1姨丈、找到微信的可執(zhí)行文件Wechat的具體路徑：
把iPhone上的所有App都關(guān)掉，唯獨(dú)保留微信埃难，然后輸入命令 ps -e----->/var/mobile/Containers/Bundle/Application/84C4EF60-8677-4E2A-BC2D-CC88460E1380/WeChat.app/WeChat
2莹弊、使用Cycript找出微信的Documents的路徑，輸入命令cycript -p WeChat
NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES)[0]
@"/var/mobile/Containers/Data/Application/AB9ADF8F-D127-4401-B77A-9E261F996581/Documents"
3涡尘、記下剛獲取到的兩個(gè)路徑(Bundle和Documents)忍弛，使用dumpdecrypted來(lái)為微信二進(jìn)制文件(WeChat)砸殼。
從Github上下載最新的dumpdecrypted源碼考抄，進(jìn)入dumpdecrypted源碼的目錄细疚，編譯dumpdecrypted.dylib.
4、拷貝dumpdecrypted.dylib到微信的Documents目錄下
5川梅、開(kāi)始砸殼：DYLD_INSERT_LIBRARIES=/PathFrom/dumpdecrypted.dylib /PathTo
DYLD_INSERT_LIBRARIES=/var/mobile/Containers/Data/Application/AB9ADF8F-D127-4401-B77A-9E261F996581/Documents/dumpdecrypted.dylib /var/mobile/Containers/Bundle/Application/84C4EF60-8677-4E2A-BC2D-CC88460E1380/WeChat.app/WeChat
執(zhí)行如下：
iPhone:~ root# DYLD_INSERT_LIBRARIES=/var/mobile/Containers/Data/Application/AB9ADF8F-D127-4401-B77A-9E261F996581/Documents/dumpdecrypted.dylib /var/mobile/Containers/Bundle/Application/84C4EF60-8677-4E2A-BC2D-CC88460E1380/WeChat.app/WeChat
mach-o decryption dumper
DISCLAIMER: This tool is only meant for security research purposes, not for application crackers.
[+] detected 32bit ARM binary in memory.
[+] offset to cryptid found: @0xa2a90(from 0xa2000) = a90
[+] Found encrypted data at address 00004000 of length 53313536 bytes - type 1.
[+] Opening /private/var/mobile/Containers/Bundle/Application/84C4EF60-8677-4E2A-BC2D-CC88460E1380/WeChat.app/WeChat for reading.
[+] Reading header
[+] Detecting header type
[+] Executable is a FAT image - searching for right architecture
[+] Correct arch is at offset 16384 in the file
[+] Opening WeChat.decrypted for writing.
[+] Copying the not encrypted start of the file
[+] Dumping the decrypted data into the file
[+] Copying the not encrypted remainder of the file
[+] Setting the LC_ENCRYPTION_INFO->cryptid to 0 at offset 4a90
[+] Closing original file
[+] Closing dump file
當(dāng)前目錄下會(huì)生成砸殼后的文件疯兼，即WeChat.decrypted
6然遏、拷出WeChat.decrypted文件，將WeChat.decrypted改為WeChat吧彪，砸殼完成待侵。
7、class-dump命令,把剛剛砸殼后的WeChat.decrypted,導(dǎo)出其中的頭文件姨裸。./class-dump -s -S -H ./WeChat.decrypted -o ./header
