摘要：二次打包動態庫的注入二次打包動態庫的注入，是通過修改可執行文件的來實現的在中增加一個寫入路徑這樣程序執行的時候就會編譯這個找到要注入的加載動態庫的常用命令格式化根據地址獲取對象。
前言
Cycript 是一個能夠理解Objective-C語法的javascript解釋器， 它能夠掛鉤正在運行的進程， 以在運行時修改很多東西, 一般我們用于動態調試應用, 一般來說如果要調試的代碼是用OC編寫的,用cycript調試會很方便, 如果是用C編寫的,通過lldb來調試了.
安裝Cycript
官網地址：
Github地址：
@import Substrate, so we can use MS.hookFunction
cy# @import com.saurik.substrate.MS
iPhone:/usr/lib/cycript0.9/com/saurik/substrate root# ls -lrt
total 4
-rw-r--r-- 1 root staff 1968 Jan 11 2016 MS.cy
剛開始分析逆向的時候，常常利用它進行控制器class的定位，完成類似功能的工具有AFlexLoader
注入方式
cycript注入
cycript注入動態庫的方式,這必須要在越獄環境下才能實現。
cycript的原理是動態庫注入,但是其動態庫注入的原理,與我們常見的通過LC_LOAD_DYLIB在可執行文件中注入動態庫不同. cycript的操作是 : 抓取到要掛載的應用, 由于越獄機上擁有權限,所以直接在掛載的進程上創建一個掛起的線程, 然后在這個線程里申請一片用于加載動態庫的內存,然后恢復線程,動態庫就被注入。
二次打包動態庫的注入
二次打包動態庫的注入，是通過修改可執行文件的Load Commands來實現的. 在Load Commands中增加一個LC_LOAD_DYLIB , 寫入dylib路徑,這樣程序執行的時候, 就會編譯這個 LC_LOAD_DYLIB 找到要注入的 dylib,加載動態庫 .
Powerful private methods
_ivarDescription
_shortMethodDescription
nextResponder
_autolayoutTrace
recursiveDescription
_methodDescription
cycript的常用命令
格式化
.toString()
根據地址獲取對象。
#address
cy# [#0x1031f9b0]
[#">"]
bundleIdentifier
[[NSBundle mainBundle] bundleIdentifier]
可執行文件
[[NSFileManager defaultManager] URLsForDirectory:NSDocumentDirectory inDomains:NSUserDomainMask][0]
先查找進程名稱
iPhone:~ root# ps -e |grep /var/mobile*
Inject Into Processes
iPhone:~ root# cycript -p Moon
Objective-C Messages
cy# [UIApp description]
@""
cy# [#0x4870560 _ivarDescription].toString()
`:
in DFApplication:
in UIApplication:
_delegate (*):
JavaScript Extensions
cy# [for (x of [1,2,3]) x+1]
[2,3,4]
Bridged Object Model
cy# choose(CALayer) instanceof Array
true
Foreign Function Calls
cy# var a = malloc(128)
(typedef void*)(0x8b00b90)
Magical Tab-Complete
cy# a = ({m: 4, b: 5})
{m:4,b:5}
cy# a["m"]
4
C++11 Lambda Syntax
cy# [&](int a)->int{return a}
(extern "C" int 80904192(int))
打印出當前界面的view層級
cy# UIApp.keyWindow.recursiveDescription().toString()
`; layer = >
| >
| | >
| | | >
| | | | ; layer = >
| | | | | >
| | | | | | >
| | | | | | | >
| | | | | | | | >
| | | | | | | | | >
| | | | | | | | | | >
| | | | | | | | | | | >
| | | | | | | | | | | >
| | | | | | | | | | | | >
| | | | | | | | | | | |
通過view的nextResponder方法，可以找出它所屬的視圖控制器ViewController
cy# [#0x181009f0 nextResponder]
#""
接下來就可以對MoonWXParentViewController 進行hook分析
Powerful private methods for debugging in Cycript & LLDB
_shortMethodDescription 用于LLDB 進行打斷點
_printHierarchy
Shortcut to find the ViewController’s class name on the keyWindow
快捷的獲取 ViewController 的方法。
cy# [[[UIWindow keyWindow] rootViewController] _printHierarchy].toString()
`, state: appeared, view:
| , state: disappeared, view: not in the window
| | , state: disappeared, view: not in the window
| | | , state: disappeared, view: not in the window
| | , state: disappeared, view: not in the window
| | , state: disappeared, view: not in the window
| | , state: disappeared, view: not in the window
| , state: disappeared, view: not in the window
| , state: disappeared, view: not in the window
| , state: appeared, view: `
支持iOS8之后
_ivarDescription
Prints all names and values of instance variables of a specified object
比一個一個打印屬性方便多了
cy# [#0x5822600 _ivarDescription].toString()
cy# [#0x5822600 _ivarDescription].toString()
`:
in H5WebViewController:
_fontScale (NSString*): @"100%"<__NSCFConstantString: 0x338132c>
_is3DTouchPeek (BOOL): 0
_is3DTouchPop (BOOL): 0
_gestureBack (BOOL): 0
_isFromNavigationBarHidden (BOOL): 0
_webPageLoadSuccess (BOOL): 1
_isBackProcessing (BOOL): 0
_isBackProcessed (BOOL): 0
_hideLeftButtonsByJs (BOOL): 0
_isDefaultOptionMenu (BOOL): 0
_isWebViewBackgroundColorSetted (BOOL): 1
_pullRefreshing (BOOL): 1
_isFromStatusBarHidden (BOOL): 0
_isInitAsSubView (BOOL): 0
_isDissmissProcess (BOOL): 0
_isAphaOverLimit (BOOL): 0
_isWebLoading (BOOL): 0
