-
獲取iOS iPhone 上微信bundle的路徑 ps -e | grep WeChat
FA0482C5-D194-4F98-B71A-282C148CF89A.png -
iPhone 微信程序拷貝到 Mac scp /var/mobile/Containers/Bundle/Application/BA5B36D0-E801-4B5A-80EB-9306A8438D0A/WeChat.app/WeChat liudefu@10.0.105.143:/tmp
86A3F7C1-4092-4BA1-8C39-03B034620278.png -
otool -L WeChat 查看微信用的框架依賴(lài)庫(kù)
圖片.png -
是否加殼 otool -l WeChat | grep crypt
3FE2AF41-B676-454B-AE9D-DC5691AF67C7.png- crypt 表示0或者沒(méi)有crypt字段表示沒(méi)有加密亥至，crypt為1表示加密了，為什么crypt有2個(gè)呢敬辣，因?yàn)槲⑿攀莻€(gè)集合包，包含了arm64蜕便，和arm7,所以微信是加殼的移斩，加殼是用class-dump拿 不出來(lái)
- cycript -p WeChat
圖片.png
-
class-dump WeChat 砸殼
CE14E1AA-E603-48A6-87EF-7686B9A12507.png
如果沒(méi)有加密的應(yīng)用用class-dump 砸殼痪欲，可以看到一切文件
- class-dump 如何使用
class-dump 3.5 (64 bit)
Usage: class-dump [options] <mach-o-file>
where options are:
-a show instance variable offsets
-A show implementation addresses
--arch <arch> choose a specific architecture from a universal binary (ppc, ppc64, i386, x86_64, armv6, armv7, armv7s, arm64)
-C <regex> only display classes matching regular expression
-f <str> find string in method name
-H generate header files in current directory, or directory specified with -o
-I sort classes, categories, and protocols by inheritance (overrides -s)
-o <dir> output directory used for -H
-r recursively expand frameworks and fixed VM shared libraries
-s sort classes and categories by name
-S sort methods by name
-t suppress header in output, for testing
--list-arches list the arches in the file, then exit
--sdk-ios specify iOS SDK version (will look in /Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS<version>.sdk
--sdk-mac specify Mac OS X version (will look in /Developer/SDKs/MacOSX<version>.sdk
--sdk-root specify the full SDK root path (or use --sdk-ios/--sdk-mac for a shortcut)
搜索微信的頭文件
class-dump -s -S -H weChat
搜索SpringBoard頭文件
class-dump -s -S -H SpringBoard -o ./SBHeaders
- 查看頭文件的個(gè)數(shù)
- ls -lR|grep "^-"|wc -l
圖片.png
