iOS逆向-LLDB高級(jí)用法&Cycript-(ASLR)(Ⅷ)

ASLR

ASLR(Address Space Layout Randomization)喉前，地址空間布局隨機(jī)化庶橱。
是一種針對(duì)緩沖區(qū)溢出的安全保護(hù)技術(shù)，通過對(duì)堆魔眨、棧、共享庫映射等線性區(qū)布局的隨機(jī)化酿雪，通過增加攻擊者預(yù)測目的地址的難度遏暴，防止攻擊者直接定位攻擊代碼位置，達(dá)到阻止溢出攻擊的目的的一種技術(shù)指黎。
iOS4.3開始引入了ASLR技術(shù)朋凉。

在MachOView中查看LC_SEGMENT_64(_TEXT)的VM_Address是0x100000000(__PAGEZERO VM Size),如果沒有ASLR技術(shù)，MachO文件在內(nèi)存中的物理地址就是0x100000000


查看MachO文件的在內(nèi)存中的物理地址0x00000001043bc000

(lldb) image list
[  0] 802EFF39-2417-3E7E-97B8-E21AD7AFD27A 0x00000001043bc000 /Users/niujf/Library/Developer/Xcode/DerivedData/001--Demo-dantuskxyprjdbcmfkmwgrxzoxbt/Build/Products/Debug-iphoneos/001--Demo.app/001--Demo 
[  1] 571392A7-E1E6-369F-8805-C1A141F3C1C5 0x0000000104488000 /Users/niujf/Library/Developer/Xcode/iOS DeviceSupport/13.1.3 (17A878)/Symbols/usr/lib/dyld 
...

可以看到ASLR隨機(jī)產(chǎn)生的Offset,也就是MachO文件的偏移值是0x1043bc000-0x100000000=0x43bc000

如何給一個(gè)函數(shù)設(shè)置內(nèi)存斷點(diǎn)醋安？

隨便寫一個(gè)方法杂彭，在Hopper中查看方法在文件中的地址是00000001000065f0,由于Hopper會(huì)自動(dòng)加上一個(gè)__PAGEZERO VM Size 0x100000000,所以實(shí)際方法在文件中的偏移值是0x65f0


在MachOView中查看__PAGEZERO，可以看到在文件中的File offset和File Size都是0

Hopper吓揪、IDA都是未使用ASLR的VM Address

方法在內(nèi)存中的物理地址 = __PAGEZERO VM Size + File Offset + ASLR Offset = 0x100000000 + 0x65f0 + 0x43bc000
如下對(duì)方法的在內(nèi)存中的物理地址下斷點(diǎn)亲怠，可以看到下斷點(diǎn)成功了。

(lldb) b -a 00000001000065f0+0x43bc000
Breakpoint 1: where = 001--Demo`-[ViewController eatWithObjc:] at ViewController.m:17, address = 0x00000001043c25f0
(lldb) breakpoint list
Current breakpoints:
1: address = 001--Demo[0x00000001000065f0], locations = 1, resolved = 1, hit count = 0
  1.1: where = 001--Demo`-[ViewController eatWithObjc:] at ViewController.m:17, address = 0x00000001043c25f0, resolved, hit count = 0

如何查看一個(gè)全局變量在MachO文件中的位置柠辞？

查看一個(gè)int類型的全局變量a在內(nèi)存的物理地址

int a = 10;

-(void)touchesBegan:(NSSet<UITouch *> *)touches withEvent:(UIEvent *)event
{
    a = 20;   //打上斷點(diǎn)
    NSLog(@"%d",a);
}

(lldb) p a
(int) $0 = 10
(lldb) p &a
(int *) $1 = 0x0000000102ad4df0

可以看到全局變量a在內(nèi)存中的物理地址是0x0000000102ad4df0

(lldb) image list
[  0] 802EFF39-2417-3E7E-97B8-E21AD7AFD27A 0x0000000102acc000 /Users/niujf/Library/Developer/Xcode/DerivedData/001--Demo-dantuskxyprjdbcmfkmwgrxzoxbt/Build/Products/Debug-iphoneos/001--Demo.app/001--Demo

