制作一个使用'sed'修补OSX中二进制文件内的十六进制字符串的脚本

Question

patching hex strings inside binaries with sed.

how do i use Sed to open a binary file inside a .app, search for a unique string of hex values , replace them with the new string and then save the binary and exit.? i have done alot of research and im stuck.

ultimately i would like to wright this as a script and below i have written some code as terminal commands that basically doesn't work but represents what i want to happen to the best of my ability.

//binary patcher script attempt

hexdump -ve '1/1 "%.2X"' /Users/MiRAGE/Downloads/MyApp.app/Contents/MacOS/MyApp | \
sed "s/\x48\x85\xc0\x75\x33/\x48\x85\xc0\x74\x33/g" | \
xxd -r -p > /Users/MiRAGE/Downloads/MyApp.app/Contents/MacOS/MyApp.Patched | \
cd /Users/MiRAGE/Downloads/MyApp.app/Contents/MacOS/ | \
mv /Users/MiRAGE/Downloads/MyApp.app/Contents/MacOS/MyApp.Patched /Users/MiRAGE/Downloads/MyApp.app/Contents/MacOS/MyApp | \
sudo chmod u+x /Users/MiRAGE/Downloads/MyApp.app/Contents/MacOS/MyApp

//returns 1 if the string is in the file

xxd -p /Users/MiRAGE/Downloads/MyApp.app/Contents/MacOS/MyApp | tr -d '\n' | grep -c ‘4885c07533'

(this is not in use in the script at the moment but i tested it and it does return 1 if the sequence is there and so i thought it would be handy when it comes to possibly of making these patches into small applications of their own. implementing by means of something along the lines of :-

'if(xxd -p /Users/MiRAGE/Downloads/MyApp.app/Contents/MacOS/MyApp | tr -d '\n' | grep -c ‘4885c07533' == 1){runTheRestOfTheScript;
else if (xxd -p /Users/MiRAGE/Downloads/MyApp.app/Contents/MacOS/MyApp | tr -d '\n' | grep -c ‘4885c07533' == 1){ThrowERROR;'

ok so back to the stuff in the script

//First it dumps the binaries hex information into memory

hexdump -ve '1/1 "%.2X"' /Users/MiRAGE/Downloads/MyApp.app/Contents/MacOS/MyApp | \

//calls sed to find the string of values and replace it with the new one.

sed "s/\x48\x85\xc0\x75\x33/\x48\x85\xc0\x74\x33/g" | \

//saves the new patched file as MyApp.Patched

xxd -r -p > /Users/MiRAGE/Downloads/MyApp.app/Contents/MacOS/MyApp.Patched | \

//cds to the directory of the patched file

cd /Users/MiRAGE/Downloads/MyApp.app/Contents/MacOS/ | \

// renames the file to its original executable name

mv /Users/MiRAGE/Downloads/MyApp.app/Contents/MacOS/MyApp.Patched /Users/MiRAGE/Downloads/MyApp.app/Contents/MacOS/MyApp | \

//sets the new file as executable after a password.

sudo chmod u+x /Users/MiRAGE/Downloads/MyApp.app/Contents/MacOS/MyApp

now this is my first attempt and i am aware some of the functions probably are completely wrong and really, apart from it does not do the patching and it deletes the contents of the binary it works as far as the renaming goes and hopefully gives you an overview of how i need the runtime of the script to work.

now i am a real newbie but i really need to get this done and i really have no idea what to do.

i need this script to basically work by waiting for the user to point the program in the direction of the file that needs patching (as I'm patching the apps iv made preferably it would accept dragging of a .app file into the window and it finding the binary in the macOSX folder by itself (this will come later tho and could also be done in various ways) i then need it to search for the string in the binary and replace it with the edited string in this case :-

original :- 4885c07533
patched:-4885c07433            {its worth re mentioning this string will always be unique but may vary in length depending on the function that needs patching}

I then need to save it with the same name as the original which this script handles by saving the patched file as .patched appended and subsequently renaming it accordingly .

It then makes the file executable and exits leaving the patched .app ready to run.

This method of creating patches would be particularly helpful if i notice i have made a mistake in many of my programs for instance. if the function is unique i could make a single patch that could edit the binaries at the touch of a button while just holding the section of code that is relevant to patch inside.

so to sum up.

what i am looking for is some way of getting this script working and maybe, if any of you can help a little advice on turning this into a little application to make my life easier.

many thanks in advance for any and all help you can offer. i will be checking daily so if i need to clarify something let me know and ill be on it in a flash.

MiRAGE

Answer 1

With regards to the sed line

sed "s/\x48\x85\xc0\x75\x33/\x48\x85\xc0\x74\x33/g"

Firstly, you can use sed to change around arbitrary binary - but you should beware newlines. sed processes its inputs always newline separated, so if the value \\x0a appears in your string you will have problems.

The following will allow you to consider the entire file as pure binary. (call sed with the -n option so that it won't print out lines after processing them by default).

# Append the current line to the hold space
H
# On the last line the hold space contains all of the file - now swap pattern and hold space, operate on the pattern space and print the line
${
    # exchange hold and pattern space
    x
    # do substitution
    s/.../.../g
    # print out result, required due to -n option
    p
}

or, more succinctly

sed -n 'H;${x;s/.../.../g;p}'

When you append the pattern space to hold space the new line will be inserted - so this circumvents issues with new lines.

Also, in your example you used double quotes for your sed expression. Due to shell escaping rules for backslashes and the nature of sed, I would recommend the use of single quotes to avoid complication. Apologies if it is the case that this is not true for your shell.

Lastly about sed, you should beware of special values contained in the hex. If you escape a byte literal in sed with \\x.., the way this is interpreted is by first replacing the escapted byte literal with its value, and then executing the line. Importantly, regex special characters still do what they do if they weren't escaped.

Example:

sed 's/\x5e\x2f/foo/'
# becomes
substitute pattern '\x5e\x2f' for 'foo'
# becomes
substitute pattern '^/' for 'foo'
# which matches a / at the beginning of a line as opposed to ^/

So the characters to look out for on the left of a substitution are the usual suspects, and beware \\x26 (&) on the right hand side of a substitution.

Hopefully that at least clarifies sed's potential role in your script :-).