iOS 使用什么函数/系统调用来读写文件 [英] What function/syscall is used by iOS to read and write files

问题描述

我想在 iOS 上拦截文件读/写，以便为我的一些应用程序提供透明的加密/解密功能.​​

I want to intercept file read/write on iOS for providing transparent encryption/decryption functionality to some of my apps.

我知道我可以调配各种 SDK 方法来读取/写入文件来执行此操作，但这需要大量艰苦的工作并且容易出错(我可能会错过调配某些方法，导致我的应用程序崩溃/行为不端).

I know I can swizzle the various SDK methods for reading/writing files to do this, but that entails a LOT of hard work and is prone to error (I may miss swizzling some method, causing my application to crash/misbehave).

如果所有这些方法都使用了一些通用的系统调用/函数，那么我宁愿混合它并节省一些艰苦的工作+使其更加万无一失.有没有这样的通用入口点?

If there is some common syscall/function used by all these methods, then I'd rather swizzle it and save on some hard work + make it more foolproof. Is there any such common entry point?

PS:接受应用商店不是这里的标准，因为所有这些应用都是用于内部企业部署的.

PS: Acceptance into the app store is not a criteria here, since all these apps are for in-house enterprise deployment.

谢谢！

推荐答案

为此，您需要一个越狱设备.

For this, you'll need a jailbroken device.

有可以被劫持的 POSIX 系统调用 read 和 write (这里是如何 - 不是特定于 iOS 的，但无论如何都是达尔文......)

There are the POSIX syscalls read and write which can be hijacked (here's how - not iOS-specific, but Darwin anyway...)

您也可以使用 MobileSubstrate(http://iphonedevwiki.net/index.php/MobileSubstrate) 挂钩 C 标准库中的 read() 和 write() 函数，该库几乎专门用于实现许多基本框架和方法(包括 CocoaTouch - Foundation、CoreFoundation 以及实际上一些 C 和C++ 标准库等) - 所以很可能你不需要直接改变系统调用.示例:

You can also use MobileSubstrate(http://iphonedevwiki.net/index.php/MobileSubstrate) to hook the read() and write() functions in the C standard libraty which is almost exclusively used for the implementation of many basic frameworks and methods (including that of CocoaTouch - Foundation, CoreFoundation, and in fact some of the C and C++ standard libraries as well, etc.) - so most likely you won't need to alter the syscalls directly. Example:

static size_t (*orig_write)(int fd, void *buf, size_t n);

size_t hijacked_write(int fd, void *buf, size_t n)
{
    // do something, then
    return orig_write(fd, buf, n);
}

// in some initialization:
MSHookFunction(write, hijacked_write, (void **)&original_write);

这篇关于iOS 使用什么函数/系统调用来读写文件的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！