#import <dlfcn.h>  
#import <UIKit/UIKit.h>  
#import "AppDelegate.h"  
#import "fishhook.h"  

static int (*orig_close)(int);  
static int (*orig_open)(const char *, int, ...);  

int my_close(int fd) {  
  printf("Calling real close(%d)\n", fd);  
  return orig_close(fd);  
}  

int my_open(const char *path, int oflag, ...) {  
  va_list ap = {0};  
  mode_t mode = 0;  

  if ((oflag & O_CREAT) != 0) {  
    // mode only applies to O_CREAT  
    va_start(ap, oflag);  
    mode = va_arg(ap, int);  
    va_end(ap);  
    printf("Calling real open('%s', %d, %d)\n", path, oflag, mode);  
    return orig_open(path, oflag, mode);  
  } else {  
    printf("Calling real open('%s', %d)\n", path, oflag);  
    return orig_open(path, oflag, mode);  
  }  
}  

int main(int argc, char * argv[])  
{  
  @autoreleasepool {  
    rebind_symbols((struct rebinding[2]){{"close", my_close, (void *)&orig_close}, {"open", my_open, (void *)&orig_open}}, 2);  

    // Open our own binary and print out first 4 bytes (which is the same  
    // for all Mach-O binaries on a given architecture)  
    int fd = open(argv[0], O_RDONLY);  
    uint32_t magic_number = 0;  
    read(fd, &magic_number, 4);  
    printf("Mach-O Magic Number: %x \n", magic_number);  
    close(fd);  

    return UIApplicationMain(argc, argv, nil, NSStringFromClass([AppDelegate class]));  
  }  
}

#include "fishhook.h"  
#include <dlfcn.h>  
#include <stdbool.h>  
#include <stdlib.h>  
#include <string.h>  
#include <sys/mman.h>  
#include <sys/types.h>  
#include <mach/mach.h>  
#include <mach/vm_map.h>  
#include <mach/vm_region.h>  
#include <mach-o/dyld.h>  
#include <mach-o/loader.h>  
#include <mach-o/nlist.h>  

#ifdef __LP64__  
typedef struct mach_header_64 mach_header_t;  
typedef struct segment_command_64 segment_command_t;  
typedef struct section_64 section_t;  
typedef struct nlist_64 nlist_t;  
#define LC_SEGMENT_ARCH_DEPENDENT LC_SEGMENT_64  
#else  
typedef struct mach_header mach_header_t;  
typedef struct segment_command segment_command_t;  
typedef struct section section_t;  
typedef struct nlist nlist_t;  
#define LC_SEGMENT_ARCH_DEPENDENT LC_SEGMENT  
#endif  

#ifndef SEG_DATA_CONST  
#define SEG_DATA_CONST  "__DATA_CONST"  
#endif  

//存放重新绑定的信息的链表，这个链表是rebindings_entry类型的  
static struct rebindings_entry *_rebindings_head;  
struct rebindings_entry {  
  //要重新绑定的rebinding的结构体  
  struct rebinding *rebindings;  
  //rebinding结构体的数量也就是需要重新绑定的函数的数量  
  size_t rebindings_nel;  
  //next指针  
  struct rebindings_entry *next;  
};  

static int prepend_rebindings(struct rebindings_entry **rebindings_head,  
                              struct rebinding rebindings[],  
                              size_t nel) {  
  //调用malloc函数开辟链表空间  
  struct rebindings_entry *new_entry = (struct rebindings_entry *) malloc(sizeof(struct rebindings_entry));  
  //如果链表创建失败就返回-1  
  if (!new_entry) {  
    return -1;  
  }  
  //申请rebinding这个结构体大小乘nel大小的空间  
  new_entry->rebindings = (struct rebinding *) malloc(sizeof(struct rebinding) * nel);  
  //判断rebindings结构体有没有申请空间成功，如果失败了就释放，返回-1  
  if (!new_entry->rebindings) {  
    free(new_entry);  
    return -1;  
  }  

