HopperでApple社員ゴッコしてみた

無料逆コンパイラHopperを用い、iOS8ローカル通知におけるバグの分析を試みる。

バグの詳細
https://github.com/sozorogami/NotificationBug/

参考文献
https://www.mikeash.com/pyblog/friday-qa-2012-01-06-the-hopper-disassembler.html
http://abad1dea.tumblr.com/post/23487860422/analyzing-binaries-with-hoppers-decompiler
http://www.bartcone.com/new-blog/2014/11/26/hopper-lldb-for-ios-developers-a-gentle-introduction
http://www.zdziarski.com/blog/?p=2172

Transcript

1. )PQQFSͰ
   "QQMFࣾһΰοίͯ͠Έͨ Tyler Tape github.com/sozorogami/ @sozorogami_jp
2. 5IF
   #VH
3. [[UIApplication sharedApplication] cancelAllLocalNotifications];! for (NSDate *date in [self dates]) {! UILocalNotification *notification = [self defaultNotificationWithDate:date];! [[UIApplication sharedApplication] scheduleLocalNotification:notification];! }! NSLog(@"Notifications: %@", [[UIApplication sharedApplication] scheduledLocalNotifications]);!
4. 2015-01-14 22:08:41.220 NotificationBug[81492:60b] Notifications: (! "<UIConcreteLocalNotification: 0x7feb39443c70>{fire date = Thursday, January 15, 2015 at 12:55:21 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 12:55:21 AM Japan Standard Time, user info = (null)}",! "<UIConcreteLocalNotification: 0x7feb3943fb50>{fire date = Thursday, January 15, 2015 at 3:42:01 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 3:42:01 AM Japan Standard Time, user info = (null)}",! "<UIConcreteLocalNotification: 0x7feb39446b90>{fire date = Thursday, January 15, 2015 at 6:28:41 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 6:28:41 AM Japan Standard Time, user info = (null)}",! "<UIConcreteLocalNotification: 0x7feb394445d0>{fire date = Thursday, January 15, 2015 at 9:15:21 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 9:15:21 AM Japan Standard Time, user info = (null)}"! )! J04
5. 2015-01-14 22:10:33.902 NotificationBug[81560:25743720] Notifications: (! "<UIConcreteLocalNotification: 0x7fec38c1f900>{fire date = Thursday, January 15, 2015 at 12:57:13 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 12:57:13 AM Japan Standard Time, user info = (null)}",! "<UIConcreteLocalNotification: 0x7fec38c6c820>{fire date = Thursday, January 15, 2015 at 3:43:53 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 3:43:53 AM Japan Standard Time, user info = (null)}",! "<UIConcreteLocalNotification: 0x7fec38c6da60>{fire date = Thursday, January 15, 2015 at 6:30:33 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 6:30:33 AM Japan Standard Time, user info = (null)}"! ) J04
6. 2015-01-14 21:49:15.251 NotificationBug[80529:25728165] Notifications: (! "<UIConcreteLocalNotification: 0x7fb203586e60>{fire date = Thursday, January 15, 2015 at 12:35:55 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 12:35:55 AM Japan Standard Time, user info = (null)}",! "<UIConcreteLocalNotification: 0x7fb20353fc70>{fire date = Thursday, January 15, 2015 at 3:22:35 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 3:22:35 AM Japan Standard Time, user info = (null)}",! "<UIConcreteLocalNotification: 0x7fb2035850c0>{fire date = Thursday, January 15, 2015 at 6:09:15 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 6:09:15 AM Japan Standard Time, user info = (null)}",! "<UIConcreteLocalNotification: 0x7fb203587ca0>{fire date = Thursday, January 15, 2015 at 8:55:55 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 8:55:55 AM Japan Standard Time, user info = (null)}"! ) J04 ʢͱ͖Ͳ͖ʣ
7. ͏͍͟
8. )PQQFS
9. ✴
   IUUQXXXIPQQFSBQQDPN
   ✴
   Ձ֨
   
   
   = 
   ແྉ൛͋Γʣ
   ✴
   ػೳ
   ✓
   %JTBTTFNCMFS
   ✓
   %FDPNQJMFS
   ✓
   %FCVHHFS
10. 6*,JU
    JTͲ͜ʁ /Applications/Xcode.app/Contents/Developer/Platforms/ iPhoneSimulator.platform/Developer/SDKs/ iPhoneSimulator8.1.sdk/System/Library/Frameworks/ UIKit.framework
11. %3"(
    
