├── .DS_Store ├── Makefile ├── main.o ├── Insert_dylib.o ├── Remove_dylib.o ├── Insert_Remove_dylib └── Makefile ├── insert_remove_dylib ├── .DS_Store ├── Insert_dylib │ ├── Insert_dylib.h │ └── Insert_dylib.m ├── Remove_dylib │ ├── Remove_dylib.h │ └── Remove_dylib.m └── main.m ├── README.md └── insert_remove_dylib.xcodeproj ├── project.xcworkspace ├── contents.xcworkspacedata ├── xcuserdata │ ├── app2.xcuserdatad │ │ └── UserInterfaceState.xcuserstate │ └── zengxiangxiang.xcuserdatad │ │ └── UserInterfaceState.xcuserstate └── xcshareddata │ └── IDEWorkspaceChecks.plist ├── xcuserdata ├── app2.xcuserdatad │ ├── xcschemes │ │ ├── xcschememanagement.plist │ │ └── insert_remove_dylib.xcscheme │ └── xcdebugger │ │ └── Breakpoints_v2.xcbkptlist └── zengxiangxiang.xcuserdatad │ ├── xcdebugger │ └── Breakpoints_v2.xcbkptlist │ └── xcschemes │ └── xcschememanagement.plist ├── xcshareddata └── xcschemes │ └── insert_remove_dylib.xcscheme └── project.pbxproj /.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/sweetloser/Insert_Remove_dylib/HEAD/.DS_Store -------------------------------------------------------------------------------- /Makefile/main.o: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/sweetloser/Insert_Remove_dylib/HEAD/Makefile/main.o -------------------------------------------------------------------------------- /Makefile/Insert_dylib.o: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/sweetloser/Insert_Remove_dylib/HEAD/Makefile/Insert_dylib.o -------------------------------------------------------------------------------- /Makefile/Remove_dylib.o: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/sweetloser/Insert_Remove_dylib/HEAD/Makefile/Remove_dylib.o -------------------------------------------------------------------------------- /Makefile/Insert_Remove_dylib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/sweetloser/Insert_Remove_dylib/HEAD/Makefile/Insert_Remove_dylib -------------------------------------------------------------------------------- /insert_remove_dylib/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/sweetloser/Insert_Remove_dylib/HEAD/insert_remove_dylib/.DS_Store -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Insert_Remove_dylib 2 | #一个简单的注入和删除注入信息的工具 3 | 4 | #usage ./Insert_Remove_dylib [-r] [-i] dylib.path targetmachofile 5 | -------------------------------------------------------------------------------- /insert_remove_dylib.xcodeproj/project.xcworkspace/contents.xcworkspacedata: -------------------------------------------------------------------------------- 1 | 2 | 4 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /insert_remove_dylib.xcodeproj/project.xcworkspace/xcuserdata/app2.xcuserdatad/UserInterfaceState.xcuserstate: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/sweetloser/Insert_Remove_dylib/HEAD/insert_remove_dylib.xcodeproj/project.xcworkspace/xcuserdata/app2.xcuserdatad/UserInterfaceState.xcuserstate -------------------------------------------------------------------------------- /insert_remove_dylib.xcodeproj/project.xcworkspace/xcuserdata/zengxiangxiang.xcuserdatad/UserInterfaceState.xcuserstate: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/sweetloser/Insert_Remove_dylib/HEAD/insert_remove_dylib.xcodeproj/project.xcworkspace/xcuserdata/zengxiangxiang.xcuserdatad/UserInterfaceState.xcuserstate -------------------------------------------------------------------------------- /insert_remove_dylib.