uroboro uroboro

Package	Commands
pre-installed	touch lzma
bash	bash
coreutils	cat chmod cp du ln md5sum mkdir nproc tr rm uname
git	git
grep	grep
make	make
openssh-client	scp
perl	perl

Add config for other hooking mechanisms facebook/fishhook#18 (comment) :

substitute's substitute_hook_functions
rd_route's rd_route
mach_override's mach_override_ptr
libevil's evil_override_ptr
HookZz's ZzHook
DYLD_INTERPOSE
PLPatchMaster's what exactly?

%hookf(FILE *, "fopen", const char *path, const char *mode) {
	NSLog(@"Hey, we're hooking fopen to deny relative paths!");
	if (path[0] != '/') {
		return NULL;
	}
	return %orig; // Call the original implementation of this function
}

/*
 * cbz Rn, location
 *
 * 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16   <-- bit
 *  0  0  1  1  0  1  0  0 [                         <-- meaning
 * 15 14 13 12 11 10  9  8  7  6  5  4  3  2  1  0   <-- bit
 *                         location][           Rn]  <-- meaning
 * location is 4 byte aligned
 *

Explanation for OFFSET_IOSURFACEROOTUSERCLIENT_VTAB

extract the IOSurface kext
hex -dump the entire __DATA_CONST.__const segment
you should see a lot of pointers, occasionally separated by some zeroes - you're looking at vtable contents, e.g.:

now subclasses of IOUserClient have huge vtables, a couple hundred pointers

	int numberOfClasses = objc_getClassList(NULL, 0);
	Class * classList = (Class )malloc(numberOfClasses sizeof(Class));
	numberOfClasses = objc_getClassList(classList, numberOfClasses);

	NSString * string = @"digraph cluster {\nrankdir=\"LR\"\n";
	for (int idx = 0; idx < numberOfClasses; idx++) {
	Class clazz = classList[idx];
	if (some expression to filter results) {

	NSString * str = [NSString stringWithFormat:@"%@ -> %@\n",

	#include <stdio.h>
	#import <Foundation/Foundation.h>

	int main(int argc, char **argv) {
	NSArray * options = @[
	@"-h",
	@"--help",
	@"--get",
	@"--set",
	];

	#!//bin/sh

	export PATH=bin:$PATH

	self=$0

	function print_help() {
	echo "$self [IPSW path]"
	echo "$self [device model] [ios build]"
	echo

	➤ python json_output.py -d xxx -t T1000 -o - file1.swift file2.swift
	{"file1.swift": {"object": "xxx/file1.swift.T1000.o", "dependencies": "xxx/file1.swift.T1000.Td"}, "file2.swift": {"object": "xxx/file2.swift.T1000.o", "dependencies": "xxx/file2.swift.T1000.Td"}, "": {"swift-dependencies": "xxx/master.swiftdeps"}}⏎