macos逆向初體驗(yàn)恤溶。
找個(gè)別人逆向過的目標(biāo)熟悉一下逆向過程势就。
原文地址：
http://iosre.com/t/mac/3373
iosre.com應(yīng)該是目前國內(nèi)ios逆向最專業(yè)的論壇了杀饵。
好了底哥，接下來開始咙鞍。
從appstore下載掃雷app。下載前看了一下評(píng)論趾徽，一堆吐槽收費(fèi)貴的……貴是貴了點(diǎn)
就是這貨续滋。
然后建立framework，引入JRSwizzle工具孵奶，定義好宏疲酌，寫好script，將schema的啟動(dòng)項(xiàng)設(shè)置為這個(gè)游戲的app了袁。
編寫hook朗恳。分析過程見原文，可以按照原作者的思路過一遍载绿。
（其實(shí)逆向重點(diǎn)就是分析過程～）
項(xiàng)目結(jié)構(gòu)：
Main.h文件：
#import <objc/runtime.h>
#import "HookDeluxe.h"
Main.mm文件
#import "Main.h"
#import <objc/runtime.h>
#import <objc/message.h>
@implementation NSObject (HookDeluxe)
#pragma mark - GameState
- (BOOL)hook_fullgame {
return YES;
}
- (int)hook_robot{
Class c = objc_getClass("GameState");
SEL sel = NSSelectorFromString(@"sharedInstance");
id gameState = [c performSelector:sel];
SEL sel2 = NSSelectorFromString(@"setRobot:");
[gameState performSelector:sel2 withObject:[NSNumber numberWithInteger:99] afterDelay:0];
return 99;
}
@end
static void __attribute__((constructor)) initialize(void) {
NSLog(@"------- skcwiiur loaded ++++++++");
//允許掃雷難度
CBHookInstanceMethod(GameState, @selector(fullgame), @selector(hook_fullgame));
CBHookInstanceMethod(GameState, @selector(robot), @selector(hook_robot));
}
HookDeluxe.h 文件：
#import <Cocoa/Cocoa.h>
#import "JRSwizzle.h"
//! Project version number for HookDeluxe.
FOUNDATION_EXPORT double HookDeluxeVersionNumber;
//! Project version string for HookDeluxe.
FOUNDATION_EXPORT const unsigned char HookDeluxeVersionString[];
// In this header, you should import all the public headers of your framework using statements like #import <HookDeluxe/PublicHeader.h>
#define CBGetClass(classname) objc_getClass(#classname)
#define CBRegisterClass(superclassname, subclassname) { Class class = objc_allocateClassPair(CBGetClass(superclassname), #subclassname, 0);objc_registerClassPair(class); }
#define CBHookInstanceMethod(classname, ori_sel, new_sel) { NSError *error; [CBGetClass(classname) jr_swizzleMethod:ori_sel withMethod:new_sel error:&error]; if(error) NSLog(@"%@", error); }
#define CBHookClassMethod(classname, ori_sel, new_sel) { NSError *error; [CBGetClass(classname) jr_swizzleClassMethod:ori_sel withClassMethod:new_sel error:&error]; if(error) NSLog(@"%@", error); }
#define CBGetInstanceValue(obj, valuename) object_getIvar(obj, class_getInstanceVariable([obj class], #valuename))
#define CBSetInstanceValue(obj, valuename, value) object_setIvar(obj, class_getInstanceVariable([obj class], #valuename), value)
在BuildPhases中的腳本
#!/bin/bash
app_name="Minesweeper Deluxe"
framework_name="HookDeluxe"
app_bundle_path="/Applications/${app_name}.app/Contents/MacOS"
app_executable_path="${app_bundle_path}/${app_name}"
app_executable_backup_path="${app_executable_path}_"
framework_path="${app_bundle_path}/${framework_name}.framework"
# 備份原始可執(zhí)行文件
if [ ! -f "$app_executable_backup_path" ]
then
cp "$app_executable_path" "$app_executable_backup_path"
fi
cp -r "${BUILT_PRODUCTS_DIR}/${framework_name}.framework" ${app_bundle_path}
/opt/iOSOpenDev/bin/insert_dylib --all-yes "${framework_path}/${framework_name}" "$app_executable_backup_path" "$app_executable_path"
執(zhí)行過程中可能會(huì)遇到?jīng)]有權(quán)限的情況（備份文件的時(shí)候）粥诫。
這種情況是因?yàn)樵撃夸洓]有權(quán)限，自己去那Macos目錄崭庸，執(zhí)行一下
cd /Applications/Minesweeper Deluxe.app/Contents
sudo chmod 777 MacOS/
然后執(zhí)行臀脏，注入，啟動(dòng)冀自。一切ok揉稚！
