Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fail to run in MacOS Catalina 10.15.4 #45

Closed
tobegit3hub opened this issue May 15, 2020 · 4 comments
Closed

Fail to run in MacOS Catalina 10.15.4 #45

tobegit3hub opened this issue May 15, 2020 · 4 comments

Comments

@tobegit3hub
Copy link

Here is the error log.

$ make test
Running tests...
Test project /Users/tobe/code/subhook/buid
    Start 1: subhook_test_exe_test
1/2 Test #1: subhook_test_exe_test ............***Failed  Required regular expression not found. Regex=[Testing initial install
foo_hooked\(\) called
foo\(\) called
Testing re-install
foo_hooked\(\) called
foo\(\) called
Testing trampoline
foo_hooked_tr\(\) called
foo\(\) called

]  0.00 sec
    Start 2: subhook_cxx_test_exe_test
2/2 Test #2: subhook_cxx_test_exe_test ........***Failed  Required regular expression not found. Regex=[Testing initial install
foo_hooked\(\) called
foo\(\) called
Testing re-install
foo_hooked\(\) called
foo\(\) called
Testing trampoline
foo_hooked_tr\(\) called
foo\(\) called

]  0.00 sec

0% tests passed, 2 tests failed out of 2

Total Test time (real) =   0.01 sec

The following tests FAILED:
          1 - subhook_test_exe_test (Failed)
          2 - subhook_cxx_test_exe_test (Failed)
Errors while running CTest
make: *** [test] Error 8
@tobegit3hub
Copy link
Author

It seems that subhook_install fail with MacOS Catalina 10.15.4 and the tests will work in Linux.

@tobegit3hub tobegit3hub changed the title make test fail in MacOS Fail to run in MacOS Catalina 10.15.4 May 15, 2020
@tobegit3hub
Copy link
Author

We have traced the code and find out the system call of mprotect was failed in new MacOS.

The following function returns zero in MacOS and make the _hook object as NULL.

if (mprotect(address, size, PROT_READ | PROT_WRITE | PROT_EXEC) == 0) ...

Same issue for agiledragon/gomonkey#10 .

@Zeex
Copy link
Owner

Zeex commented May 30, 2020

https://stackoverflow.com/questions/60654834/using-mprotect-to-make-text-segment-writable-on-macos

As mentioned in this post, in Catalina the linker sets maxprot in 64-bit executables to read+execute rather than read+write+execute as in earliner versions, which makes mprotect fail if PROT_WRITE is passed in the protection flags parameter.

It seems that the only way to make hooking work there is to manually overwrite the flags after compiling your program.

For the subhhok's test program I used this command from the SO post:

printf '\x07' | dd of=tests/Debug/test bs=1 seek=160 count=1 conv=notrunc

@tobegit3hub
Copy link
Author

Great and this could fix for me.

printf '\x07' | dd of=tests/test bs=1 seek=160 count=1 conv=notrunc
printf '\x07' | dd of=tests/test++ bs=1 seek=160 count=1 conv=notrunc

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants