日韩性视频-久久久蜜桃-www中文字幕-在线中文字幕av-亚洲欧美一区二区三区四区-撸久久-香蕉视频一区-久久无码精品丰满人妻-国产高潮av-激情福利社-日韩av网址大全-国产精品久久999-日本五十路在线-性欧美在线-久久99精品波多结衣一区-男女午夜免费视频-黑人极品ⅴideos精品欧美棵-人人妻人人澡人人爽精品欧美一区-日韩一区在线看-欧美a级在线免费观看

歡迎訪問 生活随笔!

生活随笔

當(dāng)前位置: 首頁 > 编程资源 > 编程问答 >内容正文

编程问答

iOS逆向之深入解析如何使用Theos开发插件

發(fā)布時間:2024/5/21 编程问答 46 豆豆
生活随笔 收集整理的這篇文章主要介紹了 iOS逆向之深入解析如何使用Theos开发插件 小編覺得挺不錯的,現(xiàn)在分享給大家,幫大家做個參考.

一、Logos 語法

  • Logos 作為 Theos 開發(fā)組件的一部分,通過一組特殊的預(yù)處理指令,可以讓編寫函數(shù)鉤子(hook)代碼變得非常簡單和清晰,Logos 是隨著 Theos 發(fā)布的。
  • %hook 指定需要 hook 的類名,以 %end 結(jié)尾。
  • %log 用來打印 log,將信息輸入到 syslog 中,如 %log((NSString *)@“ZeluLi”)。
  • %orig 執(zhí)行被 hook 函數(shù)的原始代碼,類似于 super.method 功能。
  • %group 該指令用于 %hook 的分組,%group 后邊跟的是組名,%group 也是必須以 %end 結(jié)尾,其中可以包含多個 %hook。
  • %init 該指令用來初始化某個 %group,一個 group 只有被初始化后才可生效,init 必須在 hook 中進行執(zhí)行。
  • %ctor tweak 的構(gòu)造器,用來初始化,如果不顯式定義,Theos 就會自動生成一個%ctor,并在其中調(diào)用 %init(_ungrouped),如:%ctor { %init(_ungrouped)}。
  • %new 該指令用來給現(xiàn)有的 class 添加一個新的函數(shù),與 Runtime 中的 class_addMethod 相同。
  • %c 該指令用來獲取一個類的名稱,相當(dāng)于 objc_getClass。

二、工程目錄下文件

  • 新建工程的命令:$THEOS/bin/nic.pl:
devzkndeMacBook-Pro:~ devzkn$ $THEOS/bin/nic.pl NIC 2.0 - New Instance Creator ------------------------------[1.] iphone/activator_event[2.] iphone/application_modern[3.] iphone/cydget[4.] iphone/flipswitch_switch[5.] iphone/framework[6.] iphone/ios7_notification_center_widget[7.] iphone/library[8.] iphone/notification_center_widget[9.] iphone/preference_bundle_modern[10.] iphone/tool[11.] iphone/tweak[12.] iphone/xpc_service Choose a Template (required): 11 Project Name (required): testTweakDemo Package Name [com.yourcompany.testtweakdemo]: Author/Maintainer Name [devzkn]: [iphone/tweak] MobileSubstrate Bundle filter [com.apple.springboard]: com.apple.UIKit [iphone/tweak] List of applications to terminate upon installation (space-separated, '-' for none) [SpringBoard]: Instantiating iphone/tweak in testtweakdemo/... Done.
  • 說明:
    • 參數(shù) Package Name:deb包的名字;
    • 參數(shù) Bundle filter:tweak 的目標(biāo) app 的 bundle identifier,比如 wechat 的 bundle Id :com.tentcent.xin;
    • iOS 系統(tǒng)的桌面應(yīng)用的 bundle Id:com.apple.springboard tweak 注入到所有的 app,那么 Bundle filter 應(yīng)該為 com.apple.UIKit。
  • 新建一個工程之后,會生成四個文件:control、plist、Makefile、Tweak.xm,這幾個文件分別有什么用?
$ ls -lrt total 32 -rw-r--r-- 1 devzkn staff 51 Aug 10 17:07 testTweakDemo.plist -rw-r--r-- 1 devzkn staff 223 Aug 10 17:07 control -rw-r--r-- 1 devzkn staff 1045 Aug 10 17:07 Tweak.xm -rw-r--r-- 1 devzkn staff 189 Aug 10 17:07 Makefile

