Hikari源码分析 - AntiClassDump

triple = Triple(M.getTargetTriple());if (triple.getVendor() != Triple::VendorType::Apple) {  // 只支持苹果的ObjC实现，对于GNU Step等其它实现给出警告  // ...  return false;}

Type *Int8PtrTy = Type::getInt8PtrTy(M.getContext());

// 添加ObjC运行时函数的声明    FunctionType *IMPType =        FunctionType::get(Int8PtrTy, {Int8PtrTy, Int8PtrTy}, true);    PointerType *IMPPointerType = PointerType::getUnqual(IMPType);    FunctionType *class_replaceMethod_type = FunctionType::get(        IMPPointerType, {Int8PtrTy, Int8PtrTy, IMPPointerType, Int8PtrTy},        false);    M.getOrInsertFunction("class_replaceMethod", class_replaceMethod_type);    FunctionType *sel_registerName_type =        FunctionType::get(Int8PtrTy, {Int8PtrTy}, false);    M.getOrInsertFunction("sel_registerName", sel_registerName_type);// ...

  // 判断是否支持ApplePtrauth和Opaque Pointersappleptrauth = hasApplePtrauth(&M);opaquepointers = !M.getContext().supportsTypedPointers();

GlobalVariable *OLCGV = M.getGlobalVariable("OBJC_LABEL_CLASS_$", true);

if (!OLCGV) {  errs() << "No ObjC Class Found in :" << M.getSourceFileName() << "n";   // 没有找到ObjC类，Pass不进行处理  return false;}

assert(OLCGV->hasInitializer() &&           "OBJC_LABEL_CLASS_$ Doesn't Have Initializer.");           // 获取OBJC_LABEL_CLASS_$的初始化值，即包含所有类信息的常量数组ConstantArray *OBJC_LABEL_CLASS_CDS =        dyn_cast<ConstantArray>(OLCGV->getInitializer());

std::vector<std::string> readyclses;  // 存储可以处理的类std::deque<std::string> tmpclses; // 临时存储类的队列，用于处理依赖关系std::map<std::string /*class*/, std::string /*super class*/> dependency; // 存储类与其父类的对应关系std::map<std::string /*Class*/, GlobalVariable *> GVMapping; // 存储类名与对应的全局变量的映射

for (...) {  ...  if (supclsName == "" || (SuperClassGV && !SuperClassGV->hasInitializer())) {    readyclses.emplace_back(clsName);// 父类为空或者父类未初始化，说明该类是可以处理的  } else {    tmpclses.emplace_back(clsName);// 父类不为空，暂时无法处理，加入临时队列  }}

// 根据依赖关系排序，保证父类在子类之前处理while (tmpclses.size()) {  std::string clstmp = tmpclses.front();  tmpclses.pop_front();  std::string SuperClassName = dependency[clstmp];  if (SuperClassName != "" &&      std::find(readyclses.begin(), readyclses.end(), SuperClassName) ==          readyclses.end()) {    // 父类还未处理，将该类重新加入临时队列    tmpclses.emplace_back(clstmp);  } else {    // 父类已经处理，将该类加入可以处理的队列    readyclses.emplace_back(clstmp);  }}

for (std::string className : readyclses) {  handleClass(GVMapping[className], &M);}

// 判断类的全局变量是否有初始值，如果没有则直接返回assert(GV->hasInitializer() &&       "ObjC Class Structure's Initializer Missing");

ConstantStruct *CS = dyn_cast<ConstantStruct>(GV->getInitializer());StringRef ClassName = GV->getName();ClassName = ClassName.substr(strlen("OBJC_CLASS_$_"));StringRef SuperClassName =    readPtrauth(        cast<GlobalVariable>(CS->getOperand(1)->stripPointerCasts()))        ->getName();SuperClassName = SuperClassName.substr(strlen("OBJC_CLASS_$_"));errs() << "Handling Class:" << ClassName       << " With SuperClass:" << SuperClassName << "n";

GlobalVariable *metaclassGV = readPtrauth(    cast<GlobalVariable>(CS->getOperand(0)->stripPointerCasts()));GlobalVariable *class_ro = readPtrauth(    cast<GlobalVariable>(CS->getOperand(4)->stripPointerCasts()));assert(metaclassGV->hasInitializer() && "MetaClass GV Initializer Missing");GlobalVariable *metaclass_ro = readPtrauth(cast<GlobalVariable>(    metaclassGV->getInitializer()        ->getOperand(metaclassGV->getInitializer()->getNumOperands() - 1)        ->stripPointerCasts()));

