mardi 26 novembre 2019

objectiveC reflection: How to set the inputs when calling a framework method during runtime

I'm trying to reverse the way dpsconfigad extracting the current active directory domain.

Notice : It's rather simple query that can be performed using OpenDirectory public framework but it requires a username from this domain as an input, whereas dpsconfigad doesn't require any inputs.

So It appears that the framework which responsible for this functionality of retrieving the AD is : /System/Library/PrivateFrameworks/OpenDirectoryConfig.framework/Versions/A/OpenDirectoryConfig which I've linked with my project.

After looking at assembly code of dpsconfigad, I was able to trace the specific method that extract this information is readCurrentADSettings from class ODCAction and here's the function invocation:

int sub_100004316(int arg0, int arg1, int arg2) {
    var_28 = 0x0;
--> rax = [ODCAction readCurrentADSettings:0x0 error:rcx];

I've tried to imitate it with my own program using reflection :

#import <objc/runtime.h>

 int main(int argc, const char * argv[]) {

    Class ODCAction_cls = NSClassFromString(@"ODCAction");
    NSObject *currentADSettings_obj = [ODCAction_cls performSelector:@selector(readCurrentADSettings:error:)
                        withObject:nil withObject:nil];
    NSLog(@"AD settings: %@", currentADSettings_obj);
}

I did get the class properly, but the invocation itself returned nil.. Perhaps it's because I put nil instead of 0x0 and probably a pointer value which represented by Rcx in the original call.

Can anyone help me make this call return non-null value (from the assembly code it seems to be a dictionary with "active directory domain" as one of it's keys)





Aucun commentaire:

Enregistrer un commentaire