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | IDEDidComputeMac32BitWarning 6 | 7 | 8 | 9 | -------------------------------------------------------------------------------- /insert_remove_dylib/Insert_dylib/Insert_dylib.h: -------------------------------------------------------------------------------- 1 | // 2 | // Insert_dylib.h 3 | // insert_remove_dylib 4 | // 5 | // Created by app2 on 2017/9/15. 6 | // Copyright © 2017年 app2. All rights reserved. 7 | // 8 | 9 | #import 10 | @interface Insert_dylib : NSObject 11 | +(void)Insert_dylib:(NSString *)dylib_path targetFile:(NSString *)target_path; 12 | @end 13 | -------------------------------------------------------------------------------- /insert_remove_dylib/Remove_dylib/Remove_dylib.h: -------------------------------------------------------------------------------- 1 | // 2 | // Remove_dylib.h 3 | // insert_remove_dylib 4 | // 5 | // Created by app2 on 2017/9/16. 6 | // Copyright © 2017年 app2. All rights reserved. 7 | // 8 | 9 | #import 10 | 11 | @interface Remove_dylib : NSObject 12 | 13 | +(void)Remove_dylib:(NSString *)dylib_path targetFile:(NSString *)target_path; 14 | 15 | @end 16 | -------------------------------------------------------------------------------- /insert_remove_dylib.xcodeproj/xcuserdata/app2.xcuserdatad/xcschemes/xcschememanagement.plist: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | SchemeUserState 6 | 7 | insert_remove_dylib.xcscheme 8 | 9 | orderHint 10 | 0 11 | 12 | 13 | SuppressBuildableAutocreation 14 | 15 | D3853EAC1F6BCF5200D88A4A 16 | 17 | primary 18 | 19 | 20 | 21 | 22 | 23 | -------------------------------------------------------------------------------- /insert_remove_dylib.xcodeproj/xcuserdata/zengxiangxiang.xcuserdatad/xcdebugger/Breakpoints_v2.xcbkptlist: -------------------------------------------------------------------------------- 1 | 2 | 6 | 7 | 9 | 17 | 18 | 19 | 20 | 21 | -------------------------------------------------------------------------------- /insert_remove_dylib.xcodeproj/xcuserdata/zengxiangxiang.xcuserdatad/xcschemes/xcschememanagement.plist: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | SchemeUserState 6 | 7 | insert_remove_dylib.xcscheme 8 | 9 | orderHint 10 | 0 11 | 12 | insert_remove_dylib.xcscheme_^#shared#^_ 13 | 14 | orderHint 15 | 0 16 | 17 | 18 | SuppressBuildableAutocreation 19 | 20 | D3853EAC1F6BCF5200D88A4A 21 | 22 | primary 23 | 24 | 25 | 26 | 27 | 28 | -------------------------------------------------------------------------------- /Makefile/Makefile: -------------------------------------------------------------------------------- 1 | 2 | CLANG_BIN=`xcrun --sdk macosx --find clang` 3 | CLANG_UNIVERSAL=$(CLANG_BASE) -arch x86_64 -arch arm64 4 | SDK=`xcrun --sdk macosx --show-sdk-path` 5 | CFLAGS=-Wno-non-literal-null-conversion -Wno-unused-command-line-argument -fobjc-arc 6 | CLANG_BASE = $(CLANG_BIN) -Os $(CFLAGS) -isysroot $(SDK) -F$(SDK)/System/Library/Frameworks 7 | vpath %.m ../insert_remove_dylib:../insert_remove_dylib/Insert_dylib:../insert_remove_dylib/Remove_dylib 8 | vpath %.h ../insert_remove_dylib/Insert_dylib:../insert_remove_dylib/Remove_dylib 9 | all: Insert_Remove_dylib 10 | Insert_Remove_dylib: Insert_dylib.o main.o Remove_dylib.o 11 | $(CLANG_UNIVERSAL) -framework Foundation -o $@ $^ 12 | Insert_dylib.o: Insert_dylib.m 13 | $(CLANG_UNIVERSAL) -x objective-c -framework Foundation -c -o $@ $^ 14 | Remove_dylib.o: Remove_dylib.m 15 | $(CLANG_UNIVERSAL) -x objective-c -framework Foundation -c -o $@ $^ 16 | main.o: main.m 17 | $(CLANG_UNIVERSAL) -x objective-c -framework Foundation -c -o $@ $^ 18 | clean: 19 | rm -f *.o Insert_Remove_dylib 20 | -------------------------------------------------------------------------------- /insert_remove_dylib.xcodeproj/xcuserdata/app2.xcuserdatad/xcdebugger/Breakpoints_v2.xcbkptlist: -------------------------------------------------------------------------------- 1 | 2 | 5 | 6 | 8 | 13 | 14 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | -------------------------------------------------------------------------------- /insert_remove_dylib/main.m: -------------------------------------------------------------------------------- 1 | // 2 | // main.m 3 | // insert_remove_dylib 4 | // 5 | // Created by app2 on 2017/9/15. 6 | // Copyright © 2017年 app2. All rights reserved. 7 | // 8 | 9 | #import 10 | #import 11 | #import "Insert_dylib/Insert_dylib.h" 12 | #import "Remove_dylib/Remove_dylib.h" 13 | 14 | void print_usage(void) { 15 | fprintf(stderr, "insert_remove_dylib v1.0.1\n" 16 | "Usage: insert_remove_dylib [options]

\n" 17 | "\n" 18 | " where options are:\n" 19 | " -i inject a dylib to mach-o file\n" 20 | " -r remove a dylib in mach-o file\n"); 21 | } 22 | 23 | int main(int argc, const char * argv[]) { 24 | @autoreleasepool { 25 | 26 | if (argc<4) { 27 | print_usage(); 28 | } 29 | 30 | NSString *target_path = nil; 31 | NSString *insert_dylib_path = nil; 32 | NSString *remove_dylib_path = nil; 33 | 34 | struct option longopts[] = { 35 | {"insert-dylib", required_argument, NULL, 'i'}, 36 | {"remove-dylib", required_argument, NULL, 'r'}, 37 | {NULL, 0, NULL, 0}, 38 | 39 | }; 40 | int ch; 41 | BOOL errorFlag = NO; 42 | while ((ch = getopt_long(argc, (char * const *)argv, "i:r:", longopts, NULL)) != -1) { 43 | switch (ch) { 44 | case 'i': 45 | { 46 | //获取注入的路径 47 | insert_dylib_path = [NSString stringWithUTF8String:optarg]; 48 | } 49 | break; 50 | case 'r': 51 | { 52 | remove_dylib_path = [NSString stringWithUTF8String:optarg]; 53 | } 54 | break; 55 | case 0: 56 | default: 57 | errorFlag = YES; 58 | break; 59 | } 60 | } 61 | if (errorFlag) { 62 | fprintf(stderr, "ERROR!!!\n"); 63 | 64 | print_usage(); 65 | 66 | exit(1); 67 | } 68 | if (optind < argc) { 69 | //获取target文件路径 70 | target_path = [NSString stringWithUTF8String:argv[optind]]; 71 | 72 | if (insert_dylib_path) { 73 | //注入 74 | fprintf(stderr, "insert:%s\n",[insert_dylib_path UTF8String]); 75 | 76 | [Insert_dylib Insert_dylib:insert_dylib_path targetFile:target_path]; 77 | } 78 | if (remove_dylib_path) { 79 | //移除 80 | fprintf(stderr, "remove:%s\n",[remove_dylib_path UTF8String]); 81 | [Remove_dylib Remove_dylib:remove_dylib_path targetFile:target_path]; 82 | } 83 | if (insert_dylib_path==nil && remove_dylib_path==nil) { 84 | fprintf(stderr, "ERROR!!!