Fix Darwin symbolicator cache invalidator logic #768
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There are 2 problems with the existing logic:
brk
/int3
) instruction at the beginning of thenotification_address
returned byall_image_infos
. That's a function which the cache invalidator hooks withInterceptor
in order to trigger when any libraries are loaded or unloaded at runtime. The problem with this approach is that in this wayInterceptor
relocates the breakpoint instruction, so when it gets executed Xcode can't match it with the address it expected, resulting into an uncaught exception crashing the app.Interceptor
can't work on system code (like the Gadget withrequired
code-signing) the symbolicator cache is never invalidatedTo overcome these problems what this change proposes is:
_dyld_register_func_for_add_image
/_dyld_register_func_for_remove_image
whenTeardownRequirement
isMINIMAL
(because there's no good way to unregister those handlers, so it's safe only if frida-gum knows it will never be unloaded)Interceptor
, but on the instruction following the breakpoint if presentIn order to do so, though, other 2 changes are present in this MR:
disassemble_instruction_at ()
in arm64-reader, so we can use it to check the breakpoint instruction presenceTeardownRequirement
setting from the Gadget library to Gum's Process (following the same semantics as the codesign setting), so Gum can make better decisions taking into account its own promised lifetime like in this casefrida/frida-core#498 depends on this