自定义Clang命令，利用LLVM Pass实现对OC函数的静态插桩

- (NSInteger)foo:(NSInteger)num {    NSInteger result = 0;    if (num > 0) {        // 往这里插入一个桩函数：__hook_func_call(int,...)        result = num + 1;    }else {        // 往这里插入一个桩函数：__hook_func_call(int,...)        result = num + 2;    }    return result;}

namespace llvm {class InjectFuncCallPass : public PassInfoMixin {public:    /// 构造函数    /// AllowlistFiles 白名单    /// BlocklistFiles 黑名单    explicit InjectFuncCallPass(const std::vector &AllowlistFiles,const std::vector &BlocklistFiles) {        if (AllowlistFiles.size() > 0)          Allowlist = SpecialCaseList::createOrDie(AllowlistFiles,                                                   *vfs::getRealFileSystem());        if (BlocklistFiles.size() > 0)          Blocklist = SpecialCaseList::createOrDie(BlocklistFiles,                                                   *vfs::getRealFileSystem());    }  PreservedAnalyses run(Module &M, ModuleAnalysisManager &MAM);  bool runOnModule(llvm::Module &M);private:    std::unique_ptr Allowlist;    std::unique_ptr Blocklist;};} // namespace llvm

using namespace llvm;bool InjectArgsFuncCallPass::runOnModule(Module &M) {    bool Inserted = false;    auto &CTX = M.getContext();    for (Function &F : M) {        if (F.empty())            continue;;        if (F.isDeclaration()) {            continue;        }        if (F.getLinkage() == GlobalValue::AvailableExternallyLinkage)           continue;        if (isa(F.getEntryBlock().getTerminator()))           continue;;        if (Allowlist && !Allowlist->inSection("Inject-Args-Stub", "fun", F.getName())) {            continue;        }        if (Blocklist && Blocklist->inSection("Inject-Args-Stub", "fun", F.getName())) {            continue;        }        IntegerType *IntTy = Type::getInt32Ty(CTX);        PointerType* PointerTy = PointerType::get(IntegerType::get(CTX, 8), 0);        FunctionType *FuncTy = FunctionType::get(Type::getVoidTy(CTX), IntTy, /*IsVarArgs=*/true);        FunctionCallee FuncCallee = M.getOrInsertFunction("__afp_capture_arguments", FuncTy); // 取到一个callee        for (auto &BB : F) {            SmallVector<value*, 16=""> CallArgs;            for (Argument &A : F.args()) {                CallArgs.push_back(&A);            }            Builder.CreateCall(FuncCallee, CallArgs);        }      Inserted = true;    }    return Inserted;}PreservedAnalyses InjectArgsFuncCallPass::run(Module &M,                                              ModuleAnalysisManager &MAM) {   bool Changed =  runOnModule(M);   return (Changed ? llvm::PreservedAnalyses::none()                   : llvm::PreservedAnalyses::all());

static_library("InjectFuncCall") {  output_name = "LLVMInjectFuncCall"  deps = [    "//llvm/lib/Analysis",    "//llvm/lib/IR",    "//llvm/lib/Support",  ]  sources = [ "InjectFuncCall.cpp" ]}

"//llvm/lib/Transforms/Scalar",    "//llvm/lib/Transforms/Utils",    "//llvm/lib/Transforms/Vectorize",    "//llvm/lib/Transforms/InjectFuncCall",  ]  sources = [    "PassBuilder.cpp",

add_subdirectory(ObjCARC)add_subdirectory(Coroutines)add_subdirectory(CFGuard)add_subdirectory(InjectArgsFuncCall)

add_llvm_component_library(LLVMPasses  PassBuilder.cpp  PassBuilderBindings.cpp  PassPlugin.cpp  StandardInstrumentations.cpp  ADDITIONAL_HEADER_DIRS  ${LLVM_MAIN_INCLUDE_DIR}/llvm  ${LLVM_MAIN_INCLUDE_DIR}/llvm/Passes  DEPENDS  intrinsics_gen  LINK_COMPONENTS  AggressiveInstCombine  Analysis  Core  Coroutines  InjectArgsFuncCall  IPO  InstCombine  ObjCARC  Scalar  Support  Target  TransformUtils  Vectorize  Instrumentation  )