  //memcpy指的是c和c++使用的内存拷贝函数，memcpy函数的功能是从源src所指的内存地址的起始位置开始拷贝n个字节到目标dest所指的内存地址的起始位置中。  
  memcpy(new_entry->rebindings, rebindings, sizeof(struct rebinding) * nel);  
  //设置所含的rebinding结构体的数量  
  new_entry->rebindings_nel = nel;  
  //由于是往链表的头节点插入，所以这里设置new_entry->next为rebindings_head  
  new_entry->next = *rebindings_head;  
  *rebindings_head = new_entry;  
  return 0;  
}  

static vm_prot_t get_protection(void *sectionStart) {  
  mach_port_t task = mach_task_self();  
  vm_size_t size = 0;  
  vm_address_t address = (vm_address_t)sectionStart;  
  memory_object_name_t object;  
#if __LP64__  
  mach_msg_type_number_t count = VM_REGION_BASIC_INFO_COUNT_64;  
  vm_region_basic_info_data_64_t info;  
  kern_return_t info_ret = vm_region_64(  
      task, &address, &size, VM_REGION_BASIC_INFO_64, (vm_region_info_64_t)&info, &count, &object);  
#else  
  mach_msg_type_number_t count = VM_REGION_BASIC_INFO_COUNT;  
  vm_region_basic_info_data_t info;  
  kern_return_t info_ret = vm_region(task, &address, &size, VM_REGION_BASIC_INFO, (vm_region_info_t)&info, &count, &object);  
#endif  
  if (info_ret == KERN_SUCCESS) {  
    return info.protection;  
  } else {  
    return VM_PROT_READ;  
  }  
}  

static void perform_rebinding_with_section(struct rebindings_entry *rebindings,  
                                            section_t *section,  
                                            intptr_t slide,  
                                            nlist_t *symtab,  
                                            char *strtab,  
                                            uint32_t *indirect_symtab) {  
    //typedef struct section_64 section_t;  
    /*  
      struct section_64  
      {  
      char sectname[16];  
      char segname[16];  
      uint64_t addr;  
      uint64_t size;  
      uint32_t offset;  
      uint32_t align;  
      uint32_t reloff;  
      uint32_t nreloc;  
      uint32_t flags;  
      uint32_t reserved1;  
      uint32_t reserved2;  
      };  
      */  
    //对于 symbol pointer sections 和 stubs sections 来说，reserved1 表示 indirect table 数组的 index。用来索引 section's entries. stubs sections在__TEXT段的section  

    //nl_symbol_ptr和la_symbol_ptrsection中的reserved1字段指明对应的indirect symbol table起始的index  
    uint32_t *indirect_symbol_indices = indirect_symtab + section->reserved1;  
    //slide+section->addr 就是符号对应的存放函数实现的数组也就是我相应的__nl_symbol_ptr和__la_symbol_ptr相应的函数指针都在这里面了，所以可以去寻找到函数的地址  
    void **indirect_symbol_bindings = (void **)((uintptr_t)slide + section->addr);  
    vm_prot_t oldProtection = VM_PROT_READ;  
    if (isDataConst) {  
        oldProtection = get_protection(rebindings);  
        mprotect(indirect_symbol_bindings, section->size, PROT_READ | PROT_WRITE);  
    }  
    //遍历section里面的每一个符号  
    for (uint i = 0; i < section->size / sizeof(void *); i++)  
    {  
        //找到符号在Indrect Symbol Table表中的值  
        //读取indirect table中的数据  
        uint32_t symtab_index = indirect_symbol_indices[i];  

        if (symtab_index == INDIRECT_SYMBOL_ABS || symtab_index == INDIRECT_SYMBOL_LOCAL ||  
            symtab_index == (INDIRECT_SYMBOL_LOCAL   | INDIRECT_SYMBOL_ABS)) {  
            continue;  
        }  
        //以symtab_index作为下标，访问symbol table  
        uint32_t strtab_offset = symtab[symtab_index].n_un.n_strx;  

        //获取到symbol_name  
        char *symbol_name = strtab + strtab_offset;  

        //判断是否函数的名称是否有两个字符，为啥是两个，因为函数前面有个_，所以方法的名称最少要1个  
        bool symbol_name_longer_than_1 = symbol_name[0] && symbol_name[1];  

        //遍历最初的链表，来进行hook  
        struct rebindings_entry *cur = rebindings;  

        while (cur) {  

            for (uint j = 0; j < cur->rebindings_nel; j++) {  

                //这里if的条件就是判断从symbol_name[1]两个函数的名字是否都是一致的，以及判断两个  
                if (symbol_name_longer_than_1 &&  
                    strcmp(&symbol_name[1], cur->rebindings[j].name) == 0)  
                {  

