本文章分析AntiClassDump的实现细节，以下源码参考来自https://github.com/61bcdefg/Hikari-LLVM15，感谢Hikari原作者以及更多贡献者的付出。

一
前置知识

@interface MyClass : NSObject
- (void)printName;
@end
@interface MyClass(MyAddition)
- (void)printNameAddition;
@end

@"\01l_OBJC_$_CATEGORY_INSTANCE_METHODS_MyClass_$_MyAddition" = ...
@"\01l_OBJC_$_CATEGORY_MyClass_$_MyAddition" =
    private global %struct._category_t { ... }, section "__DATA, __objc_const", align 8
...
@"OBJC_LABEL_CATEGORY_$" = private global ...

struct _category_t {
  const char * const name; // CategoryName
  struct _class_t *const cls;  // the class to be extended
  const struct _method_list_t * const instance_methods;
  const struct _method_list_t * const class_methods;
  const struct _protocol_list_t * const protocols;
  const struct _prop_list_t * const properties;
  const struct _prop_list_t * const class_properties;
  const uint32_t size;
}

二
实现原理

三
代码分析

triple = Triple(M.getTargetTriple());if (triple.getVendor() != Triple::VendorType::Apple) {  // 只支持苹果的ObjC实现，对于GNU Step等其它实现给出警告  // ...  return false;}

Type *Int8PtrTy = Type::getInt8PtrTy(M.getContext());

// 添加ObjC运行时函数的声明    FunctionType *IMPType =        FunctionType::get(Int8PtrTy, {Int8PtrTy, Int8PtrTy}, true);    PointerType *IMPPointerType = PointerType::getUnqual(IMPType);    FunctionType *class_replaceMethod_type = FunctionType::get(        IMPPointerType, {Int8PtrTy, Int8PtrTy, IMPPointerType, Int8PtrTy},        false);    M.getOrInsertFunction("class_replaceMethod", class_replaceMethod_type);    FunctionType *sel_registerName_type =        FunctionType::get(Int8PtrTy, {Int8PtrTy}, false);    M.getOrInsertFunction("sel_registerName", sel_registerName_type);// ...

  // 判断是否支持ApplePtrauth和Opaque Pointersappleptrauth = hasApplePtrauth(&M);opaquepointers = !M.getContext().supportsTypedPointers();

GlobalVariable *OLCGV = M.getGlobalVariable("OBJC_LABEL_CLASS_$", true);

if (!OLCGV) {  errs() << "No ObjC Class Found in :" << M.getSourceFileName() << "\n";   // 没有找到ObjC类，Pass不进行处理  return false;}

assert(OLCGV->hasInitializer() &&           "OBJC_LABEL_CLASS_$ Doesn't Have Initializer.");           // 获取OBJC_LABEL_CLASS_$的初始化值，即包含所有类信息的常量数组ConstantArray *OBJC_LABEL_CLASS_CDS =        dyn_cast<ConstantArray>(OLCGV->getInitializer());

std::vector<std::string> readyclses;  // 存储可以处理的类std::deque<std::string> tmpclses; // 临时存储类的队列，用于处理依赖关系std::map<std::string /*class*/, std::string /*super class*/> dependency; // 存储类与其父类的对应关系std::map<std::string /*Class*/, GlobalVariable *> GVMapping; // 存储类名与对应的全局变量的映射

for (...) {  ...  if (supclsName == "" || (SuperClassGV && !SuperClassGV->hasInitializer())) {    readyclses.emplace_back(clsName);// 父类为空或者父类未初始化，说明该类是可以处理的  } else {    tmpclses.emplace_back(clsName);// 父类不为空，暂时无法处理，加入临时队列  }}

// 根据依赖关系排序，保证父类在子类之前处理while (tmpclses.size()) {  std::string clstmp = tmpclses.front();  tmpclses.pop_front();  std::string SuperClassName = dependency[clstmp];  if (SuperClassName != "" &&      std::find(readyclses.begin(), readyclses.end(), SuperClassName) ==          readyclses.end()) {    // 父类还未处理，将该类重新加入临时队列    tmpclses.emplace_back(clstmp);  } else {    // 父类已经处理，将该类加入可以处理的队列    readyclses.emplace_back(clstmp);  }}

for (std::string className : readyclses) {  handleClass(GVMapping[className], &M);}

