restore-symbol编译与使用

最新推荐文章于 2024-05-14 09:46:51 发布

zhaosuningsn

最新推荐文章于 2024-05-14 09:46:51 发布

阅读量873

点赞数

分类专栏： iOS逆向 iOS xcode 文章标签： ios objective-c xcode

本文链接：https://blog.csdn.net/zhaosuningzsn/article/details/116937483

版权

iOS 同时被 3 个专栏收录

13 篇文章 0 订阅

订阅专栏

iOS逆向

7 篇文章 0 订阅

订阅专栏

xcode

3 篇文章 0 订阅

订阅专栏

1、Mac电脑中新建一个文件夹restoresym
2、终端命令行 cd 到restoresym文件夹
3、在restoresym文件夹目录下输入终端命令如下

git clone --recursive https://github.com/tobefuturer/restore-symbol.git

得到结果

Cloning into 'restore-symbol'...
remote: Enumerating objects: 85, done.
remote: Total 85 (delta 0), reused 0 (delta 0), pack-reused 85
Unpacking objects: 100% (85/85), done.
Submodule 'class-dump' (https://github.com/0xced/class-dump) registered for path 'class-dump'
Cloning into '/Users/username/Desktop/restoresym/restore-symbol/class-dump'...
remote: Enumerating objects: 10038, done.        
remote: Total 10038 (delta 0), reused 0 (delta 0), pack-reused 10038        
Receiving objects: 100% (10038/10038), 3.63 MiB | 2.01 MiB/s, done.
Resolving deltas: 100% (6518/6518), done.
Submodule path 'class-dump': checked out 'a8877b6695f317816322134944a410de09da4911'

4、终端cd到git刚克隆的restore-symbol目录下,并 ls -l 查看信息

cd /Users/UserName/Desktop/restoresym/restore-symbol

ls -l

total 16
-rw-r--r--   1 UserName  staff  3142  5 14 15:22 README.md
drwxr-xr-x  20 UserName  staff   640  5 14 15:22 class-dump
-rw-r--r--   1 UserName  staff   415  5 14 15:22 makefile
drwxr-xr-x   3 UserName  staff    96  5 14 15:22 picture
drwxr-xr-x   4 UserName  staff   128  5 14 15:22 restore-symbol.xcodeproj
drwxr-xr-x   3 UserName  staff    96  5 14 15:22 search_oc_block
drwxr-xr-x  11 UserName  staff   352  5 14 15:22 source

5、终端执行make

make

得到结果

rm -rf libMachObjC.a restore-symbol.dSYM/ build/ class-dump/build/ 
rm -f restore-symbol
git submodule update --init --recursive
xcodebuild -project "restore-symbol.xcodeproj" -target "restore-symbol" -configuration "Release" CONFIGURATION_BUILD_DIR="/Users/username/Desktop/restoresym/restore-symbol" -jobs 4 build
User defaults from command line:
    IDEBuildOperationMaxNumberOfConcurrentCompileTasks = 4

Build settings from command line:
    CONFIGURATION_BUILD_DIR = /Users/username/Desktop/restoresym/restore-symbol

Build Preparation
Build task concurrency set to 4 via user default IDEBuildOperationMaxNumberOfConcurrentCompileTasks

note: Using new build system
note: Planning build
note: Constructing build description

2021-05-14 15:23:28.558 xcodebuild[12345:123456]  iPhoneConnect: 📱<DVTiOSDevice (0x123412341234), iphonename的 iPhone, iPhone, 14.4 (12345),12345678901234567890> unable to mount developer disk image, (Error Domain=com.apple.dtdevicekit Code=601 "Could not locate device support files." UserInfo={DeviceType=iPhone9,2, NSLocalizedDescription=Could not locate device support files., NSLocalizedRecoverySuggestion=This iPhone 7 P(Model 1234, 1234, 1234, 1234) is running iOS 14.4 (12345), which may not be supported by this version of Xcode.}) {
    DeviceType = "iPhone9,2";
    NSLocalizedDescription = "Could not locate device support files.";
    NSLocalizedRecoverySuggestion = "This iPhone 7 Plus (Model 1234, 1234, 1234, 1234) is running iOS 14.4 (12345), which may not be supported by this version of Xcode.";
}
CreateBuildDirectory /Users/username/Desktop/restoresym/restore-symbol/build (in target: restore-symbol)
    cd /Users/username/Desktop/restoresym/restore-symbol
    builtin-create-build-directory /Users/username/Desktop/restoresym/restore-symbol/build

省略

GenerateDSYMFile /Users/username/Desktop/restoresym/restore-symbol/restore-symbol.dSYM /Users/username/Desktop/restoresym/restore-symbol/restore-symbol (in target: restore-symbol)
    cd /Users/username/Desktop/restoresym/restore-symbol
    /Users/username/Desktop/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/dsymutil /Users/username/Desktop/restore-symbol/restore-symbol -o /Users/username/Desktop/restoresym/restore-symbol/restore-symbol.dSYM

