llvm 编译器高级用法：第三方库插桩

基于静态扫描+运行时trace的方案仍然存在少量瓶颈：

initialize hook不到

部分block hook不到

C++通过寄存器的间接函数调用静态扫描不出来

目前的重排方案能够覆盖到80%～90%的符号，未来我们会尝试编译期插桩等方案来进行100%的符号覆盖，让重排达到最优效果。

/*! @brief 微信Api接口函数类
 *
 * 该类封装了微信终端SDK的所有接口
 */
@interface WXApi : NSObject

/*! @brief WXApi的成员函数，向微信终端程序注册第三方应用。
 *
 * 需要在每次启动第三方应用程序时调用。
 * @attention 请保证在主线程中调用此函数
 * @param appid 微信开发者ID
 * @param universalLink 微信开发者Universal Link
 * @return 成功返回YES，失败返回NO。
 */
+ (BOOL)registerApp:(NSString *)appid universalLink:(NSString *)universalLink;

@end

@import Darwin;
int main(int argc, char * argv[]) {
  // 调用微信SDK
    [WXApi registerApp:@"App" universalLink:@"link"];
    return 0;
}

// 提供回调函数
void __sanitizer_cov_trace_pc_guard(uint32_t *guard) {
    Dl_info info;
  // 获取当前函数的返回地址 
)
    void *PC = __builtin_return_address(0);
   // 根据返回地址，获取相关的信息 
    dladdr(PC, &info);
   // 打印与 PC 最近的符号名称
    printf("guard:%p 开始执行:%s \n", PC, info.dli_sname);
}

void foo(int *a) {
  if (a)
    *a = 0;
}

// 文件 A
int f(void) __attribute__((constructor));

int f(void) {
    NSLog(@" int f() __attribute__((constructor)) 被调用");
    return 0;
}

// 文件 ViewController.mm
#import <string>

static std::string cxx_static_str("cxx_static_str");

+ (void)load {
    NSLog(@"load 被执行");
}

// 文件 main.m
@import Darwin;

void __sanitizer_cov_trace_pc_guard_init(uint32_t *start,
                                         uint32_t *stop) {
    static uint32_t N;  // Counter for the guards.
    if (start == stop || *start) return;  // Initialize only once.
    printf("INIT: %p %p\n", start, stop);
    for (uint32_t *x = start; x < stop; x++)
    *x = ++N;
}

void __sanitizer_cov_trace_pc_guard(uint32_t *guard) {
    Dl_info info;
    
    void *PC = __builtin_return_address(0);
    dladdr(PC, &info);
    printf("guard:%p 开始执行:%s \n", PC, info.dli_sname);
}

void foo(int *a) {
    if (a)
        *a = 0;
}


int main(int argc, char * argv[]) {
    dispatch_async(dispatch_get_main_queue(), ^{
        NSLog(@"main block");
    });
    int i=0;
    foo(&i);
    
    NSString * appDelegateClassName;
    @autoreleasepool {
        // Setup code that might create autoreleased objects goes here.
        appDelegateClassName = NSStringFromClass([AppDelegate class]);
    }
    return UIApplicationMain(argc, argv, nil, appDelegateClassName);
}

cat <<EOF > main.m
int main() {
  return 0;
}
EOF

xcrun clang main.m -save-temps -v -mllvm -debug-pass=Structure -fsanitize-coverage=trace-pc-guard

clang -cc1 -E --fsanitize-coverage-type=3 -fsanitize-coverage-trace-pc-guard main.mi -x objective-c main.m

clang -cc1 -emit-llvm-bc -disable-llvm-passes -fsanitize-coverage-type=3 -fsanitize-coverage-trace-pc-guard -o main.bc -x objective-c-cpp-output main.mi

clang -cc1 -S -fsanitize-coverage-type=3 -fsanitize-coverage-trace-pc-guard -o main.s -x ir main.bc

clang -cc1as -o main.o main.s

ld -o a.out -L/usr/local/lib main.o

; ModuleID = 'main.bc'
source_filename = "~/main.m"
target datalayout = "e-m:o-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-apple-macosx10.15.0"

; Function Attrs: noinline nounwind optnone ssp uwtable
define i32 @main() #0 {
  %1 = alloca i32, align 4
  store i32 0, i32* %1, align 4
  ret i32 0
}

attributes #0 = { noinline nounwind optnone ssp uwtable "correctly-rounded-divide-sqrt-fp-math"="false" "darwin-stkchk-strong-link" "disable-tail-calls"="false" "frame-pointer"="all" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "probe-stack"="___chkstk_darwin" "stack-protector-buffer-size"="8" "target-cpu"="penryn" "target-features"="+cx16,+cx8,+fxsr,+mmx,+sahf,+sse,+sse2,+sse3,+sse4.1,+ssse3,+x87" "unsafe-fp-math"="false" "use-soft-float"="false" }