                    //判断replaced的地址不为NULL以及我方法的实现和rebindings[j].replacement的方法不一致  
                    if (cur->rebindings[j].replaced != NULL &&  
                        indirect_symbol_bindings[i] != cur->rebindings[j].replacement)  
                    {  
                        //让rebindings[j].replaced保存indirect_symbol_bindings[i]的函数地址  
                        *(cur->rebindings[j].replaced) = indirect_symbol_bindings[i];  
                    }  
                    //将替换后的方法给原先的方法，也就是替换内容为自定义函数地址  
                    indirect_symbol_bindings[i] = cur->rebindings[j].replacement;  
                    goto symbol_loop;  
                }  
            }  
            cur = cur->next;  
        }  
    symbol_loop:;  
    }  
}  

//完成动态库的binding之后，会回调这个函数。其中slide跟ALSR(Address space layout randomization)有关系，是一个随机的加载地址。  
static void rebind_symbols_for_image(struct rebindings_entry *rebindings,  
                                      const struct mach_header *header,  
                                      intptr_t slide) {  

    Dl_info info;  
    /*dladdr() 可确定指定的address 是否位于构成进程的进址空间的其中一个加载模块（可执行库或共享库）内，如果某个地址位于在其上面映射加载模块的基址和为该加载模块映射的最高虚拟地址之间（包括两端），  
则认为该地址在加载模块的范围内。如果某个加载模块符合这个条件，则会搜索其动态符号表，以查找与指定的address 最接近的符号。最接近的符号是指其值等于，或最为接近但小于指定的address 的符号。  
      */  
    /*  
      如果指定的address 不在其中一个加载模块的范围内，则返回0 ；且不修改Dl_info 结构的内容。否则，将返回一个非零值，同时设置Dl_info 结构的字段。  
      如果在包含address 的加载模块内，找不到其值小于或等于address 的符号，则dli_sname 、dli_saddr 和dli_size字段将设置为0 ；dli_bind 字段设置为STB_LOCAL ， dli_type 字段设置为STT_NOTYPE 。  
      */  
    //获取某个地址的符号信息  
    if (dladdr(header, &info) == 0) {  
        return;  
    }  

    segment_command_t *cur_seg_cmd;  
    segment_command_t *linkedit_segment = NULL;  
    struct symtab_command* symtab_cmd = NULL;  
    struct dysymtab_command* dysymtab_cmd = NULL;  

    //要去寻找load command，所以这里跳过sizeof(mach_header_t)大小  
    // 初始化游标  
        // header = 0x100000000 - 二进制文件基址默认偏移  
        // sizeof(mach_header_t) = 0x20 - Mach-O Header 部分  
        // 首先需要跳过 Mach-O Header  
      uintptr_t cur = (uintptr_t)header + sizeof(mach_header_t);  
    // 遍历每一个 Load Command，游标每一次偏移每个命令的 Command Size 大小  
        // header -> ncmds: Load Command 加载命令数量  
        // cur_seg_cmd -> cmdsize: Load 大小  
      for (uint i = 0; i < header->ncmds; i++, cur += cur_seg_cmd->cmdsize) {  
          // 取出当前的 Load Command  
        cur_seg_cmd = (segment_command_t *)cur;  

        //找到__LINKEDIT段，LC_SEGMENT_64是个宏定义代表的是，LC_SEGMENT_64  
        //__LINKEDIT段 含有为动态链接库使用的原始数据，比如符号，字符串，重定位表条目等等  
          /*  
            LC_SYMTAB这个LoadCommand主要提供了两个信息  
            Symbol Table的偏移量与Symbol Table中元素的个数  
            String Table的偏移量与String Table的长度  
            LC_DYSYMTAB  
            提供了动态符号表的位移和元素个数，还有一些其他的表格索引  
            LC_SEGMENT.__LINKEDIT  
            含有为动态链接库使用的原始数据  
            */  
          // Load Command 的类型是 LC_SEGMEN  
        if (cur_seg_cmd->cmd == LC_SEGMENT_ARCH_DEPENDENT) {  
            // 比对一下 Load Command 的 name 是否为 __LINKEDIT  
          if (strcmp(cur_seg_cmd->segname, SEG_LINKEDIT) == 0) {  
              // 检索到 __LINKEDIT  
            linkedit_segment = cur_seg_cmd;  
          }  
            // 判断当前 Load Command 是否是 LC_SYMTAB 类型  
            // LC_SEGMENT - 代表当前区域链接器信息  
        } else if (cur_seg_cmd->cmd == LC_SYMTAB) {  
          //遍历寻找lc_symtab 符号表  
            // 检索到 LC_SYMTAB  
          symtab_cmd = (struct symtab_command*)cur_seg_cmd;  
        }  
          // 判断当前 Load Command 是否是 LC_DYSYMTAB 类型  
                  // LC_DYSYMTAB - 代表动态链接器信息区域  
        else if (cur_seg_cmd->cmd == LC_DYSYMTAB) {  
            //遍历寻找lc_dysymtab 动态符号表  
          dysymtab_cmd = (struct dysymtab_command*)cur_seg_cmd;  
        }  
      }  
        //如果下面有一项为空就直接返回---容错处理  
      if (!symtab_cmd || !dysymtab_cmd || !linkedit_segment ||  
          !dysymtab_cmd->nindirectsyms) {  
        return;  
      }  