① control 文件

  • control 文件存儲項目有關(guān)的信息:名稱、版本、開發(fā)者:
Package: com.yourcompany.testtweakdemo Name: testTweakDemo Depends: mobilesubstrate Version: 0.0.1 Architecture: iphoneos-arm Description: An awesome MobileSubstrate tweak! Maintainer: devzkn Author: devzkn Section: Tweaks

② plist文件

  • plist 文件的作用:設(shè)置目標(biāo) app 的 bundle Id,如果 tweak 要注入多個 APP,就在 Bundles 數(shù)組中添加其 bundle Id:
devzkndeMacBook-Pro:testtweakdemo devzkn$ more testTweakDemo.plist { Filter = { Bundles = ( "com.apple.UIKit" ); }; }

③ Makefile 文件

  • Makefile 文件設(shè)置需要用到的文件、框架、庫:
$ more Makefile include $(THEOS)/makefiles/common.mkTWEAK_NAME = testTweakDemo testTweakDemo_FILES = Tweak.xminclude $(THEOS_MAKE_PATH)/tweak.mkafter-install::install.exec "killall -9 SpringBoard" devzkndeMacBook-Pro:testtweakdemo devzkn$
  • testTweakDemo_FILES 設(shè)置工程需要引用的文件,多個文件之間以空格分隔。格式:工程名FILES = 要編譯的文件名:
testTweakDemo_FILES = Tweak.xm MyClass1.m MyClass2.m
  • include $(THEOS)/makefiles/common.mk,很多關(guān)鍵的變量都在 common.mk 中。
  • 工程名字_FRAMEWORKS : 設(shè)置工程需要引用的第三方庫,多個庫之間以空格分隔:
工程名字_FRAMEWORKS : 設(shè)置工程需要引用的第三方庫,多個庫之間以空格分隔:
  • after-install:在 tweak 安裝之后,執(zhí)行的一些輔助任務(wù),比如殺掉目標(biāo)進程,好讓 CydiaSubstrate 在進程重啟的過程加載對應(yīng)的 dylib。

④ Tweak.xm

  • 用于編寫注入的代碼,其中的 %hook,%orig,%log 符合是 theos 對 cydia Substrate 提供的函數(shù)的宏封裝:
IMP MSHookMessage(Class class, SEL selector, IMP replacement, const char* prefix); // prefix should be NULL. void MSHookMessageEx(Class class, SEL selector, IMP replacement, IMP *result); void MSHookFunction(void* function, void* replacement, void** p_original);
  • Tweak.xm 的文件名后綴 x 代表的含義:
    • Tweak.xm 的文件名后綴 x 代表支持 Logos 語法, 如果只有一個 x 代表源文件支持 Logos 和 C 語法;如果是 xm,說明源文件支持 Logos 和 C/C++ 語法;
    • 其中的 %hook,%orig,%log 等都是 Logos 語法支持的內(nèi)容。
$ more Tweak.xm /* How to Hook with Logos Hooks are written with syntax similar to that of an Objective-C @implementation. You don't need to #include <substrate.h>, it will be done automatically, as will the generation of a class list and an automatic constructor.%hook ClassName// Hooking a class method + (id)sharedInstance {return %orig; }// Hooking an instance method with an argument. - (void)messageName:(int)argument {%log; // Write a message about this call, including its class, name and arguments, to the system log.%orig; // Call through to the original function with its original arguments.%orig(nil); // Call through to the original function with a custom argument.// If you use %orig(), you MUST supply all arguments (except for self and _cmd, the automatically generated ones.) }// Hooking an instance method with no arguments. - (id)noArguments {%log;id awesome = %orig;[awesome doSomethingElse];return awesome; }// Always make sure you clean up after yourself; Not doing so could have grave consequences! %end */

