本文为看雪论优秀文章
看雪论坛作者ID:新萌
下载llvm源码
查看你的Android ndk版本
./clang -v
Android (6454773 based on r365631c2) clang version 9.0.8 (https://android.googlesource.com/toolchain/llvm-project 98c855489587874b2a325e7a516b99d838599c6f) (based on LLVM 9.0.8svn)
Target: x86_64-apple-darwin19.6.0
Thread model: posix
InstalledDir: /Volumes/Work/SDK/AndroidSDK/ndk/21.3.6528147/toolchains/llvm/prebuilt/darwin-x86_64/bin/.
下载依赖
brew install cmake zlib ninja
可以看到版本是clang version 9.0.8,所以我们去github寻找差不多的版本下载,这里我们找到了9.0.1,下载它
从这个地址下载源码:
https://github.com/llvm/llvm-project/releases
下载好后用clion打开项目,然后找到llvm文件夹中的CMakelist.txt双击打开,按照clion提示,点击同步
clion-preferences-build,execution,deployment-cmake对debug与release设置cmake options
-G Ninja -DLLVM_ENABLE_PROJECTS="clang"
等待同步完成后,跳转到cmake-build-debug文件夹
ninja -j8
写第一个demo
打开clion新建一个项目,先写一个demo:
void test(){
printf("this is Test!n");
}
void test01(){
printf("test01n");
}
int main() {
test();
test01();
return 0;
}
配置clang地址
export PATH=/Volumes/Work/CLion/Projects/llvm-project-llvmorg-9.0.1/llvm/cmake-build-debug/bin/:$PATH
尝试编译
clang main.cpp -o main_clang
$ clang main.cpp -o main_clang
clang-9: error: no such file or directory: 'main.cpp'
clang-9: error: no input files
# 解决
$ export SDKROOT=$(xcrun --sdk macosx --show-sdk-path)
clang main.c -o main_clang
./main_clang
this is Test!
test01
生成ll文件
clang -emit-llvm main.c -S -o main.ll
生成bc文件
llvm-as main.ll -o main.bc
编写第一个llvm pass
这是介绍:https://llvm.org/docs/WritingAnLLVMPass.html#writing-an-llvm-pass-basiccode
Pass
// /Volumes/Work/CLion/Projects/llvm-project-llvmorg-9.0.1/llvm/lib/Transforms/EncodeFunctionName/EncodeFunctionName.cpp
using namespace llvm;
namespace llvm {
struct EncodeFunctionName : public FunctionPass {
static char ID; // Pass identification, replacement for typeid
EncodeFunctionName() : FunctionPass(ID) {};
bool runOnFunction(Function &F) override {
errs() << "EncodeFunctionName";
errs().write_escaped(F.getName()) << 'n';
return false;
}
};
}
char EncodeFunctionName::ID = 0;
static RegisterPass<EncodeFunctionName> X("encode", "Hello EncodeFunctionName Pass");
static llvm::RegisterStandardPasses Y(
llvm::PassManagerBuilder::EP_EarlyAsPossible,
[](const llvm::PassManagerBuilder &Builder,
llvm::legacy::PassManagerBase &PM) { PM.add(new EncodeFunctionName()); });
# /Volumes/Work/CLion/Projects/llvm-project-llvmorg-9.0.1/llvm/lib/Transforms/EncodeFunctionName/CMakeLists.txt
add_llvm_library( LLVMEncodeFunctionName MODULE BUILDTREE_ONLY
EncodeFunctionName.cpp
DEPENDS
intrinsics_gen
PLUGIN_TOOL
opt
)
cd /Volumes/Work/CLion/Projects/llvm-project-llvmorg-9.0.1/llvm/cmake-build-debug
ninja LLVMEncodeFunctionName
# opt -load passpath -encode llfile -o bcfile
$ opt -load /Volumes/Work/CLion/Projects/llvm-project-llvmorg-9.0.1/llvm/cmake-build-debug/lib/LLVMEncodeFunctionName.dylib -encode main.ll -o main.bc
加密方法名
// /Volumes/Work/CLion/Projects/llvm-project-llvmorg-9.0.1/llvm/lib/Transforms/EncodeFunctionName/EncodeFunctionName.cpp
using namespace llvm;
namespace llvm {
