![](https://csdnimg.cn/release/download_crawler_static/86320708/bg8.jpg)
Xcode 非官方版本恶意代码污染事件(XcodeGhost)的分析与综述
©安天版权所有,欢迎无损转载 第 5 页
Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/Library/Fram
eworks/CoreServices.framework/CoreService
Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/Library/Priva
teFrameworks/IDEBundleInjection.framework
针对 Mac OS X
Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/Library/Frameworks
/CoreServices.framework/CoreService
Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/Library/PrivateFram
eworks/IDEBundleInjection.framework
以及修改了配置文件:
Xcode.app/Contents/PlugIns/Xcode3Core.ideplugin/Contents/SharedSupport/Developer/Library/Xcode/P
lug-ins/CoreBuildTasks.xcplugin/Contents/Resources/Ld.xcspec
2. 恶意插件植入 App 方式
被攻击的开发环节:编译 App 项目部分;
恶意代码植入机理:通过修改 Xcode 配置文件,导致编译 Linking 时程序强制加载恶意库文件;
修改的配置文件:
Xcode.app/Contents/PlugIns/Xcode3Core.ideplugin/Contents/SharedSupport/Developer/Library/Xcode/P
lug-ins/CoreBuildTasks.xcplugin/Contents/Resources/Ld.xcspec
添加的语句:“-force_load $(PLATFORM_DEVELOPER_SDK_DIR)/Library/Frameworks/CoreService
s.framework/CoreService”
图 2-3 受感染 Xcode 与官方版本配置文件对比
2.1.2.2 恶意代码运行时间
恶意代码植入位置:UIWindow (didFinishLaunchingWithOptions);
恶意代码启动时间:App 启动后,开启准备展示第一个页面时恶意代码已经执行了;