm__("counter_v1") = 0;

http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0491f/Cacgegch.html

Summary

Seems like you could use this to do a simple export symbol obfuscation for a dylib?

References

http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.kui0097a/armcc_bcfggcdh.htm
http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0491f/Cacgegch.html
https://stackoverflow.com/questions/1034852/adding-leading-underscores-to-assembly-symbols-with-gcc-on-win32

Is C++ Static Variable Initialization Inside a Function Thread-Safe?

Mon, 17 Feb 2020 00:00:00 +0000

Conclusion first: yes, it’s thread-safe, and it even uses double-checked locking, so performance is pretty good.

Exploration

When writing the C++ Singleton pattern, you’ll usually just smoothly write code like this:

class Hello {
public:
    static Hello & instance() {
        static Hello obj;
        return obj;
    }
    
    Hello() {
        printf("constructor");
    }
    ~Hello() {
        printf("destructor");
    }
    
public:
    int x = 0;
};

So when you call Hello::instance(), is it thread-safe? Can the constructor of Hello be guaranteed to run exactly once?

Let’s throw the code into Hopper and take a look.

Looks like there’s a lock. So it’s thread-safe :)

Going Further

Notice these few methods:

__cxa_guard_acquire
__cxa_atexit
__cxa_guard_release

__cxa_atexit is likely there to call the destructor when the process exits.

After some searching, you can find this source file cxa_guard.cxx:

https://opensource.apple.com/source/libcppabi/libcppabi-14/src/cxa_guard.cxx

It implements a double-checked locking via obj_guard.

inUse stores 0 and 1 in the first address pointed to by obj_guard, implementing the first check.

Found this obj_guard in Hopper:

This guard variable is a global variable.

Summary

From now on you can happily use this pattern:

    static Hello & instance() {
        static Hello obj;
        return obj;
    }

Everett — personal blog

Building a JavaScript Runtime with deno_core (Translation)

Breakpoint Every UIPasteboard Method with LLDB

Summary

How to Quickly List All +load Methods in an App

How it works

A small question

Summary

LLDB: How to Set a Breakpoint at a Function's return

When Does an Objective-C Object Held by a C++ Class Get dealloc'd?

References

Summary

Exploring the Hidden Character (LRM) in WhatsApp's App Name

The Crime Scene

Getting Started

A Quick Search

The Truth Revealed

Further Reading

Going Further

Running Android on an iPhone: My Experience

Jailbreak

Download the Android Build

setup_mac.sh

Entering DFU Mode

Screenshots

Summary

Redirecting iOS Standard Output to a UITextView

Renaming Symbols with __asm__

Discovery

Variables

Summary

References

Is C++ Static Variable Initialization Inside a Function Thread-Safe?

Exploration

Going Further

Summary

Renaming Symbols with asm