Home/ Questions/Q 8060051
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-05T09:51:47+00:00

I want to hook a function called png_handle_IHDR declared locally in the ImageIO framework.

  • 0

I want to hook a function called png_handle_IHDR declared locally in the ImageIO framework. I used MobileSafari as the filter. But while calling the original function, mobilesafari crashes. Upon inspection of the NSLog, i get this:

Jun  5 17:21:08 unknown MobileSafari[553] <Warning>: dlopen ImageIO success!
Jun  5 17:21:08 unknown MobileSafari[553] <Warning>: Zeroing of nlist success!
Jun  5 17:21:08 unknown MobileSafari[553] <Warning>: method name successfully assigned!
Jun  5 17:21:08 unknown MobileSafari[553] <Warning>: nlist SUCCESS! nlsetting..
Jun  5 17:21:08 unknown MobileSafari[553] <Warning>: nlset success! Hooking..
Jun  5 17:21:09 unknown MobileSafari[553] <Warning>: Png IHDR handle hooking!
Jun  5 17:21:09 unknown UIKitApplication:com.apple.mobilesafari[0x819][553] <Notice>: libpng error: Invalid IHDR chunk
Jun  5 17:21:09 unknown ReportCrash[554] <Notice>: Formulating crash report for process MobileSafari[553]
Jun  5 17:21:09 unknown com.apple.launchd[1] <Warning>: (UIKitApplication:com.apple.mobilesafari[0x819]) Job appears to have crashed: Abort trap: 6
Jun  5 17:21:09 unknown SpringBoard[530] <Warning>: Application 'Safari' exited abnormally with signal 6: Abort trap: 6

I immediately gathered that its very likely that I got the function prototype of the png_handle_IHDR wrong. The following is my code in the tweak:

#import <CoreFoundation/CoreFoundation.h>
#include <substrate.h>

#define ImageIO "/System/Library/Frameworks/ImageIO.framework/ImageIO"

void (*png_handle_IHDR)();

MSHook(void, png_handle_IHDR){
    NSLog(@"Png IHDR handle hooking!\n");
    _png_handle_IHDR(); //crashed here!!
    NSLog(@"Png IHDR handle hooking finished!\n");

}

template <typename Type_>
static void nlset(Type_ &function, struct nlist *nl, size_t index) {
    struct nlist &name(nl[index]);
    uintptr_t value(name.n_value);
    if ((name.n_desc & N_ARM_THUMB_DEF) != 0)
        value |= 0x00000001;
    function = reinterpret_cast<Type_>(value);
}

MSInitialize {

        if (dlopen(ImageIO, RTLD_LAZY | RTLD_NOLOAD)!=NULL)
        {       
                NSLog(@"dlopen ImageIO success!\n");
                struct nlist nl[2];
                bzero(&nl, sizeof(nl));
                NSLog(@"Zeroing of nlist success!\n");
                nl[0].n_un.n_name = (char*) "_png_handle_IHDR"; 
                NSLog(@"method name successfully assigned!\n");
                nlist(ImageIO,nl);
                NSLog(@"nlist SUCCESS! nlsetting..\n");
                nlset(png_handle_IHDR, nl, 0);  
                NSLog(@"nlset success! Hooking..\n");
                MSHookFunction(png_handle_IHDR,MSHake(png_handle_IHDR));
        }        
}

My makefile is as such:

include theos/makefiles/common.mk

TWEAK_NAME = privateFunctionTest
privateFunctionTest_FILES = Tweak.xm

include $(THEOS_MAKE_PATH)/tweak.mk
privateFunctionTest_FRAMEWORKS = UIKit ImageIO CoreGraphics Foundation CoreFoundation

Edit: The question is, is knowing the original function arguments necessary for a successful hook? If yes, is getting the function prototype from the disassembly the only way? There is no definition of this in any of the SDK headers. Thanks.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Ok, I decompiled the function and get the function prototype guessed by the decompiler. As long as the parameters and return type broadly matched e.g. bool : int, unsigned int : int, it still works without killing the execution. So this works:

    int *png_handle_IHDR(int a1, int a2, int a3);

MSHook(int, png_handle_IHDR, int a1, int a2, int a3){

    NSLog(@"png_handle_IHDR(%d,%d,%d)", a1,a2,a3);
    int val = _png_handle_IHDR(a1,a2,a3);
    NSLog(@"Png IHDR handle hooking finished, returning %d as result!", val);
    return val;

}
    • 0