1

Here's IDA: http://pastebin.com/AkU0MDWh

Also, would this be written in C to show like this? In comparison to a regular method like:

ListRowCell - (id)initWithStyle:(int) reuseIdentifier:(id)
3

You can hook this method (and most other methods) in iOS if codesigning enforcement is turned off in the kernel, e.g. on a jailbroken iOS device. The way to do this is to overwrite the first few instructions of the function with some instructions to jump to your hook. Your hook then call back to some instructions elsewhere that performs the instructions you had previously overwritten before jumping back to right after the overwritten section.

Specifically, you can use CydiaSubstrate to do this provided you can find the address of this method somehow. The simplest way to determine the address targeted perhaps by determining the slide of the binary and adding 0xA303C. However, this method is not as good as finding an actual symbol for that function (perhaps using nlist) since if you want it to work on multiple versions of the target binary, the exact address of that function will change.

The function cannot be hooked without a codesigning enforcement kernel patch since you can't hook this particular function without changing signed code. The block_invoke functions are often referenced in the __const section of the binary or else referenced by PC-relative references in the code.

The signature of this particular function is: UIAlertView* ___LT9867544270_block_invoke_3(UIAlertView* (^block)(void))

However, the block argument is unused. You can deduce this by looking at the fact that the function immediately overwrites R0-R2 without using their values. R3 is not used because a function is called that does not use it before R3 is ever read.

You can deduce the return value by seeing that R0 is sometimes set to R4 right before returning from the function. R4 is the result of [UIAlertView alloc] throughout the function.

The signature of the blocks in general is: [return value of the block] __[function name block was declared in]_block_invoke_[the number of the block in the function the block was declared in if it's not the first one](id block, [arguments of the block...]). For example, if you had this in your code:

void myFunction() {
    int (^myBlock)(int, int) = ^(int a, int b) {
        return a * b;
    };
}

You would get the following block:

int __myFunction_block_invoke(int (^myBlock)(int, int), int a, int b) {
    return a * b;
}
2
  • Thanks a lot for taking the time to provide such analysis. Frankly, I am an enthusiast, and this is a bit over my head, but nonetheless, it provides more info for me to learn more. This code is coming from Filza app, even though I tried changing some values to hide that. Specifically, I am trying to reduce app size with latest JB, and I used lipo to thin it by 10mb. However, the app has a mechanism to check itself, and will invoke this method accordingly. I will reach out to dev to see if he can provide the app in separate archs. Thanks again!
    – abuhun
    Aug 10 '16 at 14:11
  • Ah, I gave a lot of detail because I wasn't sure if you're talking about jailbroken iOS with Cydia, trying to hook a library in your own app on non-jailbroken iOS, or something else. Basically, you can just use CydiaSubstrate to do MSHookFunction(_dyld_get_image_vmaddr_slide(0) + 0xA303C + 1, (void*)hook, (void*)&orig); or similar, where hook and orig have that signature: UIAlertView* ___LT9867544270_block_invoke_3(UIAlertView* (^block)(void)) Aug 16 '16 at 5:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.