前面讲解了修改单架构二进制文件实现动态库注入，本篇继续讲解修改胖二进制文件实现动态库注入。注入方式并无不同，不过需要注意修改文件时的地址偏移，否则修改错误会导致文件无法解析。本文所展示的代码片段来自开源项目FishHook，更多细节可参考该项目。

如下图，胖二进制包含多种CPU架构，一般是X86_64和ARM64，胖二进制相当于多个单二进制的组合体。使用系统自带的工具lipo可以添加、提取、删除以及替换胖二进制中的某个架构的二进制，这里不多做介绍。

胖二进制文件格式

修改胖二进制首先需要解析Fat Header，通过文件头获取所支持的架构数量及各架构描述内容的偏移地址。注意，获取数据时根据机器的大端/小端模式不同，需要对数据进行处理。一般PC机都是小端模式，因此需要将高低位地址上的数据进行交换。多架构二进制的修改直接复用了单架构的代码，processThinMachO相关代码请参考上文或FishHook项目。

func repackBinary() -> Bool {
        if machOData.isEmpty {
            return false
        }
        
        return machOData.withUnsafeBytes { pointer in
            guard let header = pointer.bindMemory(to: fat_header.self).baseAddress else {
                print("[ERROR] Failed to get fat header pointer.")
                return false
            }
            
            var result = false
            var offset = MemoryLayout<fat_header>.size
            let archNum = _OSSwapInt32(header.pointee.nfat_arch)
            
            switch header.pointee.magic {
            case FAT_MAGIC, FAT_CIGAM:
                if archNum == 0 {
                    print("[ERROR] Format of Fat-MachO is invalid.")
                    return false
                }
                
                for i in 0 ..< archNum {
                    if i > 0 {
                        offset = offset + MemoryLayout<fat_arch>.size
                    }
                    result = processFatMachO(offset: offset)
                    if !result {
                        return false
                    }
                }
            case MH_MAGIC_64, MH_CIGAM_64, MH_MAGIC, MH_CIGAM:
                result = processThinMachO(offset: 0)
            default:
                print("[ERROR] Unknown MachO format.")
                return false
            }
            
            signAdhoc()
            return result
        }
    }
    
    private func processFatMachO(offset: Int) -> Bool {
        let fatData = machOData.advanced(by: offset)
        return fatData.withUnsafeBytes { pointer in
            guard let arch = pointer.bindMemory(to: fat_arch.self).baseAddress else {
                print("[ERROR] Failed to get fat arch pointer.")
                return false
            }
            
            let offset = _OSSwapInt32(arch.pointee.offset)
            return processThinMachO(offset: Int(offset))
        }
    }

上文提到，在插入动态库注入指令时并没有判断是否有足够的空白区域容纳，如果空间不足，插入会覆盖有效数据，进而导致二进制格式错误。插入空间判断代码如下：

private func isSpaceEnough(header: mach_header, offset: Int, is64bit: Bool) ->Bool {
        let pathSize = (dylibPath.count & ~(pathPadding - 1)) + pathPadding
        let injectSpace = MemoryLayout<dylib_command>.size + pathSize
        let headerSize = is64bit ? MemoryLayout<mach_header_64>.size : MemoryLayout<mach_header>.size
        
        var segOffset = offset
        for _ in 0 ..< header.ncmds {
            let segData = machOData.subdata(in: segOffset..<segOffset+MemoryLayout<segment_command_64>.size)
            guard let segCmd = getSegmentCommand(data: segData) else {
                print("[ERROR] Failed to get segment command pointer.")
                return false
            }
            
            var segName = segCmd.segname
            if (strncmp(&segName.0, "__TEXT", 15) == 0) {
                for i in 0 ..< segCmd.nsects {
                    let sectOffset = segOffset + MemoryLayout<segment_command_64>.size + MemoryLayout<section_64>.size * Int(i)
                    let sectData = machOData.subdata(in: sectOffset..<sectOffset+MemoryLayout<section_64>.size)
                    guard let sectCmd = getSectionCommand(data: sectData) else {
                        print("[ERROR] Failed to get section pointer.")
                        return false
                    }
                    
                    var sectName = sectCmd.sectname
                    if (strncmp(&sectName.0, "__text", 15) == 0) {
                        let space = sectCmd.offset - header.sizeofcmds - UInt32(headerSize)
                        print("[INFO] Available space is \(space/8) bytes.")
                        return space > injectSpace
                    }
                }
            }
            else {
                segOffset = segOffset + Int(segCmd.cmdsize)
            }
        }
        return false
    }

基本原理是查找到代码段（__text）偏移地址，然后分析该地址前是否有足够空间，读者可结合二进制格式进行代码阅读，这里不再注解。