Issues with EasySIMBL and OS X 10.11 El Capitan

[antons]

It appears that 10.11b1 is not affected by the issue described in #25.

However, one of my plugins which previously injected into the target app just fine, now has issues.

Plugin is injected into the app only if I do the following.

1. Restart the system.
2. Launch Gitbox.
3. Launch EasySIMBL, and check “Use SIMBL” (it is disabled on every relaunch of the system).

If I initially turn on SIMBL before launching Gitbox, or quit Gitbox after the first injection and launch it again, the following message is logged into console (and the plugin is not injected).

09.06.15 18:06:32,626 Gitbox[1219]: Error loading /Users/Anton/Library/ScriptingAdditions/EasySIMBL.osax/Contents/MacOS/EasySIMBL:  dlopen(/Users/Anton/Library/ScriptingAdditions/EasySIMBL.osax/Contents/MacOS/EasySIMBL, 262): no suitable image found.  Did find:
    /Users/Anton/Library/ScriptingAdditions/EasySIMBL.osax/Contents/MacOS/EasySIMBL: open() failed with errno=24

Any thoughts on what might be causing this?

[norio-nomura]

I have not yet tested on OS X 10.11, but I think it will be checked by attaching debugger to Gitbox.
On debugger's console, I did following:

(lldb) call (void*)dlopen("/Users/norio/Library/ScriptingAdditions/EasySIMBL.osax/Contents/MacOS/EasySIMBL",0)
(void *) $0 = 0x0000608000167980

and did resume the process.
On OS X 10.10.4 (14E33b), I got Gitbox Tweaks 1.2 working on Gitbox 1.6.2 with above.

Maybe it will be possible for open() or other APIs.

[jensfrancis]

Tested SafariStrand on EasySIMBL with OS X 10.11 Build 15A178w. No dice.

[catlan]

Runtime protections

Injecting code into a process is equivalent to modifying the binary on disk
Processes are marked restricted by the kernel

• Main executable is protected on disk
• (other stuff went by fast, watch the video)

https://forums.developer.apple.com/message/7363#7363

[antons]

@catlan I’m not sure how rutime protection is related to my question, considering that the issue is only with one app, which loads plugins, but once, and only fails to do it again unless the system is restarted. Other plugins are injected into other apps without any issues.

[orbitly]

Can confirm it continues to not work on beta 2 (15A204h)

[d235j]

@orbitly: 10.11 developer preview 2 has begun enforcing code injection restrictions. You will need to boot into recovery mode and disable System Integrity Protection for EasySIMBL to work.

[catlan]

@d235j can you confirm that System Integrity Protection protects all apps from code injection or does it just protect system apps?

[fjolnir]

Disabling SIP didn't fix things for me. (TotalFinder on the other hand did start working after disabling it)

[rpendleton]

@catlan @d235j I don't have the beta installed, but the WWDC slides say System Integrity Protection will "Prevent runtime attachment and code injection into system binaries." It wouldn't surprise me if injection still works with normal apps.

[norio-nomura]

Maybe #25 will prevent EasySIMBL working if SIP is disabled on OS X 10.11.

[w0lfschild]

Yup even with SIP off on 10.11 (15A204h) I'm not having success with anything loading.

[rpendleton]

@norio-nomura It looks like that's probably the problem.

I just installed a VM of OS X 10.11. To ensure that SIP was enabled, I tried to create a file in /System/ as root and I received an operation not permitted error. When I tried to inject code using my own method, it worked fine on some executables but not others.

$ ls
2015-06-28 22:34:10.827 ls[404:6219] TestInject Loaded
Desktop
Documents
Downloads
Library
Movies
Music
Pictures
Public

$ /Applications/TextEdit.app/Contents/MacOS/TextEdit
2015-06-28 22:36:14.378 TextEdit[405:6555] TestInject Loaded

I was able to inject code into Console, Terminal, TextEdit, ls, and a few others. However, I was not able to inject code into Finder, Safari, or Notes.

[norio-nomura]

FYI about SIP http://blog.binaryage.com/el-capitan-update/