iOS越狱开发 常用检测Hook 代码 闪退检测断点

在iOS越狱开发中，常用的Hook检测包括以下几种：

1. 检测当前进程是否被其他进程注入

void anti_injection() {
    char path[1024];
    int ret = proc_pidpath(getpid(), path, sizeof(path));
    if (ret <= 0) {
        NSLog(@"anti_injection: proc_pidpath failed");
        exit(1);
    }
    if (strstr(path, "/Library/MobileSubstrate") != NULL) {
        NSLog(@"anti_injection: MobileSubstrate detected");
        exit(1);
    }
    if (strstr(path, "/Library/Frameworks/CydiaSubstrate.framework") != NULL) {
        NSLog(@"anti_injection: CydiaSubstrate detected");
        exit(1);
    }
}

2. 检测是否被调试

void anti_debugging() {
    int name[4];
    struct kinfo_proc info;
    size_t info_size = sizeof(info);
    name[0] = CTL_KERN;
    name[1] = KERN_PROC;
    name[2] = KERN_PROC_PID;
    name[3] = getpid();
    if (sysctl(name, 4, &info, &info_size, NULL, 0) == -1) {
        NSLog(@"anti_debugging: sysctl failed");
        exit(1);
    }
    if (info.kp_proc.p_flag & P_TRACED) {
        NSLog(@"anti_debugging: traced");
        exit(1);
    }
}

3. 检测是否被hook

void anti_hooking() {
    const char *functionName = "ptrace";
    void *handle = dlopen("/usr/lib/libc.dylib", RTLD_GLOBAL | RTLD_NOW);
    if (handle == NULL) {
        NSLog(@"anti_hooking: dlopen failed");
        exit(1);
    }
    void *ptrace_func = dlsym(handle, functionName);
    if (ptrace_func == NULL) {
        NSLog(@"anti_hooking: dlsym failed");
        exit(1);
    }
    if (ptrace_func != (void *)&ptrace) {
        NSLog(@"anti_hooking: hook detected");
        exit(1);
    }
}

4. 检测是否被注入Cycript等调试工具

void anti_cycript() {
    char *cycript = strstr(getenv("DYLD_INSERT_LIBRARIES"), "cycript");
    if (cycript != NULL) {
        NSLog(@"anti_cycript: cycript detected");
        exit(1);
    }
}

此外，还可以在代码中添加闪退检测断点，当程序发生闪退时就可以打断点进行调试，例如：

void crash_handler(int signal) {
    signal(SIGTRAP, NULL);
    NSLog(@"crash_handler: signal=%d", signal);
    exit(1);
}

void set_crash_handler() {
    signal(SIGTRAP, crash_handler);
}