\n"); 85 | print_usage(); 86 | exit(1); 87 | } 88 | fprintf(stderr, "completed!!!\n"); 89 | } 90 | 91 | } 92 | return 0; 93 | } 94 | -------------------------------------------------------------------------------- /insert_remove_dylib.xcodeproj/xcshareddata/xcschemes/insert_remove_dylib.xcscheme: -------------------------------------------------------------------------------- 1 | 2 | 5 | 9 | 10 | 16 | 22 | 23 | 24 | 25 | 26 | 32 | 33 | 44 | 46 | 52 | 53 | 54 | 55 | 61 | 63 | 69 | 70 | 71 | 72 | 74 | 75 | 78 | 79 | 80 | -------------------------------------------------------------------------------- /insert_remove_dylib.xcodeproj/xcuserdata/app2.xcuserdatad/xcschemes/insert_remove_dylib.xcscheme: -------------------------------------------------------------------------------- 1 | 2 | 5 | 8 | 9 | 15 | 21 | 22 | 23 | 24 | 25 | 30 | 31 | 32 | 33 | 39 | 40 | 41 | 42 | 43 | 44 | 54 | 56 | 62 | 63 | 64 | 65 | 66 | 67 | 73 | 75 | 81 | 82 | 83 | 84 | 86 | 87 | 90 | 91 | 92 | -------------------------------------------------------------------------------- /insert_remove_dylib/Remove_dylib/Remove_dylib.m: -------------------------------------------------------------------------------- 1 | // 2 | // Remove_dylib.m 3 | // insert_remove_dylib 4 | // 5 | // Created by app2 on 2017/9/16. 6 | // Copyright © 2017年 app2. All rights reserved. 7 | // 8 | 9 | #import "Remove_dylib.h" 10 | #import 11 | #import 12 | @implementation Remove_dylib 13 | +(void)Remove_dylib:(NSString *)dylib_path targetFile:(NSString *)target_path{ 14 | NSFileManager *file_manager = [NSFileManager defaultManager]; 15 | if (![file_manager fileExistsAtPath:target_path isDirectory:NULL]) { 16 | fprintf(stderr, "error:target file not exist!!\n"); 17 | //直接返回 18 | return; 19 | } 20 | char target_binary[1024] = {0}; 21 | char buffer[4096] = {0}; 22 | strlcpy(target_binary, [target_path UTF8String], sizeof(target_binary)); 23 | //读取target文件(r+:以读/写方式打开文件，该文件必须存在。) 24 | FILE *target_fp = fopen(target_binary, "r+"); 25 | if (target_fp == NULL) { 26 | fprintf(stderr, "open file error!!!\n"); 27 | return; 28 | } 29 | fread(&buffer, sizeof(buffer), 1, target_fp); 30 | struct fat_header *fh = (struct fat_header *)buffer; 31 | switch (fh->magic) { 32 | case FAT_CIGAM: 33 | case FAT_MAGIC: 34 | { 35 | struct fat_arch* arch = (struct fat_arch*)&fh[1]; 36 | int i; 37 | for (i=0; infat_arch); i++) { 38 | fprintf(stderr, "removing to arch %i\n",CFSwapInt32(arch->cpusubtype)); 39 | if (CFSwapInt32(arch->cputype) == CPU_TYPE_ARM64) { 40 | [self remove_64:target_fp startAddress:CFSwapInt32(arch->offset) injectPath:dylib_path]; 41 | }else{ 42 | [self remove_32:target_fp startAddress:CFSwapInt32(arch->offset) injectPath:dylib_path]; 43 | } 44 | arch++; 45 | } 46 | } 47 | break; 48 | case MH_CIGAM_64: 49 | case MH_MAGIC_64: 50 | { 51 | fprintf(stderr, "Thin 64bit binary!\n"); 52 | [self remove_64:target_fp startAddress:0 injectPath:dylib_path]; 53 | } 54 | break; 55 | case MH_CIGAM: 56 | case MH_MAGIC: 57 | { 58 | fprintf(stderr, "Thin 32bit binary!