!llvm.module.flags = !{!0, !1, !2, !3, !4, !5, !6, !7}
!llvm.ident = !{!8}

!0 = !{i32 2, !"SDK Version", [3 x i32] [i32 10, i32 15, i32 6]}
!1 = !{i32 1, !"Objective-C Version", i32 2}
!2 = !{i32 1, !"Objective-C Image Info Version", i32 0}
!3 = !{i32 1, !"Objective-C Image Info Section", !"__DATA,__objc_imageinfo,regular,no_dead_strip"}
!4 = !{i32 1, !"Objective-C Garbage Collection", i8 0}
!5 = !{i32 1, !"Objective-C Class Properties", i32 64}
!6 = !{i32 1, !"wchar_size", i32 4}
!7 = !{i32 7, !"PIC Level", i32 2}
!8 = !{!"Apple clang version 12.0.0 (clang-1200.0.32.21)"}

	.section	__TEXT,__text,regular,pure_instructions
	.build_version macos, 10, 15	sdk_version 10, 15, 6
	.globl	_main                   ## -- Begin function main
	.p2align	4, 0x90
_main:                                  ## @main
	.cfi_startproc
## %bb.0:
	pushq	%rbp
	.cfi_def_cfa_offset 16
	.cfi_offset %rbp, -16
	movq	%rsp, %rbp
	.cfi_def_cfa_register %rbp
	subq	$16, %rsp
	leaq	l___sancov_gen_(%rip), %rdi
	callq	___sanitizer_cov_trace_pc_guard
	## InlineAsm Start
	## InlineAsm End
	xorl	%eax, %eax
	movl	$0, -4(%rbp)
	addq	$16, %rsp
	popq	%rbp
	retq
	.cfi_endproc
                                        ## -- End function
	.p2align	4, 0x90         ## -- Begin function sancov.module_ctor_trace_pc_guard
_sancov.module_ctor_trace_pc_guard:     ## @sancov.module_ctor_trace_pc_guard
	.cfi_startproc
## %bb.0:
	pushq	%rax
	.cfi_def_cfa_offset 16
	leaq	section$start$__DATA$__sancov_guards(%rip), %rax
	leaq	section$end$__DATA$__sancov_guards(%rip), %rcx
	movq	%rax, %rdi
	movq	%rcx, %rsi
	callq	___sanitizer_cov_trace_pc_guard_init
	popq	%rax
	retq
	.cfi_endproc
                                        ## -- End function
	.section	__DATA,__sancov_guards
	.p2align	2               ## @__sancov_gen_
l___sancov_gen_:
	.space	4

	.section	__DATA,__mod_init_func,mod_init_funcs
	.p2align	3
	.quad	_sancov.module_ctor_trace_pc_guard
	.no_dead_strip	l___sancov_gen_
	.section	__DATA,__objc_imageinfo,regular,no_dead_strip
L_OBJC_IMAGE_INFO:
	.long	0
	.long	64

.subsections_via_symbols

file ~/Downloads/OpenSDK1.8.7.1/libWeChatSDK.a

~/Downloads/OpenSDK1.8.7.1/libWeChatSDK.a: Mach-O universal binary with 4 architectures: [i386:current ar archive] [arm_v7] [x86_64] [arm64]
~/Downloads/OpenSDK1.8.7.1/libWeChatSDK.a (for architecture i386): current ar archive
~/Downloads/OpenSDK1.8.7.1/libWeChatSDK.a (for architecture armv7): current ar archive
~/Downloads/OpenSDK1.8.7.1/libWeChatSDK.a (for architecture x86_64): current ar archive
~/Downloads/OpenSDK1.8.7.1/libWeChatSDK.a (for architecture arm64): current ar archive

lipo -thin armv7 ~/Downloads/OpenSDK1.8.7.1/libWeChatSDK.a -o ~/Downloads/OpenSDK1.8.7.1/libWeChatSDK_armv7.a

file -b ~/Downloads/OpenSDK1.8.7.1/libWeChatSDK_armv7.a

current ar archive

tar -xf ~/Downloads/OpenSDK1.8.7.1/libWeChatSDK_armv7.a

tree
.
├── AppCommunicate.o
├── AppCommunicateData.o
├── WXApi+ExtraUrl.o
├── WXApi+HandleOpenUrl.o
├── WXApi.o
├── WXApiObject.o
├── WXLogUtil.o
├── WapAuthHandler.o
├── WeChatApiUtil.o
├── WeChatIdentityHandler.o
├── WechatAuthSDK.o
└── base64.o

0 directories, 12 files

file -b AppCommunicate.o

Mach-O object arm_v7

segedit AppCommunicate.o -extract __LLVM __bitcode .AppCommunicate.bc

xcrun clang -O1 -target armv7-apple-ios7 -S AppCommunicate.bc -o AppCommunicate.s -fsanitize-coverage=trace-pc-guard -isysroot /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS14.1.sdk

Ltmp0:
	.loc	9 16 0 prologue_end     ; AppCommunicate/AppCommunicate.m:16:0
Lloh0:
	adrp	x0, l___sancov_gen_@PAGE
Ltmp1:
	;DEBUG_VALUE: +[AppCommunicate getDataPasteboardName]:self <- [DW_OP_LLVM_entry_value 1] $x0
Lloh1:
	add	x0, x0, l___sancov_gen_@PAGEOFF
	bl	___sanitizer_cov_trace_pc_guard
Ltmp2:
	;DEBUG_VALUE: +[AppCommunicate getDataPasteboardName]:_cmd <- [DW_OP_LLVM_entry_value 1] $x1