_isWebFinishLoad (BOOL): 1
_isViewAppeared (BOOL): 1
_isViewAppearAgain (BOOL): 0
_isViewWillDisAppear (BOOL): 0
_isViewDidDisAppear (BOOL): 0
_isAlipaySchemeWillRedirect (BOOL): 0
_isAlipaySchemeDidRedirect (BOOL): 0
_isAddObserver (BOOL): 0
_isFromStartApp (BOOL): 0
name (NSString*): nil
_serviceDelegate (*): nil
_contentView (PSDView*): nil
_delegate (*):
_statesView (UIView*):
_customPreviewActionItems (NSArray*): nil
_interceptUrl (NSString*): nil
_appConfig (NSDictionary*): nil
_url (NSURL*): https://render.alipay.com/p/f/fd-j6lzqrgm/addressbook.html
_lastPageId (NSString*): nil
_refreshHeaderView (AUPullLoadingView*): nil
_stickyBouncer (H5StickyBouncer*): nil
_backDate (NSDate*): nil
_backBtnPressCount (int): 0
_serverErrorView (APExceptionView*): nil
_fontBar (H5AdjustFontControl*): nil
_statusBarStyle (int): 0
_htmlZoomValue (NSString*): @"1"<__NSCFString: 0x11130b50>
_lastMainRequest (NSURLRequest*):
_failureNumber (int): 0
_webviewDomainLabel (UILabel*):
_delayExecList (NSMutableArray*): <__NSArrayM: 0x110794a0>
_paddingBottom (float): 0
_externNativeApiManager (H5ExternNativeApiManager*):
_startLoadTime (NSDate*): <__NSDate: 0x11102510>
_co
cy# [#0x5822600 url]
#"https://render.alipay.com/p/f/fd-j6lzqrgm/addressbook.html"
_autolayoutTrace
展示的架構是基于layout
cy# [[UIApp keyWindow] _autolayoutTrace].toString()
`
UIWindow:0x46c54d0
| UILayoutContainerView:0x8c1aa10
| | UINavigationTransitionView:0x8757090
| | | UIViewControllerWrapperView:0xb68c2d0
| | | | DTBaseView:0xd8e9180
| | | | | H5WebView:0x46ba350
| | | | | | UILabel:0xfb63630"u7f51u9875u7531 render.alipay.com u63d0u4f9b"
| | | | | | _UIWebViewScrollView:0xfaaacf0
| | | | | | | UIWebBrowserView:0x5984a00
| | | | | | | UIImageView:0xfaa4850
| | | | | | | UIImageView:0xfaaa940
| | | | | UIView:0xd9fa5d0
| | | | | NBProgressView:0x1108ae60
| | | | | | UIView:0x1108c790
| | APNavigationBar:0x8734d50
| | | _UINavigationBarBackground:0x8735800
| | | | _UIBackdropView:0x11106fd0
| | | | | _UIBackdropEffectView:0x111018d0
| | | | | UIView:0x11111bb0
| | | | UIImageView:0x8735c20
| | | H5NavigationTitleView:0x1114f680
| | | | UIControl_mainTitleConten...:0xfbf7f70
| | | | | UILabel:0x11100e30"u901au8bafu5f55u670bu53cb"
| | | | UIControl_subtitleContent...:0xfbf7a90
| | | | | UILabel:0xb6f4050
| | | | UIControl_rightIconConten...:0xb681ca0
| | | | | UIImageView:0xfbfa810
| | | UIView:0x46a0090
| | | AUBarButtonItemButton_bac...:0x11146fb0
| | | | UIImageView:0x1112ffe0
| | | | UILabel:0xfb8a8c0"u8fd4u56de"
| | | _UINavigationBarBackIndicatorView:0x8c0a660`
查看安裝的app進程
iPhone:~ root# ps -e |grep /var/mobile*
333 ?? 0:13.39 /var/mobile/Containers/Bundle/Application/DB9E7889-BC60-4B5C-91BD-E59D08204958/WeChat.app/WeChat
552 ?? 0:34.13 /var/mobile/Containers/Bundle/Application/239A0B7E-AA8C-4E43-873D-16254934321A/Taobao4iPhone.app/Taobao4iPhone
635 ?? 5:42.15 /var/mobile/Containers/Bundle/Application/3FDB82B6-8D3A-47BF-A27C-184D1E052854/AlipayWallet.app/AlipayWallet
923 ?? 0:01.37 /var/mobile/Containers/Bundle/Application/3A5795F5-1E2B-42B6-A904-D7BF2178D5EB/KillOneMosquito.app/KillOneMosquito
928 ttys000 0:00.01 grep /var/mobile
cycript @import
MS
/usr/lib/cycript0.9/com
MS.cy 位于/usr/lib/cycript0.9/com/saurik/substrate 因此可以使用`cy# @import com.saurik.substrate.MS
`進行導入。
如果要導入Cycript utils的時候，用法：
Install to utils.cy to /usr/lib/cycript0.9/com/tyilo:
mkdir -p /usr/lib/cycript0.9/com
git clone https://github.com/Tyilo/cycript-utils.git /usr/lib/cycript0.9/com/tyilo
Then in cycript:
cy# @import com.tyilo.utils; 0
此時可以借助apt 進行安裝git
iPhone:~ root# apt-get install git
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
curl expat
The following NEW packages will be installed:
curl expat git
0 upgraded, 3 newly installed, 0 to remove and 16 not upgraded.
Need to get 3065kB of archives.
After this operation, 21.1MB of additional disk space will be used.
Do you want to continue [Y/n]? y
WARNING: The following packages cannot be authenticated!
curl expat git
Install these packages without verification [y/N]? y
Get:1 http://apt.saurik.com ios/1141.14/main curl 7.33.0-9 [276kB]
Get:2 http://apt.saurik.com ios/1141.14/main expat 2.0.1-3 [69.3kB]
Get:3 http://apt.saurik.com ios/1141.14/main git 2.8.1-5 [2720kB]
Fetched 3065kB in 25s (120kB/s)
Selecting previously unselected package curl.
(Reading database ... 1926 files and directories currently installed.)
Preparing to unpack .../curl_7.33.0-9_iphoneos-arm.deb ...
Unpacking curl (7.33.0-9) ...
Selecting previously unselected package expat.
Preparing to unpack .../expat_2.0.1-3_iphoneos-arm.deb ...
Unpacking expat (2.0.1-3) ...
Selecting previously unselected package git.
Preparing to unpack .../git_2.8.1-5_iphoneos-arm.deb ...
Unpacking git (2.8.1-5) ...
Setting up curl (7.33.0-9) ...
Setting up expat (2.0.1-3) ...
Setting up git (2.8.1-5) ...
apt-get 第一次通過Lydia下載“APT0.6 Transitional" 之后可以先update
iPhone:~ root# git -c http.sslVerify=false clone https://github.com/zhangkn/cycript-utils.git /usr/lib/cycript0.9/com/tyilo
Cloning into "/usr/lib/cycript0.9/com/tyilo"...
remote: Counting objects: 46, done.
remote: Total 46 (delta 0), reused 0 (delta 0), pack-reused 46
Unpacking objects: 100% (46/46), done.
Checking connectivity... done.
choose : a = choose(MyClass) 當前堆棧中查找到特定類的對象數據 Effortless Exploration
返回值是一個 數組，表示在當前堆棧中查找到的所有MyClass類的對象數據。
Effortless Exploration
cy# a = choose(UILabel).toString()
">,; layer = <_UILabelLayer: 0x10321d30>>,>,>,>,>,>,>,>,>,>,>,
hook OC函數
MS.HookMessage : 這個函數的實現是調用MSHookMessageEx ,用法如下 ：
osx cycript image not found
devzkndeMacBook-Pro:lib devzkn$ /Users/devzkn/Downloads/cycript_0.9.594/cycript
dyld: Library not loaded: /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/libruby.2.0.0.dylib
Referenced from: /Users/devzkn/Downloads/cycript_0.9.594/Cycript.lib/cycript-apl
Reason: image not found
Abort trap: 6
關掉sip創建個符號鏈接即可
devzkndeMacBook-Pro:.ssh devzkn$ sudo mkdir -p /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/
Password:
mkdir: /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/: Operation not permitted
先關閉系統的SIP，然后運行如下命令，把原來引用的位置創建符號鏈接到現在新版本的位置:
sudo mkdir -p /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/
sudo ln -s /System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/libruby.2.3.0.dylib /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/libruby.2.0.0.dylib
處理方法也很簡單，直接把2.3的復制一份，改為2.0即可
/System/Library/Frameworks/Ruby.framework/Versions/Current/usr/lib
文章版權歸作者所有，未經允許請勿轉載,若此文章存在違規行為，您可以聯系管理員刪除。
轉載請注明本文地址：http://specialneedsforspecialkids.com/yun/89324.html