// 判断类的全局变量是否有初始值，如果没有则直接返回assert(GV->hasInitializer() &&       "ObjC Class Structure's Initializer Missing");

ConstantStruct *CS = dyn_cast<ConstantStruct>(GV->getInitializer());StringRef ClassName = GV->getName();ClassName = ClassName.substr(strlen("OBJC_CLASS_$_"));StringRef SuperClassName =    readPtrauth(        cast<GlobalVariable>(CS->getOperand(1)->stripPointerCasts()))        ->getName();SuperClassName = SuperClassName.substr(strlen("OBJC_CLASS_$_"));errs() << "Handling Class:" << ClassName       << " With SuperClass:" << SuperClassName << "\n";

GlobalVariable *metaclassGV = readPtrauth(    cast<GlobalVariable>(CS->getOperand(0)->stripPointerCasts()));GlobalVariable *class_ro = readPtrauth(    cast<GlobalVariable>(CS->getOperand(4)->stripPointerCasts()));assert(metaclassGV->hasInitializer() && "MetaClass GV Initializer Missing");GlobalVariable *metaclass_ro = readPtrauth(cast<GlobalVariable>(    metaclassGV->getInitializer()        ->getOperand(metaclassGV->getInitializer()->getNumOperands() - 1)        ->stripPointerCasts()));

if (Info.find("METHODLIST") != Info.end()) {  ConstantArray *method_list = cast<ConstantArray>(Info["METHODLIST"]);  for (unsigned i = 0; i < method_list->getNumOperands(); i++) {    ConstantStruct *methodStruct =        cast<ConstantStruct>(method_list->getOperand(i));    // 从方法结构体中提取方法的名称、类型和实现    GlobalVariable *SELNameGV = cast<GlobalVariable>(        opaquepointers ? methodStruct->getOperand(0)                       : methodStruct->getOperand(0)->getOperand(0));    ConstantDataSequential *SELNameCDS =        cast<ConstantDataSequential>(SELNameGV->getInitializer());    StringRef selname = SELNameCDS->getAsCString();    if ((selname == "initialize" && UseInitialize) ||        (selname == "load" && !UseInitialize)) {      // 如果找到了现有的初始化方法（initialize或load），则记录EntryBB为该方法的入口基本块      Function *IMPFunc = cast<Function>(readPtrauth(cast<GlobalVariable>(          methodStruct->getOperand(2)->stripPointerCasts())));      errs() << "Found Existing initializer\n";      EntryBB = &(IMPFunc->getEntryBlock());    }  }} else {  errs() << "Didn't Find ClassMethod List\n";}

if (!EntryBB) {    FunctionType *InitializerType = FunctionType::get(        Type::getVoidTy(M->getContext()), ArrayRef<Type *>(), false);    Function *Initializer = Function::Create(        InitializerType, GlobalValue::LinkageTypes::PrivateLinkage,        "AntiClassDumpInitializer", M);    EntryBB = BasicBlock::Create(M->getContext(), "", Initializer);    ReturnInst::Create(M->getContext(), EntryBB);}

IRBuilder<> *IRB = new IRBuilder<>(EntryBB, EntryBB->getFirstInsertionPt());

// We now prepare ObjC API DefinitionsFunction *objc_getClass = M->getFunction("objc_getClass");// End of ObjC API DefinitionsValue *ClassNameGV = IRB->CreateGlobalStringPtr(ClassName);// Now Scan For Props and Ivars in OBJC_CLASS_RO AND OBJC_METACLASS_RO// Note that class_ro_t's structure is different for 32 and 64bit runtimeCallInst *Class = IRB->CreateCall(objc_getClass, {ClassNameGV});