      // Find base symbol/string table addresses  
      //链接时程序的基址 = __LINKEDIT.VM_Address -__LINKEDIT.File_Offset + silde的改变值ASLR：Address space layout randomization，将可执行程序随机装载到内存中,这里的随机只是偏移，而不是打乱，具体做法就是通过内核将 Mach-O的段“平移”某个随机系数。slide 正是ASLR引入的偏移，也就是说程序的基址等于__LINKEDIT的地址减去偏移量，然后再加上ASLR造成的偏移  

      uintptr_t linkedit_base = (uintptr_t)slide + linkedit_segment->vmaddr - linkedit_segment->fileoff;  

        //符号表的地址 = 基址 + 符号表偏移量  
    // 通过 base + symtab 的偏移量 计算 symtab 表的首地址，并获取 nlist_t 结构体实例  
      nlist_t *symtab = (nlist_t *)(linkedit_base + symtab_cmd->symoff);  
        //字符串表的地址 = 基址 + 字符串表偏移量  
    // 通过 base + stroff 字符表偏移量计算字符表中的首地址，获取字符串表  
      char *strtab = (char *)(linkedit_base + symtab_cmd->stroff);  

      // Get indirect symbol table (array of uint32_t indices into symbol table)  
      //动态符号表地址 = 基址 + 动态符号表偏移量  
    // 通过 base + indirectsymoff 偏移量来计算动态符号表的首地址  
      uint32_t *indirect_symtab = (uint32_t *)(linkedit_base + dysymtab_cmd->indirectsymoff);  

      //重新回到跳过header头大小的位置  
      cur = (uintptr_t)header + sizeof(mach_header_t);  
      //再次遍历 Load Commands  
      for (uint i = 0; i < header->ncmds; i++, cur += cur_seg_cmd->cmdsize) {  
        cur_seg_cmd = (segment_command_t *)cur;  
          //先判断command的描述  
        if (cur_seg_cmd->cmd == LC_SEGMENT_ARCH_DEPENDENT) {  

            //寻找__DATA和__DATA_CONST的section  
          if (strcmp(cur_seg_cmd->segname, SEG_DATA) != 0 &&  
              strcmp(cur_seg_cmd->segname, SEG_DATA_CONST) != 0) {  
            continue;  
          }  
          //标示了Segment中有多少secetion  
          for (uint j = 0; j < cur_seg_cmd->nsects; j++) {  

              //算上偏移-取出 Section  
            section_t *sect =  
              (section_t *)(cur + sizeof(segment_command_t)) + j;  
              //寻找__la_symbol_ptr区  
              // flags & SECTION_TYPE 通过 SECTION_TYPE 掩码获取 flags 记录类型的 8 bit  
              // 如果 section 的类型为 S_LAZY_SYMBOL_POINTERS  
              // 这个类型代表 lazy symbol 指针 Section  
            if ((sect->flags & SECTION_TYPE) == S_LAZY_SYMBOL_POINTERS) {  
                // 进行 rebinding 重写操作  
              perform_rebinding_with_section(rebindings, sect, slide, symtab, strtab, indirect_symtab);  
            }  
              //寻找__nl_symbol_ptr // 这个类型代表 non-lazy symbol 指针 Section  
            if ((sect->flags & SECTION_TYPE) == S_NON_LAZY_SYMBOL_POINTERS) {  
              perform_rebinding_with_section(rebindings, sect, slide, symtab, strtab, indirect_symtab);  
            }  
          }  
        }  
      }  
}  

