To restore the symbol table, we first need to know what the symbol table is and how it exists in a Mach-o file.

The Symbol Table is stored in the mach-o file’s __LINKEDIT section, which refers to the Symbol Table and the String Table.

Here we use MachOView to open the Alipay executable and find the Symbol Table item.

The structure of a symbol table is a sequential list, each of which is a struct nList.

// uint32_t n_strx; // uint32_t n_strx; // uint32_t n_strx; } n_un; uint8_t n_type; uint8_t n_sect; int16_t n_desc; // Uint32_t n_value; // Uint32_t n_value; };Copy the code

The focus here is on the first and last entries, the first being the offset of the symbol name in the string table, which is used to represent the function name, and the last being the symbol’s address in memory, which is similar to a function pointer (this is just the general structure, see the official Mach O file format documentation for details).

That is, if we know the relationship between symbol names and memory addresses, we can construct symbol table data from this structure in reverse.

Now that you know how to construct the symbol table, the next step is to collect the mapping between symbol names and memory addresses.

With the data formatted and the source of the data clear, we can write the tool.

The implementation process will not be explained in detail, the tool is open source in my documentation, link: docs.qq.com/doc/DTWxwWE…

Here’s how to use this tool:

1. Download and compile the source code

git clone --recursive https://github.com/tobefuturer/restore-symbol.git
cd restore-symbol && make
./restore-symbol
Copy the code

2. Restore the symbol table of OC, very simple

./restore-symbol ./origin_AlipayWallet -o ./AlipayWallet_with_symbol
Copy the code

For the origin_AlipayWallet Clutch, the mach-o file -o has no symbol table followed by the output file location

3. Re-sign the Mach-o file and package it to see the effect

After the symbol table of the file is restored, 20M more symbol table information is displayed

Look at the call stack in Xcode

As you can see, the symbols of this part of OC function have been restored, and the general calling process can be seen in the function call stack. However, in Alipay, the callback form of block is adopted, so a large part of symbols are not displayed correctly.

So let’s see how we can restore the symbol of this block.

First, let’s examine how blocks are stored in memory at runtime. A block exists as a structure in memory. The structure is roughly as follows:

Struct __block_impl {/** block isa struct of Class NSObject, starting with an isa pointer */ Class isa; /** these two variables do not care about */ int flags; int reserved; /** a pointer to a function! */ void (*invoke)(...) ; . }Copy the code

In the following example, the ISA pointer in a block can have three different values to represent different types of blocks:

1. _NSConcreteStackBlock

   A block on a stack is created by allocating space in a block structure on the stack and then assigning values to variables such as ISA.

2. _NSConcreteMallocBlock

   A block on the heap, when a block is added to the GCD or is owned by an object, is copied from the stack to the heap, and the resulting block type becomes _NSConcreteMallocBlock.

3. _NSConcreteGlobalBlock

   For globally static blocks, when the block does not depend on the context, such as holding no variables outside the block and only using variables inside the block, the memory allocation of the block can be completed at compile time and allocated in the global static constant area.

The second type of block does not appear until run time. We will only focus on two types, 1 and 3, and analyze the association between these two isa Pointers and the address of the block symbol.

Suppose our source code is a simple block like this:

@implementation ViewController - (void)viewDidLoad { int t = 2; void (^ foo)() = ^(){ NSLog(@"%d", t); // Block refers to an external variable t}; foo(); } @endCopy the code

After compiling, the actual assembly looks like this:

At runtime, the actual block construction process looks like this:

1. Create stack space for blocks
2. Assign a value to the block’s ISA pointer (always reference the global variable:_NSConcreteStackBlock)
3. Gets the address of a function and assigns it to a function pointer

So we can sort out a feature like this:

Here comes the point!!

Any code that uses a block on the stack, it gets it__NSConcreteStackBlockAs a pointer to isa, it is followed by a function address, which is the function address of the block.

Read this sentence carefully in conjunction with the following diagram (which is the same file as the above, but with the symbol table cropped)

Using this feature, we can make the following inferences in reverse analysis:

If you find a reference to __NSConcreteStackBlock in an OC method, there must be a function address nearby, which is a block in the OC method.

For example, in the figure above, we can see that viewDidLoad refers to __NSConcreteStackBlock and immediately loads the address of sub_100049D4. Sub_100049D4 is a block in viewDidLoad. The symbol name of sub_100049D4 should be viewDidLoad_block.

In actual use, it may occur that the block is embedded in the block:

- (void)viewDidLoad {
  dispatch_async(background_queue ,^{
    ...
    dispatch_async(main_queue, ^{
      ...     
    });
  });
}
Copy the code

So there is a parent-child relationship in the block, and if we collect these parent-child relationships, we can find that these relationships will form the forest structure in graph theory, and we can simply use recursive depth-first search to deal with it, and the detailed process will not be described.

More:

IOS Underlying Principles – Isa – The underlying principles of the class (1)

IOS Underlying Principles – Isa – The underlying principles of the class (middle)

The underlying principles of iOS – ISA – The underlying principles of the class (2)

Interview questions for iOS (part 1)

Interview questions for iOS (Part 2)

Want to enter big factory, interview question essential! (iOS Interview collection!)

A learning route for iOS developers