// Add MethodsConstantStruct *metaclassCS =    cast<ConstantStruct>(class_ro->getInitializer());ConstantStruct *classCS =    cast<ConstantStruct>(metaclass_ro->getInitializer());if (!metaclassCS->getAggregateElement(5)->isNullValue()) {  errs() << "Handling Instance Methods For Class:" << ClassName << "\n";  HandleMethods(metaclassCS, IRB, M, Class, false);   // ...} // 继续处理实例方法和类方法// 这里只处理类方法，实例方法的处理类似GlobalVariable *methodListGV = nullptr;// 存储类方法列表的全局变量if (!classCS->getAggregateElement(5)->isNullValue()) {  errs() << "Handling Class Methods For Class:" << ClassName << "\n";  HandleMethods(classCS, IRB, M, Class, true);  methodListGV = readPtrauth(cast<GlobalVariable>(      classCS->getAggregateElement(5)->stripPointerCasts()));}

//定义方法类型Type *objc_method_type =    StructType::getTypeByName(M->getContext(), "struct._objc_method"); //创建新方法的结构体Constant *newMethod = ConstantStruct::get(    cast<StructType>(objc_method_type),    ArrayRef<Constant *>(methodStructContents)); // objc_method_t //创建新方法的列表ArrayType *AT = ArrayType::get(objc_method_type, 1);Constant *newMethodList = ConstantArray::get(    AT, ArrayRef<Constant *>(newMethod)); // Container of objc_method_t

//1. 为新方法列表创建结构体类型和实例std::vector<Type *> newStructType;std::vector<Constant *> newStructValue;// ...（省略初始化newStructType和newStructValue的代码） StructType *newType = StructType::get(M->getContext(), ArrayRef<Type *>(newStructType));Constant *newMethodStruct = ConstantStruct::get(newType, ArrayRef<Constant *>(newStructValue)); // l_OBJC_$_CLASS_METHODS_  //2. 创建并注册新的全局变量:GlobalVariable *newMethodStructGV = new GlobalVariable(    *M, newType, true, GlobalValue::LinkageTypes::PrivateLinkage,    newMethodStruct, "ACDNewClassMethodMap");appendToCompilerUsed(*M, {newMethodStructGV}); //3. 替换旧的方法列表引用并删除旧的全局变量:/**ConstantExpr::getBitCast和replaceAllUsesWith负责将新的方法列表安全地转换成所需类型并用其替换旧的方法列表，完成对类结构的更新。通过dropAllReferences和eraseFromParent从模块中移除旧的全局变量，确保不会有内存泄漏或其他问题。*/Constant *bitcastExpr = ConstantExpr::getBitCast(    newMethodStructGV, PointerType::getUnqual(StructType::getTypeByName(                           M->getContext(), "struct.__method_list_t"))); opaquepointers ? classCS->setOperand(5, bitcastExpr)               : classCS->handleOperandChange(                     classCS->getAggregateElement(5), bitcastExpr); if (methodListGV) {    methodListGV->replaceAllUsesWith(ConstantExpr::getBitCast(        newMethodStructGV,        methodListGV->getType()));    methodListGV->dropAllReferences();    methodListGV->eraseFromParent();}

// 获取函数指针 `sel_registerName`、`class_replaceMethod`、`class_getName`、`objc_getMetaClass`
Function *sel_registerName = M->getFunction("sel_registerName");
Function *class_replaceMethod = M->getFunction("class_replaceMethod");
Function *class_getName = M->getFunction("class_getName");
Function *objc_getMetaClass = M->getFunction("objc_getMetaClass");

StructType *objc_method_list_t_type =
    StructType::getTypeByName(M->getContext(), "struct.__method_list_t");

for (unsigned int i = 0; i < class_ro->getType()->getNumElements(); i++) {
  Constant *tmp = dyn_cast<Constant>(class_ro->getAggregateElement(i));
  if (tmp->isNullValue()) {
    continue; // 跳过空值元素
  }
  // ...
}

Type *type = tmp->getType();
if ((type == PointerType::getUnqual(objc_method_list_t_type)) ||
    (tmp->getName().startswith("_OBJC_$_INSTANCE_METHODS") ||
     tmp->getName().startswith("_OBJC_$_CLASS_METHODS"))) {
  // 处理方法列表
  // ...
}

