最近發(fā)現(xiàn)MSHookFunction無論我怎么寫都失效贾虽，我的手機(jī)是iPhone X Max ,非忱加ⅲ苦惱叙凡。
void hooksvc8() {
long long gifIMFrameworkHeader = 0x0000000000000000;
long long sub854c98 = 0x0000000000000000;
long long sub33d4fc0 = 0x0000000000000000;
for (int i = 0; i < _dyld_image_count (); i++) {
char *pathCString = _dyld_get_image_name (i);
NSString *path = [[NSString alloc] initWithCString:pathCString encoding:NSUTF8StringEncoding];
// NSLog (@"path :%@", path);
if ([path containsString:@"gifBaseFramework"]) {
gifIMFrameworkHeader = _dyld_get_image_vmaddr_slide (i);
NSLog(@"gifIMFrameworkHeader :%#016llx",(long long)gifIMFrameworkHeader);
sub854c98 = gifIMFrameworkHeader + 0x854c98;
sub33d4fc0 = gifIMFrameworkHeader + 0x00000000033d4fc0;
}
}
MSHookFunction((void *)sub33d4fc0, (void *)sub_33d4fc0, (void *)&or_sub_33d4fc0);
NSLog(@"or_sub_33d4fc0 :%#016llx",or_sub_33d4fc0);
NSLog(@"sub33d4fc0 :%#016llx",(long long)sub33d4fc0);
NSLog(@"sub_33d4fc0 :%#016llx",(long long)sub_33d4fc0);
NSLog(@"打印結(jié)束");
MSHookFunction ((void *)sub854c98, (void *)sub_854c98, (void **)&or_sub_854c98);
}
每次調(diào)試都可以看到or_sub_33d4fc0和or_sub_854c98在執(zhí)行hook之后都是0x000000.
于是我試了下我手機(jī)越獄之后系統(tǒng)自帶正驻，居然可以hook到厌蔽，無語牵辣。。奴饮。
到此解決了手機(jī)CydiaSubstrate失效的問題纬向，當(dāng)然這個(gè)庫也可在非IPhone X max 手機(jī)上使用，但是系統(tǒng)要滿足這個(gè)倆庫要求的最低系統(tǒng)戴卜，iOS11.0罢猪。
文件名字做了一些更改，這里要多導(dǎo)入一個(gè)libsubstitute.dylib叉瘩，別的到?jīng)]多什么膳帕。
這個(gè)倆動態(tài)庫要求iOS11系統(tǒng)以上。
更改文件名字后薇缅，目錄結(jié)構(gòu)如下：
以下題外話：
我把我手機(jī)里的CydiaSubstrate提取出來危彩，對比了下以下，以前的CydiaSubstrate泳桦。
這個(gè)sharedLibrary(???)居然 是Arm64e,MachOView由于很久沒更新沒識別出來汤徽。就連Appstore所有的App都沒這Arm64e。唯一有的只有系統(tǒng)的文件包含這個(gè)Arm64e灸撰。
官方的解釋：
https://developer.apple.com/documentation/security/preparing_your_app_to_work_with_pointer_authentication?language=objc
我們的動態(tài)庫和App也可以測試這個(gè)這個(gè)Arm64e谒府。如官方所說：
就這樣就可以編譯出這個(gè)arm64e.但是蘋果不允許提交到appstore.
了解這么多拼坎，我就把手機(jī)導(dǎo)出的CydiaSubstrate.framework導(dǎo)到編譯用的文件但是必須編寫腳本更改動態(tài)庫問題，代碼如下：
cp -rf "${SRCROOT}/InjectionFrameworks/CydiaSubstrate.framework" "$TARGET_APP_FRAMEWORKS_PATH"
/usr/bin/codesign --force --sign "$EXPANDED_CODE_SIGN_IDENTITY" "$TARGET_APP_FRAMEWORKS_PATH/CydiaSubstrate.framework/libsubstitute.dylib"
install_name_tool -change "/Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate" "@rpath/CydiaSubstrate.framework/CydiaSubstrate" "$TARGET_APP_FRAMEWORKS_PATH/InjectionFrameworks.framework/InjectionFrameworks"
install_name_tool -change "/usr/lib/libsubstrate.dylib" "@rpath/CydiaSubstrate.framework/CydiaSubstrate" "$TARGET_APP_FRAMEWORKS_PATH/InjectionFrameworks.framework/InjectionFrameworks"
install_name_tool -change "/usr/lib/libsubstitute.0.dylib" "@rpath/libsubstitute.dylib" "$TARGET_APP_FRAMEWORKS_PATH/CydiaSubstrate.framework/CydiaSubstrate"
install_name_tool -add_rpath "@executable_path" "$TARGET_APP_FRAMEWORKS_PATH/CydiaSubstrate.framework/CydiaSubstrate"
install_name_tool -add_rpath "@rpath" "$TARGET_APP_FRAMEWORKS_PATH/CydiaSubstrate.framework/CydiaSubstrate"
install_name_tool -add_rpath "@loader_path" "$TARGET_APP_FRAMEWORKS_PATH/CydiaSubstrate.framework/CydiaSubstrate"
install_name_tool -add_rpath "@executable_path/../Frameworks" "$TARGET_APP_FRAMEWORKS_PATH/CydiaSubstrate.framework/CydiaSubstrate"
可能是CydiaSubstrate更新了完疫？泰鸡？,也可能跟A12芯片有關(guān)系
