• Stars
    star
    184
  • Rank 209,187 (Top 5 %)
  • Language
    C
  • License
    MIT License
  • Created almost 11 years ago
  • Updated about 1 year ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Function hooking for macOS

rd_route

Build Status
Replace (aka «hook» or «override» or «route») implementation of any C function in runtime. Works on OS X with Mach–O binaries.

Do not use this code. It can destroy everthing. But if you do, I wish you a luck.

NOTE: rd_route won't work on iOS. You should take a look at libevil instead.
Aaand it won't work for you too if you're targeting ARM64. Unfortunately I don't have a modern iOS device and thus unable to look into it, but maybe you do?

Usage

#include <assert.h>
#include "rd_route.h"


static char* my_strerror(int err)
{
  return "It's OK";
}

int main (void)
{

    void *(*original)(int) = NULL;
    int err = 2;

    printf("Error(%d): %s", err, strerror(err));
    // >> No such file or directory

    rd_route(strerror, my_strerror, (void **)&original);
    
    // See if the patch works
    assert(0 == strcmp("It's OK", strerror(err)));
    // See if an original implementation is still available
    assert(0 == strcmp("No such file or directory", original(err)));

    return 0;
}

Integration

Using git submodules

$ cd /your/project/path
$ git submodule add https://github.com/rodionovd/rd_route

Not using git submodules

Just copy rd_route.h and rd_route.c files into your project's directory.


But wait, we already have mach_override for this stuff

I've created this library because mach_override requires an external disassembler in order to work properly. For those of us who don't want another few thousands of lines of foreign code in their projects, the only option is to hard-code every function prologue they know in order to patch it correctly — which isn't a great alternative to have, to be honest.

Credits

  • The source code is based on Landon Fuller's (@landonf) gorgeous libevil library.

  • I'm also glade we have Jonathan 'Wolf' Rentzsch out there with his classy mach_override 👍


If you found any bug(s) or something, please open an issue or a pull request — I'd appreciate your help! (^,,^)


Dmitry Rodionov, 2014-2015
[email protected]

More Repositories

1

SWRoute

PoC of function hooking in Swift
Swift
586
star
2

liblorgnette

Interprocess dlsym() for OS X & iOS
C
175
star
3

shortcuts

A CLI manager for your text replacements on macOS
Objective-C
66
star
4

cuckoo-osx-analyzer

An OS X analyzer for Cuckoo Sandbox project
Python
57
star
5

task_vaccine

Yet another code injection library for macOS
C
52
star
6

RDInjectionWizard

[Deprecated] Painless code injection
Objective-C
52
star
7

RDProcess

Re-implementation of NSProcessInfo+NSRunningApplication with all missed stuff (incl. Sandbox information and other things)
Objective-C
37
star
8

machobot

A Python toolbox for Mach-O files analysis.
Python
22
star
9

Locatr

OS X app for faking your location
Objective-C
17
star
10

selfieo

Dump the current process image to a file (OS X)
C
14
star
11

NeverGonnaGiveYouUp

An OS X kernel module that protects a userland process from being terminated in any way
C
13
star
12

rd_get_symbols

A modern replacement for nlist() that works for both i386 and x86_64 processes
C
11
star
13

ABetterPlaceForTweetbot

A positivity filter for Tweetbot in the morning.
Objective-C
9
star
14

Cegta

A tiny DSL for TDD/BDD written in C
C++
7
star
15

dotfiles

My dotfiles
Shell
6
star
16

Daruma

A Mac app for browsing japanese emoticons
Objective-C
5
star
17

dns-monitor

A simple DNS monitor/locker for macOS based on SystemConfiguration framework
Objective-C
4
star
18

Meetings

OS X Notifications showcase: schedule meetings and receive reminders about upcoming events
Swift
4
star
19

homebrew-taps

My very own Homebrew tap repository
Ruby
3
star
20

DropboxStatusFetcher

Query a local file sync status on OS X
Objective-C
2
star
21

YetAnotherAStar

A* path finder in Swift
Swift
1
star
22

rodionovd.github.io

my tiny corner of the web
HTML
1
star
23

HSCore.framework

HoneySound Core framework
1
star