Avatar
norio_nomura 3/31/2025 7:10 AM
SIP切ってexecsnoop(1m)ってのを使えばプロセス起動を監視できそうだけど、そこまでしたくないw
7:14 AM
xcrunも実装は/usr/lib/libxcselect.dylibの中。/usr/bin/xcrunは逆アセンブルをここに貼れるほど小さい。 $ otool -tv /usr/bin/xcrun /usr/bin/xcrun: (__TEXT,__text) section 0000000100000520 pacibsp 0000000100000524 stp x22, x21, [sp, #-0x30]! 0000000100000528 stp x20, x19, [sp, #0x10] 000000010000052c stp x29, x30, [sp, #0x20] 0000000100000530 add x29, sp, #0x20 0000000100000534 mov x19, x1 0000000100000538 mov x20, x0 000000010000053c bl 0x100000578 ; symbol stub for: _getprogname 0000000100000540 mov x8, x0 0000000100000544 ldrb w9, [x8], #0x1 0000000100000548 cmp w9, #0x2d 000000010000054c csel x21, x0, x8, ne 0000000100000550 adrp x1, 0 ; 0x100000000 0000000100000554 add x1, x1, #0x5a8 ; literal pool for: "xcrun" 0000000100000558 mov x0, x21 000000010000055c bl 0x100000588 ; symbol stub for: _strcasecmp 0000000100000560 cmp w0, #0x0 0000000100000564 csel x0, xzr, x21, eq 0000000100000568 sub w1, w20, #0x1 000000010000056c add x2, x19, #0x8 0000000100000570 mov w3, #0x0 0000000100000574 bl 0x100000598 ; symbol stub for: _xcselect_invoke_xcrun (edited)