Hooking function on macOS Ventura does not work anymore

[vanhauser-thc]

libtokencap and libdislocator do not work anymore on macOS in the newest OS release.

to reproduce:

make -C utils/libtokencap
make -C utils/libdislocator
test/test-libextensions.sh

DYLD_INSERT_LIBRARIES still works (constructors are triggered), however trying to hook libc functions do not seem to work.
e.g. strcmp, _strcmp, __impl__strcmp, __platform_strcmp - none of them are called in a lib that hooks these and a program that uses strcmp() in its code and compiled with -O0

Apparently this is an issue since Monterey (12.2.1) https://developer.apple.com/forums/thread/702374

[vanhauser-thc]

@devnexen any idea?

[devnexen]

No real idea but no surprise it is becoming increasingly difficult in that area.
However, would using calls interposition work ?

[vanhauser-thc]

hmmm that seems to work. but results in a major rework of everything preload. damn.

[seanm]

libtokencap and libdislocator do not work anymore on macOS in the newest OS release.

What does this mean concretely for afl++ Mac users? i.e. those of us that know nothing about how afl++ is implemented, but merely use it? Is afl++ totally broken on Ventura? Do only some features not work?

[vanhauser-thc]

reading the docs will answer your question. short: everything documented should work, these two libs a not essential.

[seanm]

short: everything documented should work, these two libs a not essential.

Thanks. I'm trying to use afl++ again after giving up some months ago, I thought maybe this Issue explained #1865. But I guess not.