Skip to content

Latest commit

 

History

History
39 lines (34 loc) · 1.71 KB

README.md

File metadata and controls

39 lines (34 loc) · 1.71 KB

fnhook

A simple, batteries included library for hooking / trapping standard library functions calls from an external program on macOS. Currently only supports aarch64.

This was heavily inspired by fishhook, but with a significantly different API.

!! NOTE !!

You will need to sign whatever application you include this in with the com.apple.security.cs.debugger entitlement. This library depends on task_for_pid, which requires said entitlement. This can be done via codesign, like so:

codesign -s "my-trusted-cert-for-signing-code" -f --entitlements ./Entitlements.plist --timestamp --options=runtime ../target/debug/my-application-that-hooks

Additionally, if you are using this to debug an application that has the Hardened Runtime enabled, you will need to re-sign that application with the following entitlements:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
   <dict>
      <key>com.apple.security.get-task-allow</key>
      <true/>
      <key>com.apple.security.cs.disable-library-validation</key>
      <true/>
      <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
      <true/>
   </dict>
</plist>

This can be done via codesign, like so:

codesign -f -s "my-trusted-cert-for-signing-code" --preserve-metadata=identifier,requirements,flags,runtime,launch-constraints,library-constraints --entitlements ./the_entitlements_above.plist

TODO

  • support fat binaries (e.g. universal binaries)
  • support x86_64 hooking
  • cross-platform support (?)
  • allow for dynamic payloads
  • un-hooking functions