dobby 的inlinehook,通过取出一页,插入跳转到新方法的汇编代码,然后 通过 mach_vm_remap 方法进行实现
PUBLIC MemoryOperationError CodePatch(void *address, uint8_t *buffer, uint32_t buffer_size) {
// 新创建一页,用于在新创建的页上patch 代码
addr_t remap_dummy_page =
(addr_t)mmap(0, page_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, VM_MAKE_TAG(255), 0);
if ((void *)remap_dummy_page == MAP_FAILED)
return kMemoryOperationError;
// 复制原来的页到新创建页上
memcpy((void *)remap_dummy_page, (void *)page_aligned_address, page_size);
// 将需要插入的汇编代码,插入到新页指定地址
memcpy((void *)(remap_dummy_page + offset), buffer, buffer_size);
// 改变新页的权限为可读写
mprotect((void *)remap_dummy_page, page_size, PROT_READ | PROT_WRITE);
// 获取需要被替换的页地址
mach_vm_address_t remap_dest_page = (mach_vm_address_t)page_aligned_address;
vm_prot_t curr_protection, max_protection;
// 为当前进程,使用 mach_vm_remap 方法,使用新页 remap_dummy_page 替换 remap_dest_page 老