// 读取全局变量，获取方法列表的全局变量 `methodListGV`
GlobalVariable *methodListGV =
    readPtrauth(cast<GlobalVariable>(tmp->stripPointerCasts()));
//检查方法列表的全局变量是否有初始化器，如果没有，则返回
assert(methodListGV->hasInitializer() &&
       "MethodListGV doesn't have initializer");
// 获取方法列表结构体 `methodListStruct`
ConstantStruct *methodListStruct =
    cast<ConstantStruct>(methodListGV->getInitializer());

// 从方法列表结构体中提取 `methodList`
ConstantArray *methodList = cast<ConstantArray>(methodListStruct->getOperand(2));
// 遍历方法列表 `methodList` 的每个元素
for (unsigned int i = 0; i < methodList->getNumOperands(); i++) {
  // 获取方法结构体 `methodStruct` 
  ConstantStruct *methodStruct = cast<ConstantStruct>(methodList->getOperand(i));
  // ...
}

// 提取方法名称
Constant *SELName = IRB->CreateGlobalStringPtr(
    cast<ConstantDataSequential>(
        cast<GlobalVariable>(
            opaquepointers
                ? methodStruct->getOperand(0)
                : cast<ConstantExpr>(methodStruct->getOperand(0))
                      ->getOperand(0))
            ->getInitializer())
        ->getAsCString());
// 注册SEL
CallInst *SEL = IRB->CreateCall(sel_registerName, {SELName});

// 提取方法实现
Value *BitCastedIMP = IRB->CreateBitCast(
    appleptrauth
        ? opaquepointers
              ? cast<GlobalVariable>(methodStruct->getOperand(2))
                    ->getInitializer()
                    ->getOperand(0)
              : cast<ConstantExpr>(
                    cast<GlobalVariable>(methodStruct->getOperand(2))
                        ->getInitializer()
                        ->getOperand(0))
                    ->getOperand(0)
        : methodStruct->getOperand(2),
    IMPType);

std::vector<Value *> replaceMethodArgs;
if (isMetaClass) {
  // 如果是元类（Meta Class），则获取类名并调用objc_getMetaClass函数获取元类
  CallInst *className = IRB->CreateCall(class_getName, {Class});
  CallInst *MetaClass =
      IRB->CreateCall(objc_getMetaClass, {className});
  replaceMethodArgs.emplace_back(MetaClass); // Class
} else {
  replaceMethodArgs.emplace_back(Class); // Class
}
replaceMethodArgs.emplace_back(SEL);          // SEL
replaceMethodArgs.emplace_back(BitCastedIMP); // imp

// 提取方法类型
replaceMethodArgs.emplace_back(IRB->CreateGlobalStringPtr(
    cast<ConstantDataSequential>(
        cast<GlobalVariable>(
            opaquepointers
                ? methodStruct->getOperand(1)
                : cast<ConstantExpr>(methodStruct->getOperand(1))
                      ->getOperand(0))
            ->getInitializer())
        ->getAsCString())); // type

// 调用class_replaceMethod函数进行方法的替换和注册
IRB->CreateCall(class_replaceMethod,ArrayRef<Value *>(replaceMethodArgs));

  
if (RenameMethodIMP) {
  // 如果需要重命名方法实现
  Function *MethodIMP = cast<Function>(
      appleptrauth
          ? opaquepointers
                ? cast<GlobalVariable>(methodStruct->getOperand(2))
                      ->getInitializer()
                      ->getOperand(0)
                : cast<ConstantExpr>(
                      cast<GlobalVariable>(
                          methodStruct->getOperand(2)->getOperand(0))
                          ->getInitializer()
                          ->getOperand(0))
                      ->getOperand(0)
      : opaquepointers ? methodStruct->getOperand(2)
                       : methodStruct->getOperand(2)->getOperand(0));
  MethodIMP->setName("ACDMethodIMP");
  }

四
总结

# 往期推荐

1、ELF文件脱壳纪事

2、Glibc-2.35下对tls_dtor_list的利用详解

3、对旅行APP的检测以及参数计算分析【Simplesign篇】

4、2023强网杯warmup题解

5、Directory Opus 13.2 逆向分析

6、Pwn-oneday题目解析