    %301
18. 000000000002c3f8 mov r14, rdx! 000000000002c3fb mov rbx, rdi! 000000000002c3fe lea r15, qword [ds:__UIApplicationLinkedOnVersion] ; __UIApplicationLinkedOnVersion! 000000000002c405 mov eax, dword [ds:r15]! 000000000002c408 test eax, eax! 000000000002c40a jne 0x2c42c! ! 000000000002c40c cmp qword [ds:__UIApplicationLinkedOnVersionOnce], 0xffffffffffffffff ; __UIApplicationLinkedOnVersionOnce! 000000000002c414 je 0x2c448! ! 000000000002c416 lea rdi, qword [ds:__UIApplicationLinkedOnVersionOnce] ; __UIApplicationLinkedOnVersionOnce, argument "predicate" for method imp___stubs__dispatch_once! 000000000002c41d lea rsi, qword [ds:___block_literal_global1030] ; ___block_literal_global1030, argument "block" for method imp___stubs__dispatch_once! 000000000002c424 call imp___stubs__dispatch_once! 000000000002c429 mov eax, dword [ds:r15]! ! 000000000002c42c cmp eax, 0x7ffff ; XREF=-[UIApplication scheduleLocalNotification:]+28! 000000000002c431 jbe 0x2c448! ! 000000000002c433 mov rsi, qword [ds:0xda56a8] ; @selector(validateNotification:), argument "selector" for method imp___got__objc_msgSend! 000000000002c43a mov rdi, rbx ; argument "instance" for method imp___got__objc_msgSend! 000000000002c43d mov rdx, r14! 000000000002c440 call qword [ds:imp___got__objc_msgSend]! 000000000002c446 jmp 0x2c495! ! 000000000002c448 mov rsi, qword [ds:0xda4d00] ; @selector(currentUserNotificationSettings), XREF=- [UIApplication scheduleLocalNotification:]+38, -[UIApplication scheduleLocalNotification:]+67! 000000000002c44f mov r15, qword [ds:imp___got__objc_msgSend] ; imp___got__objc_msgSend! 000000000002c456 mov rdi, rbx ; argument "instance" for method _objc_msgSend! 000000000002c459 call r15 ; _objc_msgSend! 000000000002c45c mov rsi, qword [ds:0xda4d08] ; @selector(types), argument "selector" for method _objc_msgSend! 000000000002c463 mov rdi, rax ; argument "instance" for method _objc_msgSend! 000000000002c466 call r15 ; _objc_msgSend! 000000000002c469 test al, 0x4! 000000000002c46b jne 0x2c495! ! 000000000002c46d mov rdi, qword [ds:objc_cls_ref_UIUserNotificationSettings] ; objc_cls_ref_UIUserNotificationSettings, argument "instance" for method _objc_msgSend! 000000000002c474 mov rsi, qword [ds:0xda4d10] ; @selector(settingsForTypes:categories:), argument "selector" for method _objc_msgSend! 000000000002c47b mov edx, 0x7! 000000000002c480 xor ecx, ecx! 000000000002c482 call r15 ; _objc_msgSend! 000000000002c485 mov rsi, qword [ds:0xda4d18] ; @selector(registerUserNotificationSettings:), argument "selector" for method _objc_msgSend! 000000000002c48c mov rdi, rbx ; argument "instance" for method _objc_msgSend! 000000000002c48f mov rdx, rax! 000000000002c492 call r15 ; _objc_msgSend! ! 000000000002c495 mov rdi, qword [ds:objc_cls_ref_SBSLocalNotificationClient] ; objc_cls_ref_SBSLocalNotificationClient, argument "instance" for method imp___got__objc_msgSend, XREF=-[UIApplication scheduleLocalNotification:]+88, -[UIApplication scheduleLocalNotification:]+125!
20. void -[UIApplication scheduleLocalNotification:](void * self, void * _cmd, void * arg2) {! r14 = arg2;! rbx = self;! LODWORD(rax) = *(int32_t *)__UIApplicationLinkedOnVersion;! if (LODWORD(rax) != 0x0) goto loc_2c42c;! goto loc_2c40c;! ! loc_2c42c:! if (LODWORD(rax) > 0x7ffff) {! [rbx validateNotification:r14];! }! else {! if ((LOBYTE([[rbx currentUserNotificationSettings] types]) & 0x4) == 0x0) {! r15 = *objc_msgSend;! rax = [UIUserNotificationSettings settingsForTypes:0x7 categories:0x0];! [rbx registerUserNotificationSettings:rax];! }! }! ! loc_2c495:! rdx = r14;! rax = [SBSLocalNotificationClient scheduleLocalNotification:rdx];! return;! ! loc_2c40c:! if (*__UIApplicationLinkedOnVersionOnce == 0xffffffffffffffff) goto loc_2c448;! goto loc_2c416;! ! loc_2c448:! if ((LOBYTE([[rbx currentUserNotificationSettings] types]) & 0x4) == 0x0) {! r15 = *objc_msgSend;! rax = [UIUserNotificationSettings settingsForTypes:0x7 categories:0x0];! [rbx registerUserNotificationSettings:rax];! }! goto loc_2c495;! ! loc_2c416:! dispatch_once(__UIApplicationLinkedOnVersionOnce, void ^(void * _block) {! rax = dyld_get_program_sdk_version(_block);! *(int32_t *)__UIApplicationLinkedOnVersion = LODWORD(rax);! return;! });! LODWORD(rax) = *(int32_t *)__UIApplicationLinkedOnVersion;! goto loc_2c42c;! }!
21. loc_2c495:! rdx = r14;! rax = [SBSLocalNotificationClient scheduleLocalNotification:rdx];! return;
22. 4#4-PDBM/PUJpDBUJPO$MJFOU JTͲ͜ʁ
23. /Applications/Xcode.app/Contents/Developer/Platforms/ iPhoneSimulator.platform/Developer/SDKs/ iPhoneSimulator8.1.sdk/System/Library/PrivateFrameworks/ SpringBoardServices.framework 4QSJOH#PBSE4FSWJDFT
24. +[SBSLocalNotificationClient scheduleLocalNotification:]! +[SBSLocalNotificationClient _scheduleLocalNotifications:cancel:replace:optionalBundleIdentifier:]! +[SBSLocalNotificationClient _scheduleLocalNotifications:cancel:replace:optionalBundleIdentifier:waitUntilDone:]! SBScheduleLocalNotifications(int arg0, int arg1, int arg2, int arg3, int arg4, int arg5, int arg6)!
27. hoge! hoge! hoge! hoge! hoge! 2015-01-15 01:29:52.185 NotificationBug[81959:25825956] Notifications: (! "<UIConcreteLocalNotification: 0x7fec8bc792b0>{fire date = Thursday, January 15, 2015 at 4:16:31 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 4:16:31 AM Japan Standard Time, user info = (null)}",! "<UIConcreteLocalNotification: 0x7fec8bc88d30>{fire date = Thursday, January 15, 2015 at 7:03:11 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 7:03:11 AM Japan Standard Time, user info = (null)}",! "<UIConcreteLocalNotification: 0x7fec8bc88fb0>{fire date = Thursday, January 15, 2015 at 9:49:51 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 9:49:51 AM Japan Standard Time, user info = (null)}",! "<UIConcreteLocalNotification: 0x7fec8bc89130>{fire date = Thursday, January 15, 2015 at 12:36:31 PM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 12:36:31 PM Japan Standard Time, user info = (null)}"! )! hoge! hoge! hoge! hoge! hoge! 2015-01-15 01:30:02.310 NotificationBug[81959:25825956] Notifications: (! "<UIConcreteLocalNotification: 0x7fec8bd3cef0>{fire date = Thursday, January 15, 2015 at 4:16:42 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 4:16:42 AM Japan Standard Time, user info = (null)}",! "<UIConcreteLocalNotification: 0x7fec8bd7c3e0>{fire date = Thursday, January 15, 2015 at 7:03:22 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 7:03:22 AM Japan Standard Time, user info = (null)}",! "<UIConcreteLocalNotification: 0x7fec8bd7c4f0>{fire date = Thursday, January 15, 2015 at 9:50:02 AM Japan Standard Time, time zone = (null), repeat interval = 0, repeat count = UILocalNotificationInfiniteRepeatCount, next fire date = Thursday, January 15, 2015 at 9:50:02 AM Japan Standard Time, user info = (null)}"! )! 
    IPHFT
28. ݁Ռ -[UIApplication scheduleLocalNotification:]ͷڍಈ͸໰୊ͳ͠ -[UIApplication scheduledLocalNotifications]?! -[UIApplication cancelAllLocalNotifications]?
29. ࢀߟจݙ https://www.mikeash.com/pyblog/friday-qa-2012-01-06-the- hopper-disassembler.html http://abad1dea.tumblr.com/post/23487860422/analyzing- binaries-with-hoppers-decompiler http://www.bartcone.com/new-blog/2014/11/26/hopper-lldb- for-ios-developers-a-gentle-introduction http://www.zdziarski.com/blog/?p=2172
30. δϣΠφε