CodeSign /Users/username/Desktop/restoresym/restore-symbol/restore-symbol (in target: restore-symbol)
    cd /Users/username/Desktop/restoresym/restore-symbol
    export CODESIGN_ALLOCATE=/Users/username/Desktop/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/codesign_allocate
    
Signing Identity:     "-"

    /usr/bin/codesign --force --sign - --entitlements /Users/username/Desktop/restoresym/restore-symbol/build/restore-symbol.build/Release/restore-symbol.build/restore-symbol.xcent --timestamp=none /Users/username/Desktop/restoresym/restore-symbol/restore-symbol

** BUILD SUCCEEDED **

rm -rf libMachObjC.a restore-symbol.dSYM/ build/ class-dump/build/

可以看到，上面出现一个错误，
running iOS 14.4 (12345), which may not be supported by this version of Xcode.}) {
DeviceType = “iPhone9,2”;
NSLocalizedDescription = “Could not locate device support files.”;

解决方案
连接iPhone 14.4报错，更换成连接 iPhone 6 V12.4.9，
重新

make

6、终端在restore-symbol目录下 ls -l

ls -l

得到结果

total 303360
-rw-r--r--   1 username  staff       3142  5 14 15:22 README.md
-rwxr-xr-x   1 username  staff  153430752  5  6 16:22 Snapchat
drwxr-xr-x  20 username  staff        640  5 14 15:23 class-dump
-rw-r--r--   1 username  staff        415  5 14 15:22 makefile
drwxr-xr-x   3 username  staff         96  5 14 15:22 picture
-rwxr-xr-x   1 username  staff     603584  5 14 15:23 restore-symbol
drwxr-xr-x   4 username  staff        128  5 14 15:22 restore-symbol.xcodeproj
drwxr-xr-x   3 username  staff         96  5 14 15:22 search_oc_block
drwxr-xr-x  11 username  staff        352  5 14 15:22 source

7、对APPName.app中的二进制文件APPName进行符号还原，复制二进制文件APPName到restore-symbol目录下，
注意，此时二进制文件添加了可执行权限。

chmod +x APPName

然后执行终端命令如下

./restore-symbol APPName -o APPName_with_symbol

结果如下，出现报错

=========== Start =============
Scan OC method in mach-o-file.
2021-05-14 15:33:23.255 restore-symbol[10711:121535] *** Assertion failure in -[CDObjectiveC2Processor loadClassAtAddress:], /Users/username/Desktop/restoresym/restore-symbol/class-dump/Source/CDObjectiveC2Processor.m:258
2021-05-14 15:33:23.269 restore-symbol[10711:121535] *** Terminating app due to uncaught exception 'NSInternalInconsistencyException', reason: 'Invalid parameter not satisfying: moduleName.length == length'
*** First throw call stack:
(
	0   CoreFoundation                      0x00007fff207956af __exceptionPreprocess + 242
	1   libobjc.A.dylib                     0x00007fff204cd3c9 objc_exception_throw + 48
	2   CoreFoundation                      0x00007fff207be512 +[NSException raise:format:arguments:] + 88
	3   Foundation                          0x00007fff2157a6c9 -[NSAssertionHandler handleFailureInMethod:object:file:lineNumber:description:] + 191
	4   restore-symbol                      0x0000000101a227ad -[CDObjectiveC2Processor loadClassAtAddress:] + 2813
	5   restore-symbol                      0x0000000101a202ab -[CDObjectiveC2Processor loadClasses] + 244
	6   restore-symbol                      0x0000000101a1d5b6 -[CDObjectiveCProcessor process] + 387
	7   restore-symbol                      0x0000000101a0af38 -[CDClassDump processObjectiveCData] + 344
	8   restore-symbol                      0x0000000101a0035d restore_symbol + 829
	9   restore-symbol                      0x0000000101a082de main + 514
	10  libdyld.dylib                       0x00007fff2063e621 start + 1
	11  ???                                 0x0000000000000004 0x0 + 4
)
libc++abi.dylib: terminating with uncaught exception of type NSException
zsh: abort      ./restore-symbol Snapchat -o Snapchat_with_symbol

根据上面的报错分析，restore-symbol/class-dump/Source/CDObjectiveC2Processor.m:258报错。

解决方案
在github上找class-dump的master上最新的代码，下载后替换掉

/Users/username/Desktop/restoresym/restore-symbol/class-dump/

里面的代码，然后终端重新

make

结果如下

rm -rf libMachObjC.a restore-symbol.dSYM/ build/ class-dump/build/ 
rm -f restore-symbol
git submodule update --init --recursive
xcodebuild -project "restore-symbol.xcodeproj" -target "restore-symbol" -configuration "Release" CONFIGURATION_BUILD_DIR="/Users/username/Desktop/restoresym/restore-symbol" -jobs 4 build
User defaults from command line:
    IDEBuildOperationMaxNumberOfConcurrentCompileTasks = 4

