objc/c++ dyld_get_image_header function hooking load executable mach header by path

Schevenz Rs 0
Viewed 31

So im currently testing to hook this function:

const mach_header* dyld_get_image_header(uint32_t image_index){ ... }

I successfully achieved the hooking technique for this specific function, Now my main question is this:

Lets say, I have a binary executable file in some path we call it "Original", And currently I have another executable that is executed called "Fake" if you use uint32_t dyld_image_count(void) it would return all the image counts and this "Fake" executable would be at index = 1, so if i want to use dyld_get_image_header(1) it would return the macho header of the executed "Fake" at index = 1 lets call it fake_ret, Now my purpose is to replace this fake_ret with "Original" executable which is at some path,

So my question is, How can I load the original executable as const mach_header* like the function return by path so I can assign it to the fake_ret?

pseudocode idea:

const mach_header* dyld_get_image_header_hook(uint32_t image_index){

const mach_header* fake_ret = dyld_get_image_header_org(image_index);

if(image_index == 1){
     fake_ret = original // this is the original file inside some path which i cant know to make the assignment for it
      return fake_ret;
   }
return fake_ret;
   }

ofcourse the used _org function is just a pointer to the original function of the dyld get image header and takes as parameter and return same as i described,

so how can i load the original file to that assignment in the pseudocode is there any idea for this process?

hook xcode c c++
1 Answers

Thanks for everyone, I just had to use mmap function to mmap my original executable file, mmap function can load the image and returns a pointer, then i could cast the output like this:

(const mach_header *) mmap(..)
Schevenz Rs0
Related