mediaserverd

1、mediaserverd是什么　

　　mediaserverd(/usr/sbin/mediaserverd)是被root进程launchd启动的一个后台（daemon）进程，其描述文件为com.apple.mediaserverd.plist存放在
　　/System/Library/LaunchDaemon目录下，系统在启动的时候会扫描该目录下面所有的plist文件，分别启动所有后台进程，大概有
　　50多个，后台进程是iOS系统实现伪后台的真正原因。

　　com.apple.mediaserverd.plist 描述了mediaserverd启动、以及服务的相关信息，mediaserverd主要为系统提供音视频编解码的服务，包含声音输出录音，视频解码编码等。

　　通过plist中 com.apple.airplay.sender.xpc 的描述，可以看出来mediaserverd提供了一个xpc的服务

　　XPC是苹果系统上一种进程间通信的技术，XPC 目的是提高 App 的安全性和稳定性。XPC 让进程间通信变得更容易，让我们能够相对容易地将 App 拆分成多个进程的模式。

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

<key>MachServices</key>
    <dict>
        <key>com.apple.BTAudioHALPlugin.xpc</key>
        <true/>
        <key>com.apple.airplay.sender.xpc</key>
        <true/>
        <key>com.apple.audio.AUPBServer</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.audio.AURemoteIOServer</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.audio.AudioConverterServer</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.audio.AudioFileServer</key>
        <true/>
        <key>com.apple.audio.AudioQueueServer</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.audio.AudioSession</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.audio.AudioUnitServer</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.audio.SystemSounds</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.coremedia.admin</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.coremedia.asset</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.coremedia.assetimagegenerator</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.coremedia.audiodeviceclock</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.coremedia.audioprocessingtap</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.coremedia.cpe</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.coremedia.cpeprotector</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.coremedia.endpoint</key>
        <true/>
        <key>com.apple.coremedia.formatreader</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.coremedia.mutablecomposition</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.coremedia.recorder</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.coremedia.remaker</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.coremedia.sandboxserver</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.coremedia.videocompositor</key>
        <true/>
        <key>com.apple.coremedia.videoqueue</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.coremedia.virtualdisplay</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.coremedia.virtualdisplayserver</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.fig.movie</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.mediaserverd</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.videoconference.avconference</key>
        <dict>
            <key>ResetAtClose</key>
            <true/>
        </dict>
        <key>com.apple.videoconference.camera</key>
        <dict/>
    </dict>

2、mediaserverd进程的作用和工作原理

　　mediaserverd提供音视频服务功能，用户app进程通过调用xpc服务，对视频进行解码编码。

　　xpc调用参考：https://objccn.io/issue-14-4/

　　音视频的解码涉及到对硬件的操作，mediaserverd中包含大量调用驱动层的代码，通过xpc可以防止用户进行溢出攻击，提高系统的稳定性。因为同一的xpc接口，跨进程，提高了溢出攻击伪造数据的难度。

　　在越狱手机上通过对mediaserverd中声音的服务进行hook，可以进行录音，比如通话录音等。

3、mediaserverd 中有用的方法

　　通过反汇编发现mediaserverd由C编写，不是mach-o格式的二进制文件，反汇编之后暴露出来的符号较少，通过class-dump无法提取有用信息。

　　下面是一段播放系统铃音的代码

int sub_b4fc() {
    sp = sp - 0x8;
    r0 = *0x23b50;
    if (r0 != 0x0) goto loc_b5fc;
 
loc_b514:
    r0 = dlopen("/System/Library/PrivateFrameworks/MediaToolbox.framework/MediaToolbox", 0x1);
    *(0x23b50 + 0x4) = r0;
    if (r0 != 0x0) goto loc_b54a;
 
loc_b528:
    r1 = dlopen("/System/Library/PrivateFrameworks/Celestial.framework/Celestial", 0x1);
    r0 = 0x21666967;
    *(0x23b50 + 0x4) = r1;
    if (r1 == 0x0) goto .l3;
 
loc_b54a:
    dlerror();
    *0x23b50 = dlsym(*(0x23b50 + 0x4), "FigMediaServerStart");
    r0 = dlerror();
    if ((r0 != 0x0) || (*0x23b50 == 0x0)) goto loc_b600;
 
loc_b56e:
    *(0x23b50 + 0x8) = dlsym(*(0x23b50 + 0x4), "FigMediaServerStop");
    r0 = dlerror();
    if ((r0 != 0x0) || (*(0x23b50 + 0x8) == 0x0)) goto loc_b600;
 
loc_b58e:
    *(0x23b50 + 0xc) = dlsym(*(0x23b50 + 0x4), "FigMediaServerSystemSoundIDShouldPlayWithVolume");
    r0 = dlerror();
    if ((r0 != 0x0) || (*(0x23b50 + 0xc) == 0x0)) goto loc_b600;
 
loc_b5aa:
    *(0x23b50 + 0x10) = dlsym(*(0x23b50 + 0x4), "FigMediaServerVibrateForSystemSoundID");
    r0 = dlerror();
    if ((r0 != 0x0) || (*(0x23b50 + 0x10) == 0x0)) goto loc_b600;
 
loc_b5c6:
    *(0x23b50 + 0x14) = dlsym(*(0x23b50 + 0x4), "FigMediaServerSystemSoundIDActivate");
    r0 = dlerror();
    if ((r0 != 0x0) || (*(0x23b50 + 0x14) == 0x0)) goto loc_b600;
 
loc_b5e2:
    r4 = 0x23b50;
    asm{ ldrd       r0, r1, [r0] };
    asm{ stm.w      sp, {r0, r1} };
    FigRecalcSumIndex();
    r0 = *r4;
    goto loc_b5fc;
 
loc_b5fc:
    r0 = (r0)(r0);
    return r0;
 
.l3:
    return r0;
 
loc_b600:
    r1 = "%s\n";
    r3 = *___stderrp;
    fprintf(r3, r1);
    r0 = 0x21666967;
    return r0;
}