When targeting iOS14 or later, `denyFishHook` may not work

Open
#117 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
ios, swift

Research direction

Start with the linked chained_fixups.md and swift-anti-fishhook implementation, then inspect denyFishHook and the existing FishHook and exports-trie parsing. Done means symbols in binaries targeting iOS 14 or later are found reliably, including cases covered by the reported parsing failures.

Written by the indexing model from the issue text.

Description

If the symbols given to denyFishHook are defined in binaries targeting iOS14 or later, it may not work.

Currently, symbols are searched based on binding information obtained from LC_DYLD_INFO. However, if targeting iOS14 or later, by default, it must be obtained from LC_DYLD_CHAINED_FIXUPS.
https://github.com/qyang-nj/llios/blob/main/dynamic_linking/chained_fixups.md

Here is an example of a tried and tested implementation.
https://github.com/p-x9/swift-anti-fishhook

I tried to fix it to send a pull request to this repository, but I noticed that the existing FishHook and exports trie parsing also needed some fixes.
(When the official fishhook was used, it succeeded, but in some cases it failed in the current implementation.)

I will add more information as soon as I have it.
Thank you

Dominant language
Swift
Stars
2.7k
Forks
346
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from securing/IOSSecuritySuite

All issues in securing/IOSSecuritySuite

Similar issues

More Swift issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.