Interface Inspector簡介
Interface Inspector是用于查看mac os app界面布局的利器鹅士，類似于iOS的Reveal褥影。
破解過程
下載下來打開后，出現(xiàn)一個License窗口：
License
hopper的Strings表里面搜索 License 宪塔，發(fā)現(xiàn)有這么一個方法：
-[SMLicenseManager isLicensed]
Modify -> Assemble Instruction...(option+a)梢杭，修改返回值為YES：
-[SMLicenseManager isLicensed]:
000000010010fe70 mov rax, 0x1
000000010010fe77 ret
File -> Produce New Executable...command+shift+e偏窝，選擇Remove Signature衬吆，替換原可執(zhí)行文件梁钾。
然后打開，彈出了：
Signature
它驗證簽名了逊抡，我們Strings表里面搜索 Sign 姆泻，發(fā)現(xiàn) codeSignState字符串
x查看引用，在applicationWillFinishLaunching中調(diào)用了這個方法：
void -[SMAppDelegate applicationWillFinishLaunching:](void * self, void * _cmd, void * arg2) {
rdx = arg2;
rbx = self;
var_30 = *___stack_chk_guard;
rax = [NSBundle mainBundle];
rax = [rax retain];
var_128 = rax;
if ([rax codeSignState] != 0x2) goto loc_100024851;
......
loc_100024851:
r14 = [[NSAlert alloc] init];
var_F8 = r14;
r13 = [[NSBundle mainBundle] retain];
rbx = [[r13 localizedStringForKey:@"Signature of the Interface Inspector is broken" value:@"" table:0x0] retain];
需要把codeSignState的值修改為0x2。
在SMFoundation.framework找到這個方法拇勃，直接修改：
-[NSBundle codeSignState]:
000000000003b298 mov rax, 0x2
000000000003b29f ret
替換SMFoundation后再次運行蛾娶，成功了！
解決Could not attach to application
控制臺查看日志
Error loading /Library/Frameworks/mach_inject_bundle.framework/Resources/mach_inject_bundle_stub.bundle/Contents/MacOS/mach_inject_bundle_stub: dlopen(/Library/Frameworks/mach_inject_bundle.framework/Resources/mach_inject_bundle_stub.bundle/Contents/MacOS/mach_inject_bundle_stub, 262): Symbol not found: ___pthread_set_self
Referenced from: /Library/Frameworks/mach_inject_bundle.framework/Resources/mach_inject_bundle_stub.bundle/Contents/MacOS/mach_inject_bundle_stub
Expected in: /usr/lib/libSystem.B.dylib
in /Library/Frameworks/mach_inject_bundle.framework/Resources/mach_inject_bundle_stub.bundle/Contents/MacOS/mach_inject_bundle_stub
查閱資料潜秋，mach_inject_bundle.framework過期導(dǎo)致：
Fix Bug for Interface Inspector on macOS Serria
去github下載最新源碼：
https://github.com/rentzsch/mach_inject
編譯出mach_inject_bundle.framework文件，放在：
/Library/Frameworks/mach_inject_bundle.framework