⑤ 編譯和安裝deb

  • 使用命令 make package 編譯,其中 packages 文件夾下保留的是每一次編譯成功產(chǎn)生的 deb 安裝包文件。theos 編譯之后,會生成一個 deb 包,deb 安裝到手機上面,有多種方式:
    • 通過 iFile 進行安裝:使用 iTools 等工具將這個 deb 包拷貝到手機中,利用 iFile 瀏覽進行安裝;
    • 通過 SSH 進行安裝:
      • 需要使用到 openssh 服務(wù),確保手機上已經(jīng)安裝了該服務(wù)(cydia 中搜索安裝 OpenSSH),這種安裝方式需要在 Makefile 文件的首行添加手機設(shè)備的 IP 地址 THEOS_DEVICE_IP = 10.200.201.22 (手機本地 IP);
      • 安裝的時確保證 iOS 設(shè)備和 Mac 在同一局域網(wǎng)的同一網(wǎng)段中,打開終端,先 cd 到工程的目錄下,然后輸入編譯安裝命令 make package install;
    • 通過 cydia 源進行安裝。

⑥ 免輸密碼進行 SSH

  • 使用 make package install 命令可以一次性完成編譯、打包、安裝,這個過程中可能需要兩次輸入 ssh 的 root 密碼(一次是簽名打包,一次是安裝)。
  • 創(chuàng)建 rsa文件 : ssh-keygen -t rsa -b 2048 按提示輸入存放 keygen 存放的目錄和文件名。
  • 配置 ssh config:
# Private 192.168.2.125 Host iPhone HostName 192.168.2.125 User root IdentityFile ~/.ssh/id_rsa_Theos125
  • 添加對應(yīng)的公鑰到對應(yīng)的遠程服務(wù)器 :ssh-copy-i d千萬不要把私鑰泄漏,只是把公鑰(*.pub 文件)復(fù)制給遠程服務(wù)器,ssh-copy-id root@:
ssh-copy-id 指定認證文件$ ssh-copy-id -i id_rsa_Theos125 root@192.168.2.131 $ ssh-copy-id root@192.168.2.212 /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/Users/devzkn/.ssh/id_rsa_Theos.pub" /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys root@192.168.2.212's password: Number of key(s) added: 1Now try logging into the machine, with: "ssh 'root@192.168.2.212'" and check to make sure that only the key(s) you wanted were added.

三、常見問題

① 壓縮方式不被支持

  • 原因是 dpkg 有兩個不同的版本,最新版本不支持 lzma:
$ make package > Making all for tweak testTweakDemo… ==> Preprocessing Tweak.xm… ==> Compiling Tweak.xm (armv7)==> Linking tweak testTweakDemo (armv7)… clang: warning: libstdc++ is deprecated; move to libc++ with a minimum deployment target of iOS 7 [-Wdeprecated] ==> Preprocessing Tweak.xm… ==> Compiling Tweak.xm (arm64)==> Linking tweak testTweakDemo (arm64)… clang: warning: libstdc++ is deprecated; move to libc++ with a minimum deployment target of iOS 7 [-Wdeprecated] ==> Merging tweak testTweakDemo… ==> Signing testTweakDemo… > Making stage for tweak testTweakDemo… dpkg-deb: error: obsolete compression type 'lzma'; use xz insteadType dpkg-deb --help for help about manipulating *.deb files; Type dpkg --help for help about installing and deinstalling packages. make: *** [internal-package] Error 2
  • 解決方案:修改 lzma 為 xz:
$ find /opt/theos -type f -name "*.mk" | xargs grep "lzma" /opt/theos/makefiles/package/deb.mk:_THEOS_PLATFORM_DPKG_DEB_COMPRESSION ?= lzma
  • 修改 /opt/theos/makefiles/package/deb.mk 第六行為_THEOS_PLATFORM_DPKG_DEB_COMPRESSION ?= xz。
  • 另外一個辦法是直接使用舊版本,命令如下:
Debian 'dpkg' package management program version 1.18.24 (darwin-amd64) brew switch dpkg 1.18.10 brew link dpkg brew pin dpkg 1.18.10
  • 驗證是否修復(fù):
$ make package > Making all for tweak testTweakDemo… make[2]: Nothing to be done for `internal-library-compile'. > Making stage for tweak testTweakDemo… dpkg-deb: building package 'com.yourcompany.testtweakdemo' in './packages/com.yourcompany.testtweakdemo_0.0.1-2+debug_iphoneos-arm.deb'.
  • 另如果只修改為 XZ 的話,屆時安裝的時候仍會報錯:
root@192.168.2.212's password: Selecting previously unselected package com.yourcompany.testtweakdemo. (Reading database ... 1848 files and directories currently installed.) Preparing to unpack /tmp/_theos_install.deb ... Unpacking com.yourcompany.testtweakdemo (0.0.1-8+debug) ... dpkg-deb (subprocess): unable to execute decompressing archive member (xz): No such file or directory dpkg-deb (subprocess): subprocess decompressing archive member returned error exit status 2 dpkg-deb: error: subprocess <decompress> returned error exit status 2 dpkg: error processing archive /tmp/_theos_install.deb (--install):subprocess dpkg-deb --fsys-tarfile returned error exit status 2 Errors were encountered while processing:/tmp/_theos_install.deb make: *** [internal-install] Error 1
  • 如果在出現(xiàn)上面錯誤時是將 lzma->xz 的話,后面可能會出現(xiàn)此錯誤,解決方法是將 lzma->gzip 即可:
_THEOS_PLATFORM_DPKG_DEB_COMPRESSION ?=gzip
  • 驗證是否成功:
$ make package install > Making all for tweak testTweakDemo… make[2]: Nothing to be done for `internal-library-compile'. > Making stage for tweak testTweakDemo… dpkg-deb: building package 'com.yourcompany.testtweakdemo' in './packages/com.yourcompany.testtweakdemo_0.0.1-9+debug_iphoneos-arm.deb'. ==> Installing… root@192.168.2.212's password: (Reading database ... 1848 files and directories currently installed.) Preparing to unpack /tmp/_theos_install.deb ... Unpacking com.yourcompany.testtweakdemo (0.0.1-9+debug) ... Setting up com.yourcompany.testtweakdemo (0.0.1-9+debug) ... install.exec "killall -9 SpringBoard" root@192.168.2.212's password:

