substitute bug on arm?

[bitmizone]

app crash when i hook DNSServiceGetAddrInfo, SSLSetConnection

cpu architecture: arm 32bit
os version: ios8 ios9

[comex]

I'll look at this.

edit: Since you mention iOS 9 - are you jailbroken?

[bitmizone]

not jailbroken on ios9.

when i hook socket connect() ，it also crash after running for some time. I do not know when it crash, but there will always crash.
cpu architecture: arm 64bit
os version: iphone5s ios8.3 jailbroken

static const struct substitute_function_hook hooks[] = {
{connect, my_connect, &orig_connect, 0},
}
substitute_hook_functions(hooks,
sizeof(hooks)/sizeof(*hooks),
NULL,
SUBSTITUTE_NO_THREAD_SAFETY);

error tips:
error: memory read failed for 0x0
lldb bt show:
frame #0: 0x0000000000000000
frame #1: 0x00000001956d3c74 libsystem_network.dylibnetcore_create_control_socket + 224 frame #2: 0x00000001956c1730 libsystem_network.dylibget_host_counts + 72
frame #3: 0x00000001956e2294 libsystem_network.dylibtcp_connection_destination_create + 324 frame #4: 0x00000001956c4e90 libsystem_network.dylibtcp_connection_destination_add + 72
frame #5: 0x00000001956ddb08 libsystem_network.dylibtcp_connection_host_resolve_result + 1392 frame #6: 0x0000000195633c2c libsystem_dnssd.dylibhandle_addrinfo_response + 420
frame #7: 0x0000000195631f20 libsystem_dnssd.dylibDNSServiceProcessResult + 660 frame #8: 0x0000000100154f94 libdispatch.dylib_dispatch_client_callout + 16
frame #9: 0x000000010016c848 libdispatch.dylib_dispatch_source_latch_and_call + 1392 frame #10: 0x00000001001571c0 libdispatch.dylib_dispatch_source_invoke + 292
frame #11: 0x0000000100160384 libdispatch.dylib_dispatch_queue_drain + 2264 frame #12: 0x00000001001582c4 libdispatch.dylib_dispatch_queue_invoke + 132
frame #13: 0x00000001001625d4 libdispatch.dylib_dispatch_root_queue_drain + 772 frame #14: 0x0000000100164248 libdispatch.dylib_dispatch_worker_thread3 + 132
frame #15: 0x000000019571522c libsystem_pthread.dylib`_pthread_wqthread + 816

(lldb) bt

• thread Use TASK_VM_INFO to obtain target page size rather than hardcoding based on architecture #6: tid = 0x364c, 0x0000000000000000, queue = 'com.apple.CFNetwork.SPDY.Connection', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  • frame #0: 0x0000000000000000
    frame How is the dylib API gonna work? #1: 0x000000018306b494 CFNetworkSocketStream::securityRead_NoLock(unsigned char*, long, unsigned char*, unsigned char*) + 164 frame #2: 0x000000018306b2d0 CFNetworkSocketStream::securityBufferedRead_NoLock() + 168
    frame Better Cydia reboot #3: 0x00000001830f1aa4 CFNetworkSocketStream::canRead(__CFReadStream*) + 200 frame #4: 0x000000018365c4b0 CoreFoundationCFReadStreamHasBytesAvailable + 264
    frame ios 8 is now a dependency, readme should reflect it #5: 0x0000000183091bc4 CFNetworkSPDYConnection::_onqueue_scheduleIO() + 272 frame #6: 0x0000000183091a9c CFNetwork___ZN14SPDYConnection10scheduleIOEv_block_invoke + 24
    frame Use safe_mode when flag is set on boot for OS X #7: 0x00000001000ccfd4 libdispatch.dylib_dispatch_call_block_and_release + 24 frame #8: 0x00000001000ccf94 libdispatch.dylib_dispatch_client_callout + 16
    frame Unable to compile substitute for iOS due to manual_thread_get_state in execmem.c #9: 0x00000001000d7db8 libdispatch.dylib_dispatch_queue_drain + 780 frame #10: 0x00000001000d02c4 libdispatch.dylib_dispatch_queue_invoke + 132
    frame substitute bug on arm? #11: 0x00000001000da5d4 libdispatch.dylib_dispatch_root_queue_drain + 772 frame #12: 0x00000001000dc248 libdispatch.dylib_dispatch_worker_thread3 + 132
    frame Feasibility of using these techniques in-process to self-patch an iOS application #13: 0x000000019571522c libsystem_pthread.dylib`_pthread_wqthread + 816

sorry for my english