//此函数内部调用了rebind_symbols_for_image  
//参数1：mach_header的地址，参数2:slide 随机偏移量  
//由于ASLR的缘故，导致程序实际虚拟内存地址与对应的MachO结构中的地址不一致，有一个偏移量 slide，slide是程序装在时随机生成的随机数。  
static void _rebind_symbols_for_image(const struct mach_header *header,  
                                      intptr_t slide) {  
    //这里就是调用rebind_symbols_for_image方法  
    rebind_symbols_for_image(_rebindings_head, header, slide);  
}  

int rebind_symbols_image(void *header,  
                          intptr_t slide,  
                          struct rebinding rebindings[],  
                          size_t rebindings_nel) {  
    struct rebindings_entry *rebindings_head = NULL;  
    int retval = prepend_rebindings(&rebindings_head, rebindings, rebindings_nel);  
    rebind_symbols_for_image(rebindings_head, (const struct mach_header *) header, slide);  
    if (rebindings_head) {  
      free(rebindings_head->rebindings);  
    }  
    free(rebindings_head);  
    return retval;  
}  

int rebind_symbols(struct rebinding rebindings[], size_t rebindings_nel) {  
    //调用prepend_rebindings的函数会将整个 rebindings 数组添加到 _rebindings_head 这个链表的头部  
  int retval = prepend_rebindings(&_rebindings_head, rebindings, rebindings_nel);  
    //根据上面的prepend_rebinding来做判断，如果小于0的话，直接返回一个错误码回去  
  if (retval < 0) {  
    return retval;  
  }  
    //Fishhook采用链表的方式来存储每一次调用rebind_symbols传入的参数，每次调用，就会在链表的头部插入一个节点  
    //链表的头部是：_rebindings_head 根据_rebindings_head->next是否为空来判断是否是第一次调用rebind_symbols方法  
  if (!_rebindings_head->next) {  
    //fishhook利用了_dyld_register_func_for_add_image在动态库加载完成之后，做一次符号地址的替换。  
    //调用_dyld_register_func_for_add_image注册监听方法后，当前已经装载的image(动态库等)会立刻触发回调，之后的image会在装载的时候触发回调。  
    //dyld在装载的时候，会对符号进行bind，而fishhook则会在回调函数中进行rebind。启动的时候做函数替换，注册image装载的监听方法，当dyld链接符号时，调用此回调函数  
    _dyld_register_func_for_add_image(_rebind_symbols_for_image);  
  } else {  
      //遍历已经加载的image，进行的hook  
    uint32_t c = _dyld_image_count();  
    for (uint32_t i = 0; i < c; i++) {  
      _rebind_symbols_for_image(_dyld_get_image_header(i), _dyld_get_image_vmaddr_slide(i));  
    }  
  }  
  return retval;  
}

// rebinding 结构体的定义  
//    struct rebinding {  
//        const char *name; // 需要 HOOK 的函数名称，字符串  
//        void *replacement; // 替换的新函数（函数指针，也就是函数名称）  
//        void **replaced; //  保存原始函数指针变量/地址的指针(它是一个二级指针!)  
//    };  
// C 语言传参是值/址传递的，把它的值/址穿过去，就可以在函数内部修改函数指针变量的值  

- (void)viewDidLoad {  
    [super viewDidLoad];  
      NSLog(@"123");  
    //rebinding结构体  
    struct rebinding nslog;  
    nslog.name = "NSLog";// 函数名称  
    nslog.replacement = myNslog; // 新的函数指针  
    nslog.replaced = (void *)&sys_nslog;// 保存原始函数地址的变量的指针  
    //rebinding结构体数组  
    struct rebinding rebs[1] = {nslog};  
    /**  
      * 存放rebinding结构体的数组  
      * 数组的长度  
      */  
    rebind_symbols(rebs, 1);  
}  
//---------------------------------更改NSLog-----------  
//函数指针，用来保存原始的函数地址 (C 语言语法，函数指针类型变量)  
static void(*sys_nslog)(NSString * format,...);  
//定义一个新的函数  
void myNslog(NSString * format,...){  
    format = [format stringByAppendingString:@"勾上了！\n"];  
    //调用原始的  
    sys_nslog(format);  
}  

-(void)touchesBegan:(NSSet<UITouch *> *)touches withEvent:(UIEvent *)event  
{  
    NSLog(@"点击了屏幕！！");  
}