MachO文件在內(nèi)存中的物理地址是0x0000000102acc000团秽，全局變量a在文件中的偏移值就是0x0000000102ad4df0 - 0x0000000102acc000 = 0x8df0

在MachOView中查看0x8df0位置對(duì)應(yīng)的數(shù)據(jù)是0xA0,也就是十進(jìn)制10.

chisel

chisel一個(gè)LLDB命令集合，用于幫助調(diào)試iOS應(yīng)用程序。
可以通過Homebrew安裝,具體的安裝命令在README里有

chisel在Xcode11上遇到的問題
error: module importing failed: Missing parentheses in call to 'print'. Did you mean print('Whoops! You are missing the <' + arg.argName + '> argument.')? (fblldb.py, line 98)
  File "temp.py", line 1, in <module>

莫慌习勤，在issues里面已經(jīng)給出了解決方案,有兩種踪栋，lz是在 /usr/local/Cellar/chisel/1.8.1 路徑下替換了修改了源碼兼容Python 3的libexec文件

chisel的Commands

如果對(duì)那個(gè)Commands不熟悉，可以通過(lldb) help Commands 查看,也可以看README

  • pviews(打印當(dāng)前頁面的視圖層級(jí))
(lldb) pviews
<UIWindow: 0x135e0be70; frame = (0 0; 375 812); gestureRecognizers = <NSArray: 0x283f42310>; layer = <UIWindowLayer: 0x283142fa0>>
   | <UITransitionView: 0x135e14430; frame = (0 0; 375 812); autoresize = W+H; layer = <CALayer: 0x2831688c0>>
   |    | <UIDropShadowView: 0x135e14be0; frame = (0 0; 375 812); clipsToBounds = YES; autoresize = W+H; layer = <CALayer: 0x283168980>>
   |    |    | <UIView: 0x135e13cd0; frame = (0 0; 375 812); autoresize = W+H; layer = <CALayer: 0x283168620>>
   |    |    |    | <UIButton: 0x135e13320; frame = (100 200; 100 100); opaque = NO; layer = <CALayer: 0x283168780>>
   |    |    |    |    | <UIButtonLabel: 0x135e23c50; frame = (31.6667 39; 37 22); text = ''; opaque = NO; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x281268000>>
   |    |    |    |    |    | <_UILabelContentLayer: 0x283171be0> (layer)
(lldb) pviews self.view
<UIView: 0x135e13cd0; frame = (0 0; 375 812); autoresize = W+H; layer = <CALayer: 0x283168620>>
   | <UIButton: 0x135e13320; frame = (100 200; 100 100); opaque = NO; layer = <CALayer: 0x283168780>>
   |    | <UIButtonLabel: 0x135e23c50; frame = (31.6667 39; 37 22); text = ''; opaque = NO; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x281268000>>
   |    |    | <_UILabelContentLayer: 0x283171be0> (layer)
  • pvc(打印當(dāng)前頁面的控制器)
(lldb) pvc
<ViewController 0x135e0afc0>, state: appeared, view: <UIView 0x135e13cd0>
  • presponder(打印響應(yīng)者鏈)
(lldb) presponder 0x149d05b60 //按鈕的在內(nèi)存中的真實(shí)地址
<UIButton: 0x149d05b60; frame = (100 200; 100 100); opaque = NO; layer = <CALayer: 0x280e3ab00>>
   | <UIView: 0x149d039d0; frame = (0 0; 375 812); autoresize = W+H; layer = <CALayer: 0x280e3aa00>>
   |    | <ViewController: 0x149e07d80>
   |    |    | <UIDropShadowView: 0x149d073a0; frame = (0 0; 375 812); clipsToBounds = YES; autoresize = W+H; layer = <CALayer: 0x280e3aae0>>
   |    |    |    | <UITransitionView: 0x149d06bf0; frame = (0 0; 375 812); autoresize = W+H; layer = <CALayer: 0x280e3aac0>>
   |    |    |    |    | <UIWindow: 0x149e08c30; frame = (0 0; 375 812); gestureRecognizers = <NSArray: 0x280050420>; layer = <UIWindowLayer: 0x280e14f00>>
   |    |    |    |    |    | <UIWindowScene: 0x149e04330; scene = <FBSSceneImpl: 0x28202cc80; identifier: sceneID:com.ttt.jinxiao-default>; persistentIdentifier = 42D38740-A3B7-4D1F-BB16-34AA4FE0252A; activationState = UISceneActivationStateForegroundActive; settingsCanvas = <UIWindowScene: 0x149e04330>; windows = (
    "<UIWindow: 0x149e08c30; frame = (0 0; 375 812); gestureRecognizers = <NSArray: 0x280050420>; layer = <UIWindowLayer: 0x280e14f00>>",
    "<UITextEffectsWindow: 0x149d32600; frame = (0 0; 375 812); opaque = NO; autoresize = W+H; layer = <UIWindowLayer: 0x280e160a0>>"
)>
   |    |    |    |    |    |    | <UIApplication: 0x149e02140>
   |    |    |    |    |    |    |    | <AppDelegate: 0x280e3a600>
  • pactions(打印一個(gè)控件的響應(yīng)方法和調(diào)用者)
(lldb) pactions 0x149d05b60
<ViewController: 0x149e07d80>: btClicked
  • pclass(打印class的繼承關(guān)系)
(lldb) pclass 0x149d05b60
UIButton
   | UIControl
   |    | UIView
   |    |    | UIResponder
   |    |    |    | NSObject
  • fvc(根據(jù)ViewController的Class名字查找VC)
(lldb) fvc ViewController
0x105002580 ViewController
(lldb) fvc -v 0x105002580
Found the owning view controller.
<ViewController: 0x105002580>
  • pmethods(打印一個(gè)類的類和實(shí)例方法)
(lldb) pmethods 0x105002580
Class Methods:
No methods were found

