,---------------------------,
  Header    |  Mach header              |
            |    Segment 1              |
            |      Section 1 (__text)   | --,
            |---------------------------|   |
  Data      |           blob            | <-'
            '---------------------------'

-1) header structure：The header contains general information about the binary: byte order (magic number), CPU type, amount of load commands, etc.
-2)The load commands section is like a table of contents of the binary: 
it describes the position of the segments, symbols table, dynamic symbols table etc. 
Each load command includes meta-information, such as type of command, its name, position in a binary, etc. 
-3) 链接信息：The data section contains the application code and the data, such as symbol tables, dynamic symbol tables, etc.

Header: Specifies the target architecture of the file, such as PPC, PPC64, IA-32, or x86-64.
Load commands: Specify the logical structure of the file and the layout of the file in virtual memory.
Raw segment data: Contains raw data for the segments defined in the load commands.

- 1. Insert the library to the application container

- 2. Insert the load command on the load commands section of the binary

- 3. Increment the load command counter on the header section

- 4. Increase the size binary number on the header section

#define MH_OBJECT 0x1   /* relocatable object file  gcc -c xxx.c 生成xxx.o文件 */
#define MH_EXECUTE  0x2   /* demand paged executable file */
#define MH_FVMLIB 0x3   /* fixed VM shared library file */
#define MH_CORE   0x4   /* core file 崩溃时的Dump文件 */
#define MH_PRELOAD  0x5   /* preloaded executable file */
#define MH_DYLIB  0x6   /* dynamically bound shared library */
#define MH_DYLINKER 0x7   /* dynamic link editor */
#define MH_BUNDLE 0x8   /* dynamically bound bundle file */
#define MH_DYLIB_STUB 0x9   /* shared library stub for static */
          /*  linking only, no section contents */
#define MH_DSYM   0xa   /* companion file with only debug */
          /*  sections */
#define MH_KEXT_BUNDLE  0xb   /* x86_64 kexts 内核扩展文件 */

#define MH_PIE 0x200000     /* When this bit is set, the OS will
             load the main executable at a
             random address.  Only used in
             MH_EXECUTE filetypes. */
#define MH_ALLOW_STACK_EXECUTION 0x20000/* When this bit is set, all stacks 
             in the task will be given stack
             execution privilege.  Only used in
             MH_EXECUTE filetypes. */
#define MH_NO_HEAP_EXECUTION 0x1000000  /* When this bit is set, the OS will
             run the main executable with
             a non-executable heap even on
             platforms (e.g. i386) that don't
             require it. Only used in MH_EXECUTE
             filetypes. */
#define  MH_NOUNDEFS 0x1   /* the object file has no undefined
             references */

#define LC_SEGMENT  0x1 /* segment of this file to be mapped */
#define LC_LOAD_DYLIB 0xc /* load a dynamically linked shared library */
#define LC_ENCRYPTION_INFO 0x21 /* encrypted segment information */
#define LC_CODE_SIGNATURE 0x1d  /* local of code signature */
#define LC_UUID   0x1b  /* the uuid */

struct segment_command { /* for 32-bit architectures */
  uint32_t  cmd;    /* LC_SEGMENT */
  uint32_t  cmdsize;  /* includes sizeof section structs */
  char    segname[16];  /* segment name */
  uint32_t  vmaddr;   /* memory address of this segment */
  uint32_t  vmsize;   /* memory size of this segment */
  uint32_t  fileoff;  /* file offset of this segment */
  uint32_t  filesize; /* amount to map from the file */
  vm_prot_t maxprot;  /* maximum VM protection */
  vm_prot_t initprot; /* initial VM protection */
  uint32_t  nsects;   /* number of sections in segment */
  uint32_t  flags;    /* flags */
};

struct section { /* for 32-bit architectures */
  char    sectname[16]; /* name of this section */
  char    segname[16];  /* segment this section goes in */
  uint32_t  addr;   /* memory address of this section */
  uint32_t  size;   /* size in bytes of this section */
  uint32_t  offset;   /* file offset of this section */
  uint32_t  align;    /* section alignment (power of 2) */
  uint32_t  reloff;   /* file offset of relocation entries */
  uint32_t  nreloc;   /* number of relocation entries */
  uint32_t  flags;    /* flags (section type and attributes)*/
  uint32_t  reserved1;  /* reserved (for offset or index) */
  uint32_t  reserved2;  /* reserved (for count or sizeof) */
};

#define SEG_PAGEZERO  "__PAGEZERO"  /* the pagezero segment which has no */
          /* protections and catches NULL */
          /* references for MH_EXECUTE files */


#define SEG_TEXT  "__TEXT"  /* the tradition UNIX text segment 含有可执行代码和只读的数据。 为了让内核将它 直接从可执行文件映射到共享内存，静态连接器设置该段的虚拟内存权限为不允许写。当这个段被映射到内存后，可以被所有进程共享。（这主要用在frameworks, bundles和共享库等程序中，也可以为同一个可执行文件的多个进程拷贝使用） */
#define SECT_TEXT "__text"  /* the real text part of the text */
          /* section no headers, and no padding */
#define SECT_FVMLIB_INIT0 "__fvmlib_init0"  /* the fvmlib initialization */
            /*  section */
#define SECT_FVMLIB_INIT1 "__fvmlib_init1"  /* the section following the */
                  /*  fvmlib initialization */
            /*  section */

#define SEG_DATA  "__DATA"  /* the tradition UNIX data segment */
#define SECT_DATA "__data"  /* the real initialized data section */
          /* no padding, no bss overlap */
#define SECT_BSS  "__bss"   /* the real uninitialized data section*/
          /* no padding */
#define SECT_COMMON "__common"  /* the section common symbols are */
          /* allocated in by the link editor */

