注入dylib

开源选择

目前找到比较好的一个开源库是这个
https://github.com/Tyilo/insert_dylib

至少我发现它是能够支持模拟器的。

原理

这些东西原理都一个样，通过修改LoadCommand来使得系统加载应用时顺便把你的dylib加载进来。

LoadCommand.png

取值

添加一个Command, value要如何取值

• dylib直接放在app目录下: @executable_path/libtest.dylib
• dylib放在已存在Frameworks目录下: @rpath/libtest.dylib 或 @executable_path/Frameworks/libtest.dylib
• dylib放在自己创建的Frameworks目录下: @executable_path/Frameworks/libtest.dylib

用法

直接编译得到二进制后即可使用

坑1

为了方便重签名，我尝试总是将dylib放到Frameworks下面。当然，如果没有.app文件下面没有这个目录，我就为他创建一个，然后把dylib放进去。事实证明这样是不行的，会导致dylib加载失败。（如果原来Frameworks目录是存在的，是不会失败的）

Exception Type:  EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Exception Note:  EXC_CORPSE_NOTIFY
Termination Description: DYLD, Library not loaded: @rpath/libtest.dylib | Referenced from: /var/containers/Bundle/Application/9683F64B-63A5-4CD2-90D0-076CD85789E5/Test.app/Test | Reason: image not found
Triggered by Thread:  0

Filtered syslog:
None found

Thread 0 Crashed:
0   dyld                            0x0000000103841cbc __abort_with_payload + 8
1   dyld                            0x0000000103841668 abort_with_payload_wrapper_internal + 100
2   dyld                            0x0000000103841694 fcntl + 0
3   dyld                            0x0000000103820514 dyld::fastBindLazySymbol(ImageLoader**, unsigned long) + 0
4   dyld                            0x00000001038229a8 dyld::_main(macho_header const*, unsigned long, int, char const**, char const**, char const**, unsigned long*) + 4072
5   dyld                            0x000000010381d044 _dyld_start + 68

Thread 0 crashed with ARM Thread State (64-bit):
    x0: 0x0000000000000006   x1: 0x0000000000000001   x2: 0x000000016fdde1b0   x3: 0x0000000000000082
    x4: 0x000000016fddddb0   x5: 0x0000000000000000   x6: 0x0000000000000000   x7: 0x0000000000000e80
    x8: 0x0000000000000020   x9: 0x0000000000000009  x10: 0x6f5a512f35453938  x11: 0x512f7070612e656e
   x12: 0x20200a656e6f7a51  x13: 0x203a6e6f73616552  x14: 0x6f6e206567616d69  x15: 0x00646e756f662074
   x16: 0x0000000000000209  x17: 0x0000000000000030  x18: 0x0000000000000000  x19: 0x0000000000000000
   x20: 0x000000016fddddb0  x21: 0x0000000000000082  x22: 0x000000016fdde1b0  x23: 0x0000000000000001
   x24: 0x0000000000000006  x25: 0x000000010384dab8  x26: 0x000000010384fbb8  x27: 0x9015bc02032200b8
   x28: 0x000000010384d000   fp: 0x000000016fdddd80   lr: 0x0000000103841668
    sp: 0x000000016fdddd40   pc: 0x0000000103841cbc cpsr: 0x00000000

Binary Images:
0x100020000 - 0x102bcffff Test arm64  <98ee4fcadd62340f838b652d5fe58ecb> /var/containers/Bundle/Application/9683F64B-63A5-4CD2-90D0-076CD85789E5/Test.app/Test
0x10381c000 - 0x10384bfff dyld arm64   /usr/lib/dyld

EOF

解决办法：

• 如果Frameworks文件夹是我们创建的话，使用 @executable_path/Frameworks/libtest.dylib而不是@rpath/libtest.dylib
• 放在app目录下就好了，使用 ```@executable_path/libtest.dylib