dylibx

README

dylibx

一键扫描查找可注入&劫持Dylib的应用程序。

安装

• Go Install

go install github.com/ac0d3r/dylibx/cmd/dylibx@latest

• Github Release

前往 releases 下载合适的版本然后从命令行运行即可。

用法

一键开扫：

$ ./dylibx
...

Documentation

Index

• Constants
• type AppInfo
• type AppVulnerable
• type Dylib
• type Dylibx
  • func (d *Dylibx) AutoScanApps() ([]*AppVulnerable, error)
  • func (d *Dylibx) Exist(path string) bool
  • func (d *Dylibx) GetExecutablePath(app string) (string, error)
  • func (d *Dylibx) InSIPPath(path string) bool
  • func (d *Dylibx) IsLibraryValidation(f uint32) bool
  • func (d *Dylibx) IsRuntime(f uint32) bool
  • func (d *Dylibx) ParseProxyPath(path string, ExePath string) string
  • func (d *Dylibx) ParseRPaths(rpath []string, ExePath string)
  • func (d *Dylibx) ScanApp(path_ string) (*AppVulnerable, error)
• type Entitlements
• type FatMachOInfo
  • func ParseMacho(path string) (FatMachOInfo, error)
• type MachOInfo
• type VulnItem

Constants

const (
	REQUIRE_LV = 0x2000
	RUNTIME    = 0x10000
)

const (
	RPathPre          = "@rpath"
	ExecutablePathPre = "@executable_path"
	LoaderPathPre     = "@loader_path"
)

rpath

Types

type AppInfo

type AppInfo struct {
	CFBundleExecutable string `plist:"CFBundleExecutable"`
}

type AppVulnerable

type AppVulnerable struct {
	AppPath                       string
	ExecutablePath                string
	CodeSignFlags                 string
	DisableLibraryValidation      bool
	AllowDyldEnvironmentVariables bool
	Injectable                    bool
	Dylibs                        []VulnItem
}

type Dylib

type Dylib struct {
	Name           string
	Time           uint32
	CurrentVersion string
	CompatVersion  string
}

type Dylibx

type Dylibx struct {
}

func (*Dylibx) AutoScanApps

func (d *Dylibx) AutoScanApps() ([]*AppVulnerable, error)

func (*Dylibx) Exist

func (d *Dylibx) Exist(path string) bool

func (*Dylibx) GetExecutablePath

func (d *Dylibx) GetExecutablePath(app string) (string, error)

func (*Dylibx) InSIPPath

func (d *Dylibx) InSIPPath(path string) bool

func (*Dylibx) IsLibraryValidation

func (d *Dylibx) IsLibraryValidation(f uint32) bool

func (*Dylibx) IsRuntime

func (d *Dylibx) IsRuntime(f uint32) bool

func (*Dylibx) ParseProxyPath

func (d *Dylibx) ParseProxyPath(path string, ExePath string) string

func (*Dylibx) ParseRPaths

func (d *Dylibx) ParseRPaths(rpath []string, ExePath string)

func (*Dylibx) ScanApp

func (d *Dylibx) ScanApp(path_ string) (*AppVulnerable, error)

type Entitlements

type Entitlements struct {
	DisableLibraryValidation      bool `plist:"com.apple.security.cs.disable-library-validation"`
	AllowDyldEnvironmentVariables bool `plist:"com.apple.security.cs.allow-dyld-environment-variables"`
}

type FatMachOInfo

type FatMachOInfo []*MachOInfo

func ParseMacho

func ParseMacho(path string) (FatMachOInfo, error)

type MachOInfo

type MachOInfo struct {
	Magic types.Magic
	CPU   types.CPU
	Type  types.HeaderFileType

	LoadDylinker   string
	LcRpaths       []string
	DylibLoads     []Dylib
	WeakDylibLoads []Dylib

	CodeSignFlags        uint32
	CodeSignEntitlements Entitlements
}

type VulnItem

type VulnItem struct {
	Type string
	Path string
}