前言

昨天在去掉ptrace的示例代码中碰到

No previous prototype for function 
// See http://iphonedevwiki.net/index.php/Logos

//http://everettjf.com/2015/12/20/amap-ios-client-kill-anti-debugging-protect/
//https://segmentfault.com/a/1190000006104602
//http://dev.qq.com/topic/5791da152168f2690e72daa4
//https://bbs.pediy.com/thread-185014.htm
//http://www.rainyx.com/archives/category/ios/reverse

#import <substrate.h>
#import <mach-o/dyld.h>
#import <dlfcn.h>

void (*old_sub_bf92)(void);

void new_sub_bf92(void)
{
    // old_sub_bf92();
    NSLog(@"KNiOSRE: anti-anti-debugging");
}
//sub_bf92
%ctor
{
    @autoreleasepool
    {
        unsigned long _sub_bf92 = (_dyld_get_image_vmaddr_slide(0) + 0xbf92) | 0x1;
        if (_sub_bf92) NSLog(@"KNiOSRE: Found sub_bf92!");
            MSHookFunction((void *)_sub_bf92, (void *)&new_sub_bf92, (void **)&old_sub_bf92);
    }
}
  • 解决方法是用static 修饰
static void new_sub_bf92(void)
{
    // old_sub_bf92();
    NSLog(@"KNiOSRE: anti-anti-debugging");
}
  • 获取设置工程的编译配置
Project-Info -> TARGETS ->Build Settings -> LLVM GCC4.2 - Warnings组 -> Missing Function Prototypes   Yes->No

iOS逆向
44 声望15 粉丝

引用和评论

0 条评论