IMG_0691.PNG

IMG_0692.PNG

由于最近沖頂大會越來越熱,網(wǎng)上就出現(xiàn)了各種輔助蛙粘。大都是和“跳一跳”輔助一樣的套路,截圖使用python文字識別然后拿到題目和選項去搜索构挤。我想做的是脫離電腦，直接在app里拿到題目進行搜索。以上截圖就是最終實現(xiàn)的效果。話不多說讓我們直接開始借浊。

工具

我們需要hookApp里的一些方法和修改一些界面所以就需要逆向的一些工具,我使用的是MonkeyDev直接安裝使用,不懂的可以查看教程。至于不帶殼的App可以從某助手里下載或則自己選擇手動砸殼萝招。最后就是分析工具Hopper。

分析頁面

屏幕快照 2018-01-17 下午9.17.08.png

屏幕快照 2018-01-17 下午10.40.50.png

編寫

屏幕快照 2018-01-17 下午9.18.05.png

屏幕快照 2018-01-17 下午9.18.42.png

接下來:

CHDeclareClass(_TtC10LiveTrivia18LiveViewController)
CHOptimizedMethod(0, self,void,_TtC10LiveTrivia18LiveViewController,viewDidLoad){
    CHSuper(0, _TtC10LiveTrivia18LiveViewController,viewDidLoad);
    UIWindow *win = [UIApplication sharedApplication].keyWindow;
    UIView *view = CHIvar(self, _view, __strong UIView *);
    CGFloat offsetY = 80;
    UIWebView *web = [[UIWebView alloc] initWithFrame:CGRectMake(0, CGRectGetHeight(view.frame)/2 + offsetY, CGRectGetWidth(view.frame), CGRectGetHeight(view.frame)/2 - offsetY)];
    web.layer.cornerRadius = 4;
    web.layer.masksToBounds = YES;
    [win addSubview:web];
    objc_setAssociatedObject(self, @"searchWeb", web, OBJC_ASSOCIATION_RETAIN_NONATOMIC);
    
    UIButton *moveWeb = [UIButton buttonWithType:UIButtonTypeSystem];
    [moveWeb setTitle:@"Move" forState:UIControlStateNormal];
    [moveWeb addTarget:self action:@selector(moveWebAction:) forControlEvents:UIControlEventTouchUpInside];
    [moveWeb setFrame:CGRectMake(0, 0, CGRectGetWidth(web.frame), 45)];
    moveWeb.backgroundColor = [UIColor whiteColor];
    [web addSubview:moveWeb];
    
    NSLog(@"%@",view.subviews[1].subviews[1]);
    
    UIView *questionView = view.subviews[1].subviews[1];
    [questionView addObserver:self forKeyPath:@"alpha" options:NSKeyValueObservingOptionNew context:nil];
    
    UILabel *qaLabel = questionView.subviews[3].subviews.firstObject;
    UIButton *option1 = questionView.subviews[5].subviews[0];
    UIButton *option2 = questionView.subviews[5].subviews[1];
    UIButton *option3 = questionView.subviews[5].subviews[2];
    
    objc_setAssociatedObject(self, @"qaLabel", qaLabel, OBJC_ASSOCIATION_RETAIN_NONATOMIC);
    objc_setAssociatedObject(self, @"opation1", option1, OBJC_ASSOCIATION_RETAIN_NONATOMIC);
    objc_setAssociatedObject(self, @"opation2", option2, OBJC_ASSOCIATION_RETAIN_NONATOMIC);
    objc_setAssociatedObject(self, @"opation3", option3, OBJC_ASSOCIATION_RETAIN_NONATOMIC);
 NSLog(@"%@--%@---%@---%@",qaLabel,option1,option2,option3);
}

先添加到webView到window上,然后關(guān)聯(lián)對象到LiveViewController上,留著后面用,加上button是用來控制webView的frame,下面的qaLabel是存放問題的,三個optionButton分別是三個選項岗钩。同樣我們關(guān)聯(lián)到controller上,我們還要監(jiān)聽questionView的alpha值的變化。
alpha值改變我們獲取問題和選項去搜索

CHOptimizedMethod(4, self,void,_TtC10LiveTrivia18LiveViewController,observeValueForKeyPath,NSString *,keyPath,ofObject,id,object,change,NSDictionary*,change,context,void *,context){
    NSLog(@"%@,%@",change,keyPath);
    
    if ([change[@"new"] intValue] != 1)    return; 

    NSString *questionStr = nil;
    
    UILabel *qaLabel = objc_getAssociatedObject(self, @"qaLabel");
    UIButton *option1 = objc_getAssociatedObject(self, @"opation1");
    UIButton *option2 = objc_getAssociatedObject(self, @"opation2");
    UIButton *option3 = objc_getAssociatedObject(self, @"opation3");
    
    questionStr = [NSString stringWithFormat:@"%@ %@ %@ %@",qaLabel.text,option1.titleLabel.text,option2.titleLabel.text,option3.titleLabel.text];
    
    NSString *wd = [questionStr stringByAddingPercentEscapesUsingEncoding:NSUTF8StringEncoding];
    NSURL *url = [NSURL URLWithString:[NSString stringWithFormat:@"http://www.baidu.com/s?wd=%@",wd]];
    UIWebView *web = objc_getAssociatedObject(self, @"searchWeb");
    [web loadRequest:[NSURLRequest requestWithURL:url]];
    NSLog(@"%@",questionStr);
}

最后點擊button的事件我們得添加新的方法

%hook _TtC10LiveTrivia18LiveViewController

%new
- (void)moveWebAction:(UIButton *)btn{
    NSLog(@"%@",btn.superview);
    UIWebView *web = btn.superview;
    CGFloat top = 150;
    CGFloat offsetY = 80;
    if (CGRectGetMinY(web.frame) == 150) {
        [UIView animateWithDuration:.3 animations:^{
            CGRect newFrame = CGRectMake(0, kHeight/2 + offsetY, kWidth, kHeight/2 - offsetY);
            web.frame = newFrame;
        } completion:^(BOOL finished) {
            
        }];
    }else{
        [UIView animateWithDuration:.3 animations:^{
            CGRect newFrame = CGRectMake(0, top, kWidth, kHeight - top);
            web.frame = newFrame;
        } completion:^(BOOL finished) {
            
        }];
    }
}

采用tweak的方式寫的肖油。忘了說試圖class-dump出頭文件的就放棄吧,代碼是OC和Swift混編兼吓，所以.........
代碼地址

最后還是聲明一下,寫這個純屬娛樂,請勿用作商業(yè)用途，否則后果自負森枪。