Instance Methods:
- (void)btClicked
- (void)setBtn:(id)arg0 
- (void)testMethod:(id)arg0 
- (void)setTestArray:(id)arg0 
- (id)btn
- (void).cxx_destruct
- (void)touchesBegan:(id)arg0 withEvent:(id)arg1 
- (void)viewDidLoad
- (id)test
- (id)testArray
- (void)setTest:(id)arg0
  • pinternals(打印一個(gè)對(duì)象內(nèi)部的成員變量)
(lldb) pinternals 0x105002580
(ViewController) $16 = {
  _test = nil
  _testArray = nil
  _btn = 0x0000000105107520
}
  • taplog(我們需要先將程序暫停姻报，輸入taplog己英，程序會(huì)自己運(yùn)行，這時(shí)候點(diǎn)擊你需要查看的view吴旋，控制臺(tái)上就會(huì)顯示出你剛剛點(diǎn)擊的view相關(guān)信息损肛。)
(lldb) taplog
Process 669 resuming
<UIButton: 0x105107520; frame = (100 200; 100 100); opaque = NO; layer = <CALayer: 0x282a70f80>>

要查看的view必須能接收點(diǎn)擊事件，也就是他的userInteractionEnabled必須為YES才能被找到荣瑟，UILabel和UIImageView默認(rèn)userInteractionEnabled為NO治拿。

  • flicker(將view閃爍一下，以便于查找view的位置)
flicker 0x105107520  //view的在內(nèi)存中的真實(shí)地址
  • vs(在view層級(jí)中搜索view笆焰，并顯示出來)
(lldb) vs 0x105107520

Use the following and (q) to quit.
(w) move to superview
(s) move to first subview
(a) move to previous sibling
(d) move to next sibling
(p) print the hierarchy

<UIButton: 0x105107520; frame = (100 200; 100 100); opaque = NO; layer = <CALayer: 0x282a70f80>>

DerekSelander-LLDB

DerekSelander-LLDB是另一款比較好用的LLDB調(diào)試工具
README.md里面有安裝步驟劫谅，這里lz是把lldb_commands文件夾，放到了跟chisel同級(jí)目錄嚷掠，/usr/local/opt,然后在~/.lldbinit里面加上 command script import /usr/local/opt/lldb_commands/dslldb.py 就ok了

常用命令

  • search(在堆中搜索某個(gè)類的所有活動(dòng)實(shí)例,此類必須是動(dòng)態(tài)的(繼承NSObject / SwiftObject),目前不適用于NSString或NSNumber(標(biāo)記的指針對(duì)象))
(lldb) search UIView
<UIViewControllerWrapperView: 0x10b76dd00; frame = (0 0; 414 736); autoresize = W+H; layer = <CALayer: 0x283716880>>

<UIImageView: 0x10b587350; frame = (0 -0.333333; 414 0.333333); userInteractionEnabled = NO; layer = <CALayer: 0x28377cb40>>

<_UINavigationBarLargeTitleView: 0x10b54eb70; frame = (0 0; 0 0); clipsToBounds = YES; hidden = YES; layer = <CALayer: 0x2837aec60>>
...
  • methods(打印所屬類別的所有方法和成員變量)
(lldb) methods 0x2814fceb0
<WCAccountLoginControlLogic: 0x2814fceb0>:
in WCAccountLoginControlLogic:
    Properties:
        @property (readonly) unsigned long hash;
        @property (readonly) Class superclass;
        @property (readonly, copy) NSString* description;
        @property (readonly, copy) NSString* debugDescription;
    Instance Methods:
        - (void) startLogic; (0x10511d4e8)
        - (void) stopLogic; (0x10511da50)
        - (void) onOneClickLoginSwitchAccount; (0x10511e2e0)
        - (void) onOneClickLoginProblem; (0x10511e314)
        - (void) onOneClickLoginGoToSecurityCenter; (0x10511e34c)
        - (void) onOneClickLoginGoToHelpCenter; (0x10511e384)
...
  • sbt(恢復(fù)去符號(hào)的函數(shù)調(diào)用棧信息)
(lldb) b -a 0x10511dbcc           //對(duì)一個(gè)函數(shù)方法下斷點(diǎn)
(lldb) c
Process 19583 resuming
(lldb) bt   //查看函數(shù)堆棧調(diào)用信息捏检，frame #0是去符號(hào)的函數(shù)調(diào)用信息
* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
  * frame #0: 0x000000010511dbcc WeChat`___lldb_unnamed_symbol142055$$WeChat
    frame #1: 0x0000000193667a44 UIKitCore`-[UIApplication sendAction:to:from:forEvent:] + 96

(lldb) sbt       //frame #0 恢復(fù)了去符號(hào)的函數(shù)調(diào)用信息
frame #0 : 0x10511dbcc WeChat`-[WCAccountLoginControlLogic onFirstViewLogin] 
frame #1 : 0x193667a44 UIKitCore`-[UIApplication sendAction:to:from:forEvent:] + 96

README.md里面還有其他命令，可以自己去嘗試

Cycript

Cycript是由Cydia創(chuàng)始人Saurik推出的一款腳本語言不皆，Cycript混合了OC贯城、JavaScript語法的解釋器，這意味著我們能夠在一個(gè)命令中使用OC或者JavaScript霹娄，甚至兩者并用能犯。它能夠掛鉤正在運(yùn)行的進(jìn)程，能夠在運(yùn)行時(shí)修改很多東西犬耻。

Cycript的安裝

1. 下載Cycript后踩晶，解壓后直接把 cycript_0文件夾放到 /opt 目錄下.


2. Terminal執(zhí)行如下命令

$ cd /opt/cycript_0 
$ ./cycript

如果出現(xiàn)

dyld: Library not loaded: /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/libruby.2.0.0.dylib
  Referenced from: /opt/cycript_0/./Cycript.lib/cycript-apl
  Reason: image not found
Abort trap: 6

這個(gè)錯(cuò)誤是因?yàn)殡娔X的ruby版本太高導(dǎo)致

3. 查看電腦ruby版本

$ cd /System/Library/Frameworks/Ruby.framework/Versions/
$ ls
2.3 Current

4. 創(chuàng)建Ruby2.0版本文件，并將2.3版本文件拷貝到2.0中

sudo mkdir -p /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/
sudo ln -s /System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/libruby.2.3.0.dylib /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/libruby.2.0.0.dylib

如果出現(xiàn)

mkdir: /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/: Operation not permitted

5. 關(guān)閉系統(tǒng)的SIP
系統(tǒng)完整性保護(hù)(SIP)

  • 通過重新啟動(dòng)計(jì)算機(jī)并在啟動(dòng)時(shí)按住Command+R鍵啟動(dòng)到恢復(fù)操作系統(tǒng)枕磁。
  • 從 Utilities 菜單啟動(dòng) Terminal渡蜻。
  • 輸入以下命令：csrutil disable
  • 重新啟動(dòng)您的計(jì)算機(jī)

6. 重新執(zhí)行步驟4和步驟2，出現(xiàn)如下標(biāo)志计济，安裝成功茸苇！

cy#

control + D 退出 Cycript

Cycript配置環(huán)境變量

1. 編輯bash_profile文件

$ cd ~/
$ vim .bash_profile

2. 添加如下配置信息

#Cycript
export CY_PATH_ROOT=/opt/cycript_0
export PATH=$CY_PATH_ROOT:$PATH

3. 退出文件編輯并保存,執(zhí)行如下命令查看，cycript環(huán)境變量配置成功

$ cycript
cy#

Cycript的簡單使用

Cycript連接手機(jī)有兩種方式：

  1. 通過ssh登錄峭咒，需要越獄手機(jī)打開ssh端口
  2. 在非越獄手機(jī)上税弃，我們可以使用MonkeyDev(iOS逆向-反Hook防護(hù)(VI)里面有詳細(xì)介紹安裝和使用)。它里面有句代碼CYListenServer(6666)凑队，代表在當(dāng)前應(yīng)用給Cycript的Server端申請了一個(gè)端口號(hào)6666则果，我們可以在終端通過這個(gè)端口號(hào)在運(yùn)行時(shí)給當(dāng)前應(yīng)用附加Cycript(MonkeyDev已經(jīng)幫我們注入了libcycript.dylib)
$ cycript -r 172.20.0.240:6666
cy#

172.20.0.240是手機(jī)網(wǎng)絡(luò)的ip

cy# UIWindow.keyWindow()
#"<iConsoleWindow: 0x10b139fc0; baseClass = UIWindow; frame = (0 0; 414 736); gestureRecognizers = <NSArray: 0x283099110>; layer = <UIWindowLayer: 0x283e296e0>>"
cy# [UIApplication sharedApplication]
#"<UIApplication: 0x10b115b50>"
cy# UIApp
#"<UIApplication: 0x10b115b50>"
cy# var keyWindow = UIWindow.keyWindow()
#"<iConsoleWindow: 0x10b139fc0; baseClass = UIWindow; frame = (0 0; 414 736); gestureRecognizers = <NSArray: 0x283099110>; layer = <UIWindowLayer: 0x283e296e0>>"
cy# keyWindow
#"<iConsoleWindow: 0x10b139fc0; baseClass = UIWindow; frame = (0 0; 414 736); gestureRecognizers = <NSArray: 0x283099110>; layer = <UIWindowLayer: 0x283e296e0>>"
cy# keyWindow.rootViewController
#"<MMUINavigationController: 0x10b920a00>"
cy# #0x10b920a00 //根據(jù)地址獲取對(duì)象
#"<MMUINavigationController: 0x10b920a00>"

cy# *#0x10b920a00 //獲取對(duì)象的所有成員變量和值
{isa:MMUINavigationController,_responderFlags:@error,_overrideTransitioningDelegate:null,_view:#"<UILayoutContainerView: 0x10b13a2f0; frame = (0 0; 414 736); clipsToBounds = YES; 
...

cy# [i for(i in *keyWindow)]  //獲取對(duì)象的所有成員變量（key）
["isa","_responderFlags","_constraintsExceptingSubviewAutoresizingConstraints","_cachedTraitCollection","_animationInfo","_layer","_layerRetained","_gestureRecognizers","_window","_subvi....

cy# choose(UIButton)  //獲取所有UIButton的對(duì)象
[#"<UIButton: 0x10b54ba10; frame = (269 20; 145 49); opaque = NO; autoresize = LM; layer = <CALayer: 0x283efd4e0>>",#"<