② THEOS_DEVICE_IP 設(shè)置錯誤

$ make package install > Making all for tweak testTweakDemo… make[2]: Nothing to be done for `internal-library-compile'. > Making stage for tweak testTweakDemo… dpkg-deb: building package 'com.yourcompany.testtweakdemo' in './packages/com.yourcompany.testtweakdemo_0.0.1-3+debug_iphoneos-arm.deb'. ==> Error: /Applications/Xcode.app/Contents/Developer/usr/bin/make install requires that you set THEOS_DEVICE_IP in your environment. ==> Notice: It is also recommended that you have public-key authentication set up for root over SSH, or you will be entering your password a lot.
  • 解決:THEOS_DEVICE_IP = 10.200.201.22 (手機本地 IP),首先得保證 iOS 設(shè)備和 Mac 在同一局域網(wǎng)的同一網(wǎng)段中,打開終端,輸入 ssh root@192.168.xxx.xxx 輸入 iOS 設(shè)備密碼,默認 alpine:
$ ping 192.168.2.212 PING 192.168.2.212 (192.168.2.212): 56 data bytes 64 bytes from 192.168.2.212: icmp_seq=0 ttl=64 time=34.303 ms 64 bytes from 192.168.2.212: icmp_seq=1 ttl=64 time=28.949 ms 64 bytes from 192.168.2.212: icmp_seq=2 ttl=64 time=25.753 ms 64 bytes from 192.168.2.212: icmp_seq=3 ttl=64 time=5.306 ms 64 bytes from 192.168.2.212: icmp_seq=4 ttl=64 time=106.028 ms 64 bytes from 192.168.2.212: icmp_seq=5 ttl=64 time=84.643 ms 64 bytes from 192.168.2.212: icmp_seq=6 ttl=64 time=44.845 ms ^C --- 192.168.2.212 ping statistics --- 7 packets transmitted, 7 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 5.306/47.118/106.028/32.913 ms devzkndeMacBook-Pro:testtweakdemo devzkn$ ssh root@192.168.2.212 The authenticity of host '192.168.2.212 (192.168.2.212)' can't be established. RSA key fingerprint is SHA256:/. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.2.212' (RSA) to the list of known hosts. root@192.168.2.212's password: Permission denied, please try again. root@192.168.2.212's password: iPhone:~ root#

總結(jié)

以上是生活随笔為你收集整理的iOS逆向之深入解析如何使用Theos开发插件的全部內(nèi)容,希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯,歡迎將生活随笔推薦給好友。