#define SEG_OBJC  "__OBJC"  /* objective-C runtime segment */
#define SECT_OBJC_SYMBOLS "__symbol_table"  /* symbol table */
#define SECT_OBJC_MODULES "__module_info" /* module information */
#define SECT_OBJC_STRINGS "__selector_strs" /* string table */
#define SECT_OBJC_REFS "__selector_refs"  /* string table */

#define SEG_ICON   "__ICON" /* the icon segment */
#define SECT_ICON_HEADER "__header" /* the icon headers */
#define SECT_ICON_TIFF   "__tiff" /* the icons in tiff format */

#define SEG_LINKEDIT  "__LINKEDIT"  /* the segment containing all structs */
          /* created and maintained by the link */
          /* editor.  Created with -seglinkedit */
          /* option to ld(1) for MH_EXECUTE and */
          /* FVMLIB file types only */

#define SEG_UNIXSTACK "__UNIXSTACK" /* the unix stack segment */

#define SEG_IMPORT  "__IMPORT"  /* the segment for the self (dyld) */
          /* modifing code stubs that has read, */
          /* write and execute permissions */

devzkndeMacBook-Pro:bin devzkn$ otool -d vi
vi:
Contents of (__DATA,__data) section

devzkndeMacBook-Pro:bin devzkn$ otool -sv  __DATA __data vi
vi:
Contents of (__DATA,__data) section
00000001001a2b20  c0 5b 17 00 01 00 00 00 c8 62 17 00 01 00 00 00 
00000001001a2b30  cf 5b 17 00 01 00 00 00 37 5c 17 00 01 00 00 00 

devzkndeMacBook-Pro:bin devzkn$ otool -tv vi
vi:
(__TEXT,__text) section
0000000100000b34  pushq %rbp
0000000100000b35  movq  %rsp, %rbp
0000000100000b38  pushq %r15
0000000100000b3a  pushq %r14
0000000100000b3c  pushq %r13

Failed to spawn: unable to launch iOS app: timeout  

devzkndeMacBook-Pro:~ devzkn$ /Users/devzkn/Downloads/frida-ios-dump-master/dump.py 邮件
open target app......
devzkndeMacBook-Pro:~ devzkn$

evzkndeMacBook-Pro:frida-ios-dump-master devzkn$  frida -U -p 1292
     ____
    / _  |   Frida 10.6.27 - A world-class dynamic instrumentation framework
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at http://www.frida.re/docs/home/
                                                                                
}
[iPhone::PID::1292]-> obj
                          ObjC                          
                          Object

Frida 从 9.0 开始，改 hook launchd 来 spawn process，Frida 8.2.5 以前是利用 dylib 注入的方式来 spawn。

目前解决方法:
1.降回旧版Frida
2.不要使用spawn

我之前也一直在研究这个问题，目前只知道 Frida spawn process 在修改 kernel process flags 时，会导致32-bit 装置重启，不过我还没研究出为什么，大概只能判断 32-bit, 64-bit kernel 处理稍有不同。

有人懂这一块地也希望能一起研究研究

devzkndeMacBook-Pro:zhangkn.github.io devzkn$ frida -U -p 1262
     ____
    / _  |   Frida 10.6.27 - A world-class dynamic instrumentation framework
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at http://www.frida.re/docs/home/
                                                                                
[iPhone::PID::1262]-> 

(Pdb) l
108  		script = loadJsFile(session, APP_JS);
109  		name = target.decode('utf8');
110  		script.post(name);
111  		opened.wait();
112  		session.detach();
113  ->		createDir(os.getcwd()+"/"+OUTPUT)
114  		print "start dump target app......"
115  		session = device.attach(name);
116  		script = loadJsFile(session, DUMP_JS);
117  		script.post("dump");
118  		finished.wait();
(Pdb) s
--Return--
> /Users/devzkn/Downloads/kevin－software/ios-Reverse_Engineering/frida-ios-dump-master/dump.py(113)main()->None
-> createDir(os.getcwd()+"/"+OUTPUT)
(Pdb) l
108  		script = loadJsFile(session, APP_JS);
109  		name = target.decode('utf8');
110  		script.post(name);
111  		opened.wait();
112  		session.detach();
113  ->		createDir(os.getcwd()+"/"+OUTPUT)
114  		print "start dump target app......"
115  		session = device.attach(name);
116  		script = loadJsFile(session, DUMP_JS);
117  		script.post("dump");
118  		finished.wait();
(Pdb) s
UnicodeDecodeError: UnicodeD...ge(128)')
> /Users/devzkn/Downloads/kevin－software/ios-Reverse_Engineering/frida-ios-dump-master/dump.py(127)<module>()
-> main(sys.argv[1])
(Pdb) l
122  		if len(sys.argv) < 2:
123  			print "usage: ./dump.py 微信"
124  			sys.exit(0)
125  		else:
126  			try:
127  ->				main(sys.argv[1])
128  			except KeyboardInterrupt:
129  				if session:
130  					session.detach()
131  				sys.exit()
132  			except:
(Pdb) s
> /Users/devzkn/Downloads/kevin－software/ios-Reverse_Engineering/frida-ios-dump-master/dump.py(128)<module>()
-> except KeyboardInterrupt:
(Pdb) pp UnicodeDecodeError
<type 'exceptions.UnicodeDecodeError'>

#!/bin/sh
# frida-ps -Uai 查看，来获取参数
# usage: devzkndeMacBook-Pro:~ devzkn$ kndump 邮件
# dump app   
cd ~/decrypted/frida-ios-dump-master 
rm -rf ./Payload
./dump.py $1
open .
exit 0