\n"); 59 | [self remove_32:target_fp startAddress:0 injectPath:dylib_path]; 60 | } 61 | break; 62 | default: 63 | break; 64 | } 65 | fclose(target_fp); 66 | } 67 | +(void)remove_64:(FILE *)fp startAddress:(unsigned long)top injectPath:(NSString *)dylib_path{ 68 | fseek(fp, top, SEEK_SET); 69 | struct mach_header_64 mach; 70 | fread(&mach, sizeof(struct mach_header_64), 1, fp); 71 | long load_command_start_address = ftell(fp); 72 | struct load_command exist_cmd; 73 | char orig_dylib_name[1024] = {0}; 74 | struct dylib_command orig_dylib; 75 | unsigned char load_command_buffer[4096]; 76 | for (int i=0; i 0) { 99 | long tmp_size = other_dylib_size > 4096 ? 4096 : other_dylib_size; 100 | fread(&load_command_buffer, tmp_size, 1, fp); 101 | fseek(fp, tmp_addr, SEEK_SET); 102 | fwrite(&load_command_buffer, tmp_size, 1, fp); 103 | tmp_addr += tmp_size; 104 | other_dylib_size -= tmp_size; 105 | } 106 | //将最后的一段置为‘\0’ 107 | for (int i=0; i 11 | #import 12 | #define DYLIB_CURRENT_VER 0x10000 13 | #define DYLIB_COMPATIBILITY_VERSION 0x10000 14 | @implementation Insert_dylib 15 | +(void)Insert_dylib:(NSString *)dylib_path targetFile:(NSString *)target_path{ 16 | NSFileManager *file_manager = [NSFileManager defaultManager]; 17 | if (![file_manager fileExistsAtPath:target_path isDirectory:NULL]) { 18 | 19 | fprintf(stderr, "error:target file not exist!!!!!\n"); 20 | //直接返回 21 | return; 22 | } 23 | if ([dylib_path hasPrefix:@"@executable_path/"]) { 24 | }else{ 25 | dylib_path = [NSString stringWithFormat:@"@executable_path/%@",dylib_path]; 26 | } 27 | char target_binary[1024] = {0}; 28 | char buffer[4096] = {0}; 29 | strlcpy(target_binary, [target_path UTF8String], sizeof(target_binary)); 30 | //读取target文件(r+:以读/写方式打开文件，该文件必须存在。) 31 | FILE *target_fp = fopen(target_binary, "r+"); 32 | if (target_fp == NULL) { 33 | fprintf(stderr, "open file error!!!"); 34 | return; 35 | } 36 | fread(&buffer, sizeof(buffer), 1, target_fp); 37 | struct fat_header *fh = (struct fat_header *)buffer; 38 | switch (fh->magic) { 39 | case FAT_CIGAM: 40 | case FAT_MAGIC: 41 | { 42 | struct fat_arch* arch = (struct fat_arch*)&fh[1]; 43 | int i; 44 | for (i=0; infat_arch); i++) { 45 | fprintf(stderr, "Injecting to arch %i\n",CFSwapInt32(arch->cpusubtype)); 46 | if (CFSwapInt32(arch->cputype) == CPU_TYPE_ARM64) { 47 | [self inject_64:target_fp startAddress:CFSwapInt32(arch->offset) injectPath:dylib_path]; 48 | }else{ 49 | [self inject_32:target_fp startAddress:CFSwapInt32(arch->offset) injectPath:dylib_path]; 50 | } 51 | arch++; 52 | } 53 | } 54 | break; 55 | case MH_CIGAM_64: 56 | case MH_MAGIC_64: 57 | { 58 | fprintf(stderr, "Thin 64bit binary!\n"); 59 | [self inject_64:target_fp startAddress:0 injectPath:dylib_path]; 60 | } 61 | break; 62 | case MH_CIGAM: 63 | case MH_MAGIC: 64 | { 65 | fprintf(stderr, "Thin 32bit binary!\n"); 66 | [self inject_32:target_fp startAddress:0 injectPath:dylib_path]; 67 | } 68 | break; 69 | default: 70 | break; 71 | } 72 | fclose(target_fp); 73 | } 74 | /***************************************************/ 75 | /***************************************************/ 76 | +(void)inject_64:(FILE *)fp startAddress:(unsigned int)top injectPath:(NSString *)dylib_path{ 77 | //将指针指向64架构的开始位置 78 | fseek(fp, top, SEEK_SET); 79 | struct mach_header_64 mach; 80 | fread(&mach, sizeof(struct mach_header_64), 1, fp); 81 | struct load_command exist_cmd; 82 | struct dylib_command orig_dyld; 83 | char orig_dyld_name[1024]; 84 | //遍历所有的load command 段，查看是否已经注入相同的动态库，如果已经注入相同的库，就不注入了 85 | for (int i=0; i