Crash when hook fonction `object_setClass`

[Yanni Wang 王氩]

What crash

When I hook fonction object_setClass, then call object_setClass, it works. but when I call [NSString stringWithFormat:@"%@", @""];, It crash.

Demo code

#import <UIKit/UIKit.h>
#import "fishhook.h"
#import <objc/runtime.h>

Class _Nullable
(*orig_object_setClass)(id _Nullable obj, Class _Nonnull cls);

Class _Nullable
my_object_setClass(id _Nullable obj, Class _Nonnull cls)
{
    return orig_object_setClass(obj, cls);
}


int main(int argc, char * argv[]) {
    @autoreleasepool {
        rebind_symbols((struct rebinding[]){
            {"object_setClass", my_object_setClass, (void *)&orig_object_setClass}
        }, 1);
        
        object_setClass(@"", NSObject.class);
        
        [NSString stringWithFormat:@"%@", @""];
        
        return 0;
    }
}

[XjShi]

It may be a careless mistake. Try this:

Class _Nullable
my_object_setClass(id _Nullable obj, Class _Nonnull cls)
{
    return orig_object_setClass(obj, cls);
}

[Yanni Wang 王氩]

Hi @XjShi , I fix it. But still crash:

[XjShi]

Call object_setClass(@"", NSObject.class) can also cause crash without hook object_setClass.

[Yanni Wang 王氩]

@XjShi I tried. It doesn't crash without hooking.

#import "AppDelegate.h"
#import <UIKit/UIKit.h>
#import "fishhook.h"
#import <objc/runtime.h>

Class _Nullable
(*orig_object_setClass)(id _Nullable obj, Class _Nonnull cls);

Class _Nullable
my_object_setClass(id _Nullable obj, Class _Nonnull cls)
{
    return orig_object_setClass(obj, cls);
}


int main(int argc, char * argv[]) {
    @autoreleasepool {
//        rebind_symbols((struct rebinding[]){
//            {"object_setClass", my_object_setClass, (void *)&orig_object_setClass}
//        }, 1);
        
        object_setClass(@"", NSObject.class);
        
        [NSString stringWithFormat:@"%@", @""];
        
        return UIApplicationMain(argc, argv, nil, NSStringFromClass([AppDelegate class]));
    }
}

[XjShi]

It may be an 'undefined' behavior. I tried this in several different situation. Crash did happens in some situation.

I don't know anything deeper about object_class. 😢

[Yanni Wang 王氩]

Thanks @XjShi .

[Yanni Wang 王氩]

Found the answer: https://stackoverflow.com/a/62068020/9315497
Tagged Pointer Strings are special objects.