// 开始自定义的命令到Driverdef inject_func_call_stub_EQ : Joined<["-","--"],"add-inject-func-call=">, Flags<[NoXarchOption]>,HelpText<"Add Inject Func Call">;def inject_func_call_allowlist_EQ : Joined<["-","--"],"add-inject-allowlist=">, Flags<[NoXarchOption]>,HelpText<"Enable Inject Func Call From AllowList">;def inject_func_call_blocklist_EQ : Joined<["-","--"],"add-inject-blocklist=">, Flags<[NoXarchOption]>,HelpText<"Disable Inject Func Call From BlockList">;def inject_func_call : Flag<["-","--"],"add-inject-func-call">, Flags<[NoXarchOption]>, Alias, AliasArgs<["none"]>, HelpText<"[None] Add Inject Func Call.">;// 结束自定义的命令到Driver

//===----------------------------------------------------------------------===//// 自定义插桩 Options//===----------------------------------------------------------------------===//def inject_func_call_type : Joined<["-"],"inject_func_call_type=">, HelpText<"CC1 add args stub [bb,func]">;def inject_func_call_allowlist : Joined<["-"],"inject_func_call_allowlist=">, HelpText<"CC1 add args from allow list">;def inject_func_call_blocklist : Joined<["-"],"inject_func_call_blocklist=">, HelpText<"CC1 add args from block list">;

void Clang::ConstructJob(Compilation &C, const JobAction &JA,const InputInfo &Output, const InputInfoList &Inputs,const ArgList &Args, const char *LinkingOutput) const {......const SanitizerArgs &Sanitize = TC.getSanitizerArgs();Sanitize.addArgs(TC, Args, CmdArgs, InputType);/// 添加Driver 到Fronted之间的命令的链接  if(const Arg *arg = Args.getLastArg(options::OPT_inject_func_call_stub_EQ)){        StringRef val = arg->getValue();        if (val != "none") {            CmdArgs.push_back(Args.MakeArgString("-inject_func_call_type=" + Twine(val)));            StringRef allowedFile = Args.getLastArgValue(options::OPT_inject_func_call_allowlist_EQ);            llvm::errs().write_escaped("Clang:allowedFile:") << allowedFile << '\\n';            CmdArgs.push_back(Args.MakeArgString("-inject_func_call_allowlist=" + Twine(allowedFile)));            StringRef blockFile = Args.getLastArgValue(options::OPT_inject_func_call_blocklist_EQ);            llvm::errs().write_escaped("Clang:blockFile:") << blockFile << '\\n';            CmdArgs.push_back(Args.MakeArgString("-inject_func_call_blocklist=" + Twine(blockFile)));        }  }......}

  /// type of inject func call  std::string InjectFuncCallOption;  /// inject func allow list  std::vector InjectFuncCallAllowListFiles;  /// inject func block list  std::vector InjectFuncCallBlockListFiles;bool CompilerInvocation::ParseCodeGenArgs(CodeGenOptions &Opts, ArgList &Args,                                          InputKind IK,                                          DiagnosticsEngine &Diags,                                          const llvm::Triple &T,                                          const std::string &OutputFile,                                          const LangOptions &LangOptsRef) {...for (const auto &Arg : Args.getAllArgValues(OPT_inject_args_stub_type)) {      StringRef Val(Arg);      Opts.InjectArgsOption = Args.MakeArgString(Val);  }  Opts.InjectArgsAllowListFiles = Args.getAllArgValues(OPT_inject_args_stub_allowlist);  Opts.InjectArgsBlockListFiles = Args.getAllArgValues(OPT_inject_args_stub_blocklist);...}

#include "llvm/Transforms/InjectArgsFuncCall/InjectArgsFuncCall.h"// 最后添加 Inject Args Function Pass。if (CodeGenOpts.InjectArgsOption.size() > 0) {      MPM.addPass(InjectArgsFuncCallPass(CodeGenOpts.InjectArgsAllowListFiles, CodeGenOpts.InjectArgsBlockListFiles));}

cd llvm-project// 新建一个build文件夹来生成工程mkdir build cd build// -G Xcode会cmake出来一个xcode工程，也可以选择ninjacmake -DLLVM_ENABLE_PROJECTS=clang -G Xcode ../llvm// 执行结束后，会在build文件夹生成完整的工程目录

// 指定使用new pass manager，llvm里面有两套写自定pass的接口，现在是使用新的接口。-fexperimental-new-pass-manager// 启动功能，以基础块级别地插入函数-add-inject-func-call=bb// 设置白名单，只有在白名单里面的文件/函数才会插桩-add-inject-allowlist=$(SRCROOT)/config/allowlist.txt// 设置黑名单，黑名单里指定的文件/函数会忽略掉-add-inject-blocklist=$(SRCROOT)/config/blocklist.txt

#指定对应的section[InjectFuncCallSection]# 指定对应的文件src:/OC-Hook-Demo/OC-Hook-Demo/Foo.m# 指定对应的函数名，*号可支持模糊匹配func:*foo*

void** hook\_func\_call(int args, ...) {  ...}