Regression in %hookf about logos HOT 4 OPEN

This is by design. It’s not recommended to use MSFindSymbol() or dlsym() with NULL passed as the image argument, as looking up a symbol across the entire set of images loaded in the processes is slow. Unfortunately the initial design of %hookf encouraged this. Instead, define it yourself by passing the pointer into %init:

%hookf(void, afunction) {
  // …
}

%ctor {
  void *myLib = dlopen("/System/Library/PrivateFrameworks/Awesome.framework/Awesome", RTLD_NOLOAD);
  void *myFunc = dlsym(myLib, "afunction");
  %init(afunction = myFunc);
}

from logos.

Thanks @NSExceptional .

What about adding an optional:

%hooklib "/System/Library/PrivateFrameworks/Awesome.framework/Awesome"
%hookf ....
%end

Best of both world?

@kirb I write most of my tweaks without logos, but I love to have logos when I need to do a quick and dirty proof of concept or a throw away analysis tweak. Having to write the constructor defeats the purpose of %hookf as I may as well call MSHookFunction by hand at this point.

from logos.

@kirb I actually got the OK from @uroboro to revert this regression when I have time

from logos.

An idea that floated around when I originally introduced this feature was to specify the library along with the function name:

%hookf(void, "/System/Library/PrivateFrameworks/Awesome.framework/Awesome:aFunction") {
}

from logos.