struct EncodeFunctionName : public FunctionPass {
static char ID; // Pass identification, replacement for typeid
EncodeFunctionName() : FunctionPass(ID) {};
bool runOnFunction(Function &F) override {
errs() << "EncodeFunctionName: " << F.getName() << " -> ";
if(F.getName().compare("main") !=0){ # 过滤方法名,main方法名不能改,其他方法可以
llvm::MD5 Hasher; # 使用md5算法修改方法名称
llvm::MD5::MD5Result Hash; # 使用md5算法修改方法名称
Hasher.update(F.getName()); # 使用md5算法修改方法名称
Hasher.update("NewFunctionName"); # 使用md5算法修改方法名称
Hasher.final(Hash); # 使用md5算法修改方法名称
SmallString<32> HexString; # 使用md5算法修改方法名称
llvm::MD5::stringifyResult(Hash, HexString);# 使用md5算法修改方法名称
F.setName(HexString); # 修改方法名称
}
errs().write_escaped(F.getName()) << 'n';
return false;
}
};
}
char EncodeFunctionName::ID = 0;
static RegisterPass<EncodeFunctionName> X("encode", "Hello EncodeFunctionName Pass");
static llvm::RegisterStandardPasses Y(
llvm::PassManagerBuilder::EP_EarlyAsPossible,
[](const llvm::PassManagerBuilder &Builder,
llvm::legacy::PassManagerBase &PM) { PM.add(new EncodeFunctionName()); });
add_llvm_library( LLVMEncodeFunctionName MODULE BUILDTREE_ONLY
EncodeFunctionName.cpp
DEPENDS
intrinsics_gen
PLUGIN_TOOL
opt
)
$ cd /Volumes/Work/CLion/Projects/llvm-project-llvmorg-9.0.1/llvm/cmake-build-debug
$ ninja LLVMEncodeFunctionName
[2/2] Linking CXX shared module lib/LLVMEncodeFunctionName.dylib
# 配置临时环境变量
$ export PATH=/Volumes/Work/CLion/Projects/llvm-project-llvmorg-9.0.1/llvm/cmake-build-debug/bin/:$PATH
# 查看版本信息
$ clang --version
clang version 9.0.1
Target: x86_64-apple-darwin19.6.0
Thread model: posix
InstalledDir: /Volumes/Work/CLion/Projects/llvm-project-llvmorg-9.0.1/llvm/cmake-build-debug/bin
# 编译ll文件
$ clang -emit-llvm main.c -S -o main.ll
# 产生bc文件
$ opt -load /Volumes/Work/CLion/Projects/llvm-project-llvmorg-9.0.1/llvm/cmake-build-debug/lib/LLVMEncodeFunctionName.dylib -encode main.ll -o main.bc
EncodeFunctionName: test -> 5087472e3f661e2a53ecdb4d8dc398a7
EncodeFunctionName: test01 -> e63ae3cc6d7f9892993496b04573c87c
EncodeFunctionName: main -> main
# bc文件转可执行文件
$ clang main.bc -o main_clang
int __cdecl main(int argc, const char **argv, const char **envp)
{
5087472e3f661e2a53ecdb4d8dc398a7();
e63ae3cc6d7f9892993496b04573c87c();
return 0;
}
将pass注册到clang
以编写ObfString为例
namespace llvm{
Pass* createObfString(bool flag);
}
using namespace llvm;
namespace {
struct ObfString : public ModulePass {
static char ID;
bool flag;
ObfString() : ModulePass(ID) {};
ObfString(bool flag) : ModulePass(ID) {
this->flag = flag;
};
bool runOnModule(Module &M) override {
return false;
};
};
}
char ObfString::ID = 0;
static RegisterPass<ObfString> X("obfstr", "String encrypt Pass",
false /* Only looks at CFG */,
false /* Analysis Pass */);
Pass *llvm::createObfString(bool flag) {
return new ObfString(flag);
}
add_llvm_library(LLVMObfPass
CryptoUtils.cpp
ObfString.cpp
)
add_dependencies(LLVMObfPass intrinsics_gen)
[component_0]
type = Library
name = ObfPass
parent = Transforms
library_name = ObfPass
add_subdirectory(ObfPass)
ObfPass
ObfPass
......