if (Info.find("METHODLIST") != Info.end()) {  ConstantArray *method_list = cast<ConstantArray>(Info["METHODLIST"]);  for (unsigned i = 0; i < method_list->getNumOperands(); i++) {    ConstantStruct *methodStruct =        cast<ConstantStruct>(method_list->getOperand(i));    // 从方法结构体中提取方法的名称、类型和实现    GlobalVariable *SELNameGV = cast<GlobalVariable>(        opaquepointers ? methodStruct->getOperand(0)                       : methodStruct->getOperand(0)->getOperand(0));    ConstantDataSequential *SELNameCDS =        cast<ConstantDataSequential>(SELNameGV->getInitializer());    StringRef selname = SELNameCDS->getAsCString();    if ((selname == "initialize" && UseInitialize) ||        (selname == "load" && !UseInitialize)) {      // 如果找到了现有的初始化方法（initialize或load），则记录EntryBB为该方法的入口基本块      Function *IMPFunc = cast<Function>(readPtrauth(cast<GlobalVariable>(          methodStruct->getOperand(2)->stripPointerCasts())));      errs() << "Found Existing initializern";      EntryBB = &(IMPFunc->getEntryBlock());    }  }} else {  errs() << "Didn't Find ClassMethod Listn";}

if (!EntryBB) {    FunctionType *InitializerType = FunctionType::get(        Type::getVoidTy(M->getContext()), ArrayRef<Type *>(), false);    Function *Initializer = Function::Create(        InitializerType, GlobalValue::LinkageTypes::PrivateLinkage,        "AntiClassDumpInitializer", M);    EntryBB = BasicBlock::Create(M->getContext(), "", Initializer);    ReturnInst::Create(M->getContext(), EntryBB);}

IRBuilder<> *IRB = new IRBuilder<>(EntryBB, EntryBB->getFirstInsertionPt());

// We now prepare ObjC API DefinitionsFunction *objc_getClass = M->getFunction("objc_getClass");// End of ObjC API DefinitionsValue *ClassNameGV = IRB->CreateGlobalStringPtr(ClassName);// Now Scan For Props and Ivars in OBJC_CLASS_RO AND OBJC_METACLASS_RO// Note that class_ro_t's structure is different for 32 and 64bit runtimeCallInst *Class = IRB->CreateCall(objc_getClass, {ClassNameGV});

// Add MethodsConstantStruct *metaclassCS =    cast<ConstantStruct>(class_ro->getInitializer());ConstantStruct *classCS =    cast<ConstantStruct>(metaclass_ro->getInitializer());if (!metaclassCS->getAggregateElement(5)->isNullValue()) {  errs() << "Handling Instance Methods For Class:" << ClassName << "n";  HandleMethods(metaclassCS, IRB, M, Class, false);   // ...} // 继续处理实例方法和类方法// 这里只处理类方法，实例方法的处理类似GlobalVariable *methodListGV = nullptr;// 存储类方法列表的全局变量if (!classCS->getAggregateElement(5)->isNullValue()) {  errs() << "Handling Class Methods For Class:" << ClassName << "n";  HandleMethods(classCS, IRB, M, Class, true);  methodListGV = readPtrauth(cast<GlobalVariable>(      classCS->getAggregateElement(5)->stripPointerCasts()));}

//定义方法类型Type *objc_method_type =    StructType::getTypeByName(M->getContext(), "struct._objc_method"); //创建新方法的结构体Constant *newMethod = ConstantStruct::get(    cast<StructType>(objc_method_type),    ArrayRef<Constant *>(methodStructContents)); // objc_method_t //创建新方法的列表ArrayType *AT = ArrayType::get(objc_method_type, 1);Constant *newMethodList = ConstantArray::get(    AT, ArrayRef<Constant *>(newMethod)); // Container of objc_method_t

//1. 为新方法列表创建结构体类型和实例std::vector<Type *> newStructType;std::vector<Constant *> newStructValue;// ...（省略初始化newStructType和newStructValue的代码） StructType *newType = StructType::get(M->getContext(), ArrayRef<Type *>(newStructType));Constant *newMethodStruct = ConstantStruct::get(newType, ArrayRef<Constant *>(newStructValue)); // l_OBJC_$_CLASS_METHODS_  //2. 创建并注册新的全局变量:GlobalVariable *newMethodStructGV = new GlobalVariable(    *M, newType, true, GlobalValue::LinkageTypes::PrivateLinkage,    newMethodStruct, "ACDNewClassMethodMap");appendToCompilerUsed(*M, {newMethodStructGV}); //3. 替换旧的方法列表引用并删除旧的全局变量:/**ConstantExpr::getBitCast和replaceAllUsesWith负责将新的方法列表安全地转换成所需类型并用其替换旧的方法列表，完成对类结构的更新。通过dropAllReferences和eraseFromParent从模块中移除旧的全局变量，确保不会有内存泄漏或其他问题。*/Constant *bitcastExpr = ConstantExpr::getBitCast(    newMethodStructGV, PointerType::getUnqual(StructType::getTypeByName(                           M->getContext(), "struct.__method_list_t"))); opaquepointers ? classCS->setOperand(5, bitcastExpr)               : classCS->handleOperandChange(                     classCS->getAggregateElement(5), bitcastExpr); if (methodListGV) {    methodListGV->replaceAllUsesWith(ConstantExpr::getBitCast(        newMethodStructGV,        methodListGV->getType()));    methodListGV->dropAllReferences();    methodListGV->eraseFromParent();}