dumpdecrypted 砸殼
一府框、dumpdecrypted源碼地址
二、確認(rèn)要砸殼的iOS系統(tǒng)版本
即iOS版本需要與SDK版本相同。注意统求，5.1版SDK編譯出的dylib是向下兼容的乘碑，可以用于iOS5.0挖息，6.1版SDK同理。
三兽肤、提取需要的SDK版本
下載舊版本的Xcode套腹，然后把里面的SDK提取出來(lái)。
Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs 把Xcode這個(gè)文件夾提取出來(lái)放在桌面轿衔。
四沉迹、修改MakeFile和修改源碼
修改
SDK=`xcrun --sdk iphoneos --show-sdk-path`
改成
SDK=~/Desktop/SDKs/iPhoneOS8.X.sdk
再將dumpdecrypted.c第76行的
if (lc->cmd ==LC_ENCRYPTION_INFO || lc->cmd == LC_ENCRYPTION_INFO_64)
改成
if(lc->cmd == LC_ENCRYPTION_INFO)
五、編譯dumpdecrypted.dylib
接著直接cd到“~/Desktop/dumpdecrypted-master/”下害驹，然后輸入“make”并回車鞭呕，在當(dāng)前目錄下生成dumpdecrypted.dylib
不想自己編譯的話，我已經(jīng)全部編譯好了6.0宛官，7.0葫松，8.0
dumpdecrypted.dylib和源碼地址
六、去掉arm64
雖說(shuō)現(xiàn)在IDA6.9已經(jīng)支持arm64底洗，但是arm64還是很難看啊腋么，去掉arm64之后就方便多了
1、把/var/mobile/Applications/XXXXXX/TargetApp.app/XXXTargetApp 復(fù)制到mac上
2亥揖、執(zhí)行命令行
lipo xxx -remove arm64 -output xxx.remove
七珊擂、砸殼
1圣勒、把dumpdecrypted.dylib放到iOS砸殼app的Document下
2、cd到iOS中dumpdecrypted.dylib的目錄下
3摧扇、輸入命令行圣贸，回車砸殼完畢
DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Applications/XXXXXX/TargetApp.app/XXXTargetApp
4、顯示
[+] detected 32bit ARM binary in memory.
[+] offset to cryptid found: @0x81a78(from 0x81000) = a78
[+] Found encrypted data at address 00004000 of length 6569984 bytes - type 1.
[+] Opening /private/var/mobile/Containers/Bundle/Application/03B61840-2349-4559-B28E-0E2C6541F879/TargetApp.app/TargetApp for reading.
[+] Reading header
[+] Detecting header type[+] Executable is a plain MACH-O image
[+] Opening TargetApp.decrypted for writing.
[+] Copying the not encrypted start of the file
[+] Dumping the decrypted data into the file
[+] Copying the not encrypted remainder of the file
[+] Setting the LC_ENCRYPTION_INFO->cryptid to 0 at offset a78
[+] Closing original file[+] Closing dump file
八扛稽、完成
class-dump吁峻、IDA 可以開(kāi)始使用啦