static cl::opt<bool> ObfString("obfstr", cl::init(false),
cl::desc("Enable string obf"));
......
void PassManagerBuilder::populateModulePassManager(
MPM.add(createObfString(ObfString));
-G Ninja -DLLVM_ENABLE_PROJECTS="clang"
调试
在代码中编写一个错误代码:
bool runOnModule(Module &M) override {
int *err = (int *)8;
*err = 9;
编译
cd /Volumes/Work/CLion/Projects/llvm9.0.1/llvm/cmake-build-debug
ninja LLVMObfPass
ninja clang
int main(int argc, char const *argv[]) {
std::string cppstr = "adkngk222中国";
std::cout << cppstr << std::endl;
return 0;
}
/**
* export PATH=/Volumes/Work/CLion/Projects/llvm9.0.1/llvm/cmake-build-debug/bin:$PATH
* clang -mllvm -sub main.c -o main_clang
* clang -mllvm -sub -mllvm -sub_loop=3 main.c -o main_clang
* clang -mllvm -bcf main.c -o main_clang
* clang -mllvm -bcf -mllvm -bcf_loop=3 main.c -o main_clang
* clang -mllvm -bcf -mllvm -bcf_prob=60 main.c -o main_clang
* clang -mllvm -fla main.c -o main_clang
* clang -mllvm -fla -mllvm -split main.c -o main_clang
* clang -mllvm -fla -mllvm -split -mllvm -split_num=10 main.c -o main_clang
* clang -mllvm -sub -mllvm -sub_loop=3 -mllvm -bcf -mllvm -bcf_prob=60 -mllvm -fla -mllvm -split -mllvm -split_num=10 main.c -o main_clang
* clang -mllvm -enable-encode-function-name -mllvm -sub -mllvm -sub_loop=3 -mllvm -bcf -mllvm -bcf_prob=60 -mllvm -fla -mllvm -split -mllvm -split_num=10 main.c -o main_clang
* export C_INCLUDE_PATH=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.15.sdk/usr/include
* export CPLUS_INCLUDE_PATH=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include/c++/v1
* clang++ -Wall -std=c++11 -S -emit-llvm main.cpp -o main.ll
* clang++ -Wall -std=c++11 -mllvm -obfstr -S -emit-llvm main.cpp -o main_strobf.ll
*/
$ export PATH=/Volumes/Work/CLion/Projects/llvm9.0.1/llvm/cmake-build-debug/bin:$PATH
$ export CPLUS_INCLUDE_PATH=/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include/c++/v1
$ export C_INCLUDE_PATH=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.15.sdk/usr/include
# 编译
$ clang++ -Wall -std=c++11 main.cpp -o main.test
# 报错
Stack dump:
0. Program arguments: /Volumes/Work/CLion/Projects/llvm9.0.1/llvm/cmake-build-debug/bin/clang-9 -cc1 -triple x86_64-apple-macosx10.15.0 -Wdeprecated-objc-isa-usage -Werror=deprecated-objc-isa-usage -emit-obj -mrelax-all -disable-free -main-file-name main.cpp -mrelocation-model pic -pic-level 2 -mthread-model posix -mdisable-fp-elim -masm-verbose -munwind-tables -target-sdk-version=10.15.6 -target-cpu penryn -dwarf-column-info -debugger-tuning=lldb -ggnu-pubnames -target-linker-version 609 -resource-dir /Volumes/Work/CLion/Projects/llvm9.0.1/llvm/cmake-build-debug/lib/clang/9.0.1 -isysroot /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk -c-isystem /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.15.sdk/usr/include -cxx-isystem /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include/c++/v1 -stdlib=libc++ -internal-isystem /Volumes/Work/CLion/Projects/llvm9.0.1/llvm/cmake-build-debug/bin/../include/c++/v1 -internal-isystem /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/c++/v1 -internal-isystem /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/local/include -internal-isystem /Volumes/Work/CLion/Projects/llvm9.0.1/llvm/cmake-build-debug/lib/clang/9.0.1/include -internal-externc-isystem /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include -Wall -std=c++11 -fdeprecated-macro -fdebug-compilation-dir /Volumes/Work/CLion/Projects/Test -ferror-limit 19 -fmessage-length 80 -stack-protector 1 -fblocks -fencode-extended-block-signature -fregister-global-dtors-with-atexit -fobjc-runtime=macosx-10.15.0 -fcxx-exceptions -fexceptions -fmax-type-align=16 -fdiagnostics-show-option -fcolor-diagnostics -o /var/folders/vh/l2bql3ns2d5g5w6w2rk1q16m0000gn/T/main-6e5ff9.o -x c++ main.cpp
1. <eof> parser at end of file
2. Per-module optimization passes
3. Running pass 'String encrypt Pass' on module 'main.cpp'.
clion-run-edit configurations
左边选择clang,右边executable选择clang-9, program arguments配置:
-cc1 -triple x86_64-apple-macosx10.15.0 -Wdeprecated-objc-isa-usage -Werror=deprecated-objc-isa-usage -emit-obj -mrelax-all -disable-free -main-file-name main.cpp -mrelocation-model pic -pic-level 2 -mthread-model posix -mdisable-fp-elim -masm-verbose -munwind-tables -target-sdk-version=10.15.6 -target-cpu penryn -dwarf-column-info -debugger-tuning=lldb -ggnu-pubnames -target-linker-version 609 -resource-dir /Volumes/Work/CLion/Projects/llvm9.0.1/llvm/cmake-build-debug/lib/clang/9.0.1 -isysroot /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk -c-isystem /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.15.sdk/usr/include -cxx-isystem /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include/c++/v1 -stdlib=libc++ -internal-isystem /Volumes/Work/CLion/Projects/llvm9.0.1/llvm/cmake-build-debug/bin/../include/c++/v1 -internal-isystem /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/c++/v1 -internal-isystem /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/local/include -internal-isystem /Volumes/Work/CLion/Projects/llvm9.0.1/llvm/cmake-build-debug/lib/clang/9.0.1/include -internal-externc-isystem /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include -Wall -std=c++11 -fdeprecated-macro -fdebug-compilation-dir /Volumes/Work/CLion/Projects/Test -ferror-limit 19 -fmessage-length 80 -stack-protector 1 -fblocks -fencode-extended-block-signature -fregister-global-dtors-with-atexit -fobjc-runtime=macosx-10.15.0 -fcxx-exceptions -fexceptions -fmax-type-align=16 -fdiagnostics-show-option -fcolor-diagnostics -o /var/folders/vh/l2bql3ns2d5g5w6w2rk1q16m0000gn/T/main-6e5ff9.o -x c++ /Volumes/Work/CLion/Projects/Test/main.cpp
看雪ID:新萌
https://bbs.pediy.com/user-home-811222.htm
*本文由看雪论坛 新萌 原创,转载请注明来自看雪社区。
安卓应用层抓包通杀脚本发布!
《高研班》2021年3月班火热招生中!👇
* 戳图片了解详情
# 往期推荐
球分享
球点赞
球在看
点击“阅读原文”,了解更多!
本文始发于微信公众号(看雪学院):macOS安装调试llvm入门
免责声明:文章中涉及的程序(方法)可能带有攻击性,仅供安全研究与教学之用,读者将其信息做其他用途,由读者承担全部法律及连带责任,本站不承担任何法律及连带责任;如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截,联系方式见首页),望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论