ios - Parameters of guarded_open_np -

i found guarded_open_np function used libsqlite3.dylib open database file. had sqlite3 open source, there no such thing. apple has modified use guarded_open_np instead of unix's open.

i know guarded_open_np private api , found neither header nor documentation it. want interception (cydia's msfunctionhook) on guarded_open_np, need know parameters well, not function name.

i reverse-engineered libsqlite3.dylib using ida pro, how called guarded_open_np:

sub_79c1c: push {r7, lr} mov r7, sp sub sp, #0x4 mov r3, r1 movw r1, #0xc57e movt r1, #0x0 str r2, [sp, #0x4 + var_0] add r1, pc movs r2, #0xf blx imp___picsymbolstub4__guarded_open_np add sp, #0x4 pop {r7, pc}      

however, still not clear params take. appreciate if there official site mentioning guarded_open_np parameters.

from information that's here, don't believe we'll able give solid answer, though codafi's suggestion.

that said, here references may helpful in giving tools find out yourself:

first, know, learn registers , stack.

in assembly, call function typically follow called application binary interface (abi) sets conventions functions expect arguments (registers, stack etc), registers function call allowed change et cetera.

since ios, should looking @ procedure call standard arm architecture , ios abi function call guide.

looking @ "basic procedure call standard" section in first link above, can tell function calls expect first 4 arguments in registers r0~r4, respectively.

so investigation, want find out what's in these registers right before branching guarded_open_np stub. xcode can spit out assembly of file you, , should able set breakpoints on it; use register read command in llvm show register contents (note of registers may contain memory locations want examine memory read lldb commands).

for digging in bit more ios assembly, recommend mike ash's 3-part blog post "disassembling assembly" parts 1, 2 , 3. might recent post on arm 64 bit updates. these informal resources grips scanning assembly , knowing going on where.