Build settings from command line:
    CONFIGURATION_BUILD_DIR = /Users/username/Desktop/restoresym/restore-symbol

Build Preparation
Build task concurrency set to 4 via user default IDEBuildOperationMaxNumberOfConcurrentCompileTasks

note: Using new build system
note: Planning build
note: Constructing build description
CreateBuildDirectory /Users/username/Desktop/restoresym/restore-symbol/build (in target: restore-symbol)
    cd /Users/username/Desktop/restoresym/restore-symbol
    builtin-create-build-directory /Users/username/Desktop/restoresym/restore-symbol/build

CreateBuildDirectory /Users/username/Desktop/restoresym/restore-symbol/class-dump/build (in target: MachObjC)
    cd /Users/username/Desktop/restoresym/restore-symbol/class-dump
    builtin-create-build-directory /Users/username/Desktop/restoresym/restore-symbol/class-dump/build

WriteAuxiliaryFile /Users/username/Desktop/restoresym/restore-symbol/class-dump/build/class-dump.build/Release/MachObjC.build/all-product-headers.yaml (in target: MachObjC)
    cd /Users/username/Desktop/restoresym/restore-symbol/class-dump
    write-file /Users/username/Desktop/restoresym/restore-symbol/class-dump/build/class-dump.build/Release/MachObjC.build/all-product-headers.yaml

省略

Ld /Users/username/Desktop/restoresym/restore-symbol/restore-symbol normal x86_64 (in target: restore-symbol)
    cd /Users/username/Desktop/restoresym/restore-symbol
    export MACOSX_DEPLOYMENT_TARGET=10.11
    /Users/username/Desktop/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang -arch x86_64 -isysroot /Users/username/Desktop/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.14.sdk -L/Users/username/Desktop/restoresym/restore-symbol -F/Users/username/Desktop/restoresym/restore-symbol -filelist /Users/username/Desktop/restoresym/restore-symbol/build/restore-symbol.build/Release/restore-symbol.build/Objects-normal/x86_64/restore-symbol.LinkFileList -mmacosx-version-min=10.11 -Xlinker -object_path_lto -Xlinker /Users/username/Desktop/restoresym/restore-symbol/build/restore-symbol.build/Release/restore-symbol.build/Objects-normal/x86_64/restore-symbol_lto.o -fobjc-arc -fobjc-link-runtime -all_load -framework Foundation /Users/username/Desktop/restoresym/restore-symbol/libMachObjC.a -Xlinker -dependency_info -Xlinker /Users/username/Desktop/restoresym/restore-symbol/build/restore-symbol.build/Release/restore-symbol.build/Objects-normal/x86_64/restore-symbol_dependency_info.dat -o /Users/username/Desktop/restoresym/restore-symbol/restore-symbol

GenerateDSYMFile /Users/username/Desktop/restoresym/restore-symbol/restore-symbol.dSYM /Users/username/Desktop/restoresym/restore-symbol/restore-symbol (in target: restore-symbol)
    cd /Users/username/Desktop/restoresym/restore-symbol
    /Users/username/Desktop/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/dsymutil /Users/username/Desktop/restoresym/restore-symbol/restore-symbol -o /Users/username/Desktop/restoresym/restore-symbol/restore-symbol.dSYM

CodeSign /Users/username/Desktop/restoresym/restore-symbol/restore-symbol (in target: restore-symbol)
    cd /Users/username/Desktop/restoresym/restore-symbol
    export CODESIGN_ALLOCATE=/Users/username/Desktop/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/codesign_allocate
    
Signing Identity:     "-"

    /usr/bin/codesign --force --sign - --entitlements /Users/username/Desktop/restoresym/restore-symbol/build/restore-symbol.build/Release/restore-symbol.build/restore-symbol.xcent --timestamp=none /Users/username/Desktop/restoresym/restore-symbol/restore-symbol

** BUILD SUCCEEDED **

rm -rf libMachObjC.a restore-symbol.dSYM/ build/ class-dump/build/

8、对APPName.app中的二进制文件APPName进行符号还原，复制二进制文件APPName到restore-symbol目录下，
注意，此时二进制文件添加了可执行权限。

chmod +x APPName

然后执行终端命令如下

./restore-symbol APPName -o APPName_with_symbol

结果成功

=========== Start =============
Scan OC method in mach-o-file.
2021-05-17 14:30:33.764 restore-symbol[3812:74088] Warning: Parsing method types failed, initFromAttributedSticker:originalContent:withStickerSearch:queryParams:
2021-05-17 14:30:33.780 restore-symbol[3812:74088] Warning: Parsing method types failed, convertQueryParams:withQuery:
2021-05-17 14:30:33.780 restore-symbol[3812:74088] Warning: Parsing instance variable type failed, aiTextBuilder
Scan OC method finish.
=========== Finish ============

即在restore-symbol目录中得到了APPName_with_symbol，把APPName_with_symbol复制回APPName.app替换掉原来的APPName可执行文件，在XCode编译时，LLDB调试时可以看到完整的带符号的调试堆栈信息。