Question

我正在为iOS应用程序开发动态库（不适用于Apple商店）。鉴于IPA，我的动态库可以被黑客/用户解压缩到什么程度？可以在解压缩时读取动态库中的方法定义吗？提前谢谢。

Answer 1

来自man dyldinfo:

dyldinfo(1)               BSD General Commands Manual              dyldinfo(1)

NAME
    dyldinfo -- Displays information used by dyld in an executable

SYNOPSIS
    dyldinfo [-arch arch-name] [-dylibs] [-rebase] [-bind] [-weak_bind] [-lazy_bind] [-export] [-opcodes]
          [-function_starts] file(s)

DESCRIPTION
    Executables built for Mac OS X 10.6 and later have a new format for the information in the __LINKEDIT
    segment.  The dyldinfo tool will display that information.

 The options are as follows:

 -arch arch
         Only display the specified architecture.  Other architectures in a universal image are ignored.

 -dylibs
         Display the table of dylibs on which this image depends.

 -rebase
         Display the table of rebasing information.  Rebasing is what dyld does when an image is not
         loaded at its preferred address.  Typically, this involves updating pointers in the __DATA seg-
         ment which point within the image.

 -bind   Display the table of binding information.  These are the symbolic fix ups that dyld must do
         when an image is loaded.

 -weak_bind
         Display the table of weak binding information.  Typically, only C++ progams will have any weak
         binding.  These are symbols which dyld must unique accross all images.

 -lazy_bind
         Display the table of lazy binding information. These are symbols which dyld delays binding
         until they are first used.  Lazy binding is automatically used for all function calls to func-
         tions in some external dylib.

 -export
         Display the table symbols which this image exports.

 -opcodes
         Display the low level opcodes used to encode all rebase and binding information.

 -function_starts
         Decodes the list of function start addresses.

这只是可用于分析dylib的工具的一个示例。例如，在我的机器上，我在一个OpenSceneGraph的dylib上运行它，这是我得到的一个片段：

0x143942   __ZN3osg13gluDeleteTessEPNS_13GLUtesselatorE
0x143968   __ZL9GotoStatePN3osg13GLUtesselatorE9TessState
0x143AA9   __ZN3osg15gluTessPropertyEPNS_13GLUtesselatorEjd
0x143B75   __ZN3osg18gluGetTessPropertyEPNS_13GLUtesselatorEjPd
0x143C70   __ZN3osg13gluTessNormalEPNS_13GLUtesselatorEddd
0x143C85   __ZN3osg15gluTessCallbackEPNS_13GLUtesselatorEjPFvvE
0x143E44   __ZN3osg13gluTessVertexEPNS_13GLUtesselatorEPdPv
0x143FE4   __ZL10EmptyCachePN3osg13GLUtesselatorE
0x144063   __ZL9AddVertexPN3osg13GLUtesselatorEPdPv
0x14411A   __ZN3osg19gluTessBeginPolygonEPNS_13GLUtesselatorEPv
0x144161   __ZN3osg19gluTessBeginContourEPNS_13GLUtesselatorE
0x1441A1   __ZN3osg17gluTessEndContourEPNS_13GLUtesselatorE
0x1441C9   __ZN3osg17gluTessEndPolygonEPNS_13GLUtesselatorE

和

__DATA  __const          0x001D9D28    pointer       0 __ZTv0_n72_NK3osg6Camera12DrawCallback9classNameEv
__DATA  __data           0x001E8208    pointer       0 __ZTv0_n72_NK3osg6Camera12DrawCallback9classNameEv
__DATA  __data           0x001E84E8    pointer       0 __ZTv0_n72_NK3osg6Camera12DrawCallback9classNameEv
__DATA  __const          0x001DA5F8    pointer       0 __ZTv0_n72_NK3osg8Drawable12CullCallback9classNameEv
__DATA  __data           0x001E57E8    pointer       0 __ZTv0_n72_NK3osg8Drawable12CullCallback9classNameEv

和往常一样，拔出字符串和其他const数据非常容易。（以下是来自.so ...我在30秒的搜索中找不到我的系统上的x86 dylib ...虽然方法是相同的）（哦，你可以告诉我，我很沮丧valgrind附带的一个库：

如果你有包含敏感数据的字符串，那么很容易从你的lib中提取这些...这就是我从一个lib中删除IDA所得到的：

__cstring:00003A58 ; Segment type: Pure data
__cstring:00003A58 __cstring       segment dword public 'DATA' use32
__cstring:00003A58                 assume cs:__cstring
__cstring:00003A58                 ;org 3A58h
__cstring:00003A58 aDevRandom      db '/dev/random',0      ; DATA XREF: _vgr00000ZU_libSystemZdZaZddylib_arc4random+17o
__cstring:00003A58                                         ; __data:__crashreporter_info__o
__cstring:00003A64 aValgrind_launc db 'VALGRIND_LAUNCHER',0 ; DATA XREF: vg_cleanup_env+1Co
__cstring:00003A76 aDyld_shared_re db 'DYLD_SHARED_REGION',0
__cstring:00003A89 aDyld_insert_li db 'DYLD_INSERT_LIBRARIES',0
__cstring:00003A9F                 align 10h
__cstring:00003AA0 aInstrumentedBy db 'Instrumented by Valgrind 3.8.1',0
__cstring:00003AA0 __cstring       ends

这是您可以找到所有使用的const字符串的地方。本节（未显示）下面是“纯数据”部分，其中存储了其他常量数据。

所以，再一次，它完全取决于究竟哪些信息是敏感的。

动态lib可以解码或解压缩到什么程度？ - ios

1 个答案: