2023-10-10 17:54:08 +00:00
|
|
|
|
# macOS GCD - Grand Central Dispatch
|
|
|
|
|
|
|
|
|
|
|
|
<details>
|
|
|
|
|
|
|
|
|
|
|
|
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
|
|
|
|
|
|
|
|
|
|
|
* 你在一个**网络安全公司**工作吗？你想在HackTricks中看到你的**公司广告**吗？或者你想要**获取PEASS的最新版本或下载PDF格式的HackTricks**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
|
|
|
|
|
* 发现我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品——[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
|
|
|
|
|
* 获取[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
|
|
|
|
|
* **加入**[**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f)或[**电报群组**](https://t.me/peass)，或者**关注**我在**Twitter**上的[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**。**
|
|
|
|
|
|
* **通过向**[**hacktricks repo**](https://github.com/carlospolop/hacktricks) **和**[**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud) **提交PR来分享你的黑客技巧。**
|
|
|
|
|
|
|
|
|
|
|
|
</details>
|
|
|
|
|
|
|
|
|
|
|
|
## 基本信息
|
|
|
|
|
|
|
|
|
|
|
|
**Grand Central Dispatch (GCD)**，也被称为**libdispatch**，在macOS和iOS上都可用。这是由Apple开发的一项技术，用于优化应用程序在多核硬件上的并发（多线程）执行支持。
|
|
|
|
|
|
|
|
|
|
|
|
**GCD**提供和管理**FIFO队列**，您的应用程序可以将**块对象**形式的**任务提交**到这些队列中。提交到调度队列的块会在系统完全管理的线程池上执行。GCD会自动创建线程来执行调度队列中的任务，并将这些任务安排在可用的核心上运行。
|
|
|
|
|
|
|
|
|
|
|
|
{% hint style="success" %}
|
|
|
|
|
|
简而言之，要在**并行**中执行代码，进程可以将**代码块发送给GCD**，GCD将负责执行它们。因此，进程不会创建新线程；**GCD使用自己的线程池执行给定的代码**。
|
|
|
|
|
|
{% endhint %}
|
|
|
|
|
|
|
|
|
|
|
|
这对于成功管理并行执行非常有帮助，大大减少了进程创建的线程数量，并优化了并行执行。这对于需要**很高的并行性**（暴力破解？）或者不应该阻塞主线程的任务非常有用：例如，在iOS上，主线程处理UI交互，因此通过这种方式来处理可能使应用程序挂起的任何其他功能（搜索、访问网页、读取文件等）。
|
|
|
|
|
|
|
|
|
|
|
|
## Objective-C
|
|
|
|
|
|
|
|
|
|
|
|
在Objective-C中，有不同的函数可以将块对象发送到并行执行：
|
|
|
|
|
|
|
|
|
|
|
|
* [**dispatch\_async**](https://developer.apple.com/documentation/dispatch/1453057-dispatch\_async)：将一个块对象提交到调度队列以进行异步执行，并立即返回。
|
|
|
|
|
|
* [**dispatch\_sync**](https://developer.apple.com/documentation/dispatch/1452870-dispatch\_sync)：提交一个块对象进行执行，并在该块对象执行完成后返回。
|
|
|
|
|
|
* [**dispatch\_once**](https://developer.apple.com/documentation/dispatch/1447169-dispatch\_once)：在应用程序的整个生命周期中只执行一次块对象。
|
|
|
|
|
|
* [**dispatch\_async\_and\_wait**](https://developer.apple.com/documentation/dispatch/3191901-dispatch\_async\_and\_wait)：提交一个工作项进行执行，并在它完成执行后才返回。与[**`dispatch_sync`**](https://developer.apple.com/documentation/dispatch/1452870-dispatch\_sync)不同，此函数在执行块对象时会遵守队列的所有属性。
|
|
|
|
|
|
|
|
|
|
|
|
这些函数期望以下参数：[**`dispatch_queue_t`**](https://developer.apple.com/documentation/dispatch/dispatch\_queue\_t) **`queue,`** [**`dispatch_block_t`**](https://developer.apple.com/documentation/dispatch/dispatch\_block\_t) **`block`**
|
|
|
|
|
|
|
|
|
|
|
|
这是一个**块对象的结构**：
|
|
|
|
|
|
```c
|
|
|
|
|
|
struct Block {
|
|
|
|
|
|
void *isa; // NSConcreteStackBlock,...
|
|
|
|
|
|
int flags;
|
|
|
|
|
|
int reserved;
|
|
|
|
|
|
void *invoke;
|
|
|
|
|
|
struct BlockDescriptor *descriptor;
|
|
|
|
|
|
// captured variables go here
|
|
|
|
|
|
};
|
|
|
|
|
|
```
|
|
|
|
|
|
这是一个使用**并行处理**和**`dispatch_async`**的示例：
|
|
|
|
|
|
```objectivec
|
|
|
|
|
|
#import <Foundation/Foundation.h>
|
|
|
|
|
|
|
|
|
|
|
|
// Define a block
|
|
|
|
|
|
void (^backgroundTask)(void) = ^{
|
|
|
|
|
|
// Code to be executed in the background
|
|
|
|
|
|
for (int i = 0; i < 10; i++) {
|
|
|
|
|
|
NSLog(@"Background task %d", i);
|
|
|
|
|
|
sleep(1); // Simulate a long-running task
|
|
|
|
|
|
}
|
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
int main(int argc, const char * argv[]) {
|
|
|
|
|
|
@autoreleasepool {
|
|
|
|
|
|
// Create a dispatch queue
|
|
|
|
|
|
dispatch_queue_t backgroundQueue = dispatch_queue_create("com.example.backgroundQueue", NULL);
|
|
|
|
|
|
|
|
|
|
|
|
// Submit the block to the queue for asynchronous execution
|
|
|
|
|
|
dispatch_async(backgroundQueue, backgroundTask);
|
|
|
|
|
|
|
|
|
|
|
|
// Continue with other work on the main queue or thread
|
|
|
|
|
|
for (int i = 0; i < 10; i++) {
|
|
|
|
|
|
NSLog(@"Main task %d", i);
|
|
|
|
|
|
sleep(1); // Simulate a long-running task
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
return 0;
|
|
|
|
|
|
}
|
|
|
|
|
|
```
|
|
|
|
|
|
## Swift
|
|
|
|
|
|
|
|
|
|
|
|
**`libswiftDispatch`** 是一个库，它为原本用C语言编写的Grand Central Dispatch (GCD)框架提供了Swift绑定。\
|
|
|
|
|
|
**`libswiftDispatch`**库将C GCD API封装在一个更适合Swift开发者使用的界面中，使得Swift开发者更容易、更直观地使用GCD。
|
|
|
|
|
|
|
|
|
|
|
|
* **`DispatchQueue.global().sync{ ... }`**
|
|
|
|
|
|
* **`DispatchQueue.global().async{ ... }`**
|
|
|
|
|
|
* **`let onceToken = DispatchOnce(); onceToken.perform { ... }`**
|
|
|
|
|
|
* **`async await`**
|
|
|
|
|
|
* **`var (data, response) = await URLSession.shared.data(from: URL(string: "https://api.example.com/getData"))`**
|
|
|
|
|
|
|
|
|
|
|
|
**代码示例**：
|
|
|
|
|
|
```swift
|
|
|
|
|
|
import Foundation
|
|
|
|
|
|
|
|
|
|
|
|
// Define a closure (the Swift equivalent of a block)
|
|
|
|
|
|
let backgroundTask: () -> Void = {
|
|
|
|
|
|
for i in 0..<10 {
|
|
|
|
|
|
print("Background task \(i)")
|
|
|
|
|
|
sleep(1) // Simulate a long-running task
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
// Entry point
|
|
|
|
|
|
autoreleasepool {
|
|
|
|
|
|
// Create a dispatch queue
|
|
|
|
|
|
let backgroundQueue = DispatchQueue(label: "com.example.backgroundQueue")
|
|
|
|
|
|
|
|
|
|
|
|
// Submit the closure to the queue for asynchronous execution
|
|
|
|
|
|
backgroundQueue.async(execute: backgroundTask)
|
|
|
|
|
|
|
|
|
|
|
|
// Continue with other work on the main queue
|
|
|
|
|
|
for i in 0..<10 {
|
|
|
|
|
|
print("Main task \(i)")
|
|
|
|
|
|
sleep(1) // Simulate a long-running task
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
|
|
```
|
|
|
|
|
|
## Frida
|
|
|
|
|
|
|
|
|
|
|
|
以下是一个Frida脚本，可以用于**钩入多个`dispatch`函数**并提取队列名称、回溯和块：[**https://github.com/seemoo-lab/frida-scripts/blob/main/scripts/libdispatch.js**](https://github.com/seemoo-lab/frida-scripts/blob/main/scripts/libdispatch.js)
|
|
|
|
|
|
```bash
|
|
|
|
|
|
frida -U <prog_name> -l libdispatch.js
|
|
|
|
|
|
|
|
|
|
|
|
dispatch_sync
|
|
|
|
|
|
Calling queue: com.apple.UIKit._UIReusePool.reuseSetAccess
|
|
|
|
|
|
Callback function: 0x19e3a6488 UIKitCore!__26-[_UIReusePool addObject:]_block_invoke
|
|
|
|
|
|
Backtrace:
|
|
|
|
|
|
0x19e3a6460 UIKitCore!-[_UIReusePool addObject:]
|
|
|
|
|
|
0x19e3a5db8 UIKitCore!-[UIGraphicsRenderer _enqueueContextForReuse:]
|
|
|
|
|
|
0x19e3a57fc UIKitCore!+[UIGraphicsRenderer _destroyCGContext:withRenderer:]
|
|
|
|
|
|
[...]
|
|
|
|
|
|
```
|
|
|
|
|
|
## Ghidra
|
|
|
|
|
|
|
|
|
|
|
|
目前，Ghidra无法理解ObjectiveC的**`dispatch_block_t`**结构，也无法理解**`swift_dispatch_block`**结构。
|
|
|
|
|
|
|
|
|
|
|
|
如果你希望Ghidra能够理解它们，你可以**声明它们**：
|
|
|
|
|
|
|
|
|
|
|
|
<figure><img src="../../.gitbook/assets/image (688).png" alt="" width="563"><figcaption></figcaption></figure>
|
|
|
|
|
|
|
|
|
|
|
|
<figure><img src="../../.gitbook/assets/image (690).png" alt="" width="563"><figcaption></figcaption></figure>
|
|
|
|
|
|
|
|
|
|
|
|
<figure><img src="../../.gitbook/assets/image (691).png" alt="" width="563"><figcaption></figcaption></figure>
|
|
|
|
|
|
|
|
|
|
|
|
然后，在代码中找到它们被**使用**的地方：
|
|
|
|
|
|
|
2023-10-10 18:01:13 +00:00
|
|
|
|
{% hint style="success" %}
|
|
|
|
|
|
注意所有对"block"的引用，以了解如何确定该结构被使用。
|
|
|
|
|
|
{% endhint %}
|
|
|
|
|
|
|
2023-10-10 17:54:08 +00:00
|
|
|
|
<figure><img src="../../.gitbook/assets/image (692).png" alt="" width="563"><figcaption></figcaption></figure>
|
|
|
|
|
|
|
|
|
|
|
|
右键点击变量 -> 重新定义变量，并在这种情况下选择**`swift_dispatch_block`**：
|
|
|
|
|
|
|
|
|
|
|
|
<figure><img src="../../.gitbook/assets/image (693).png" alt="" width="563"><figcaption></figcaption></figure>
|
|
|
|
|
|
|
|
|
|
|
|
Ghidra将自动重写所有内容：
|
|
|
|
|
|
|
|
|
|
|
|
<figure><img src="../../.gitbook/assets/image (694).png" alt="" width="563"><figcaption></figcaption></figure>
|
|
|
|
|
|
|
|
|
|
|
|
<details>
|
|
|
|
|
|
|
|
|
|
|
|
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
|
|
|
|
|
|
|
|
|
|
|
* 你在一家**网络安全公司**工作吗？想要在HackTricks中**宣传你的公司**吗？或者想要**获取PEASS的最新版本或下载PDF格式的HackTricks**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
|
|
|
|
|
* 发现我们的独家[NFT收藏品](https://opensea.io/collection/the-peass-family)——[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
|
|
|
|
|
* 获得[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
|
|
|
|
|
* **加入**[**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f)或[**Telegram群组**](https://t.me/peass)，或在**Twitter**上**关注**我[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks\_live)**。**
|
2023-10-10 18:01:13 +00:00
|
|
|
|
* **通过向**[**hacktricks repo**](https://github.com/carlospolop/hacktricks) **和** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud) **提交PR来分享你的黑客技巧。**
|
2023-10-10 17:54:08 +00:00
|
|
|
|
|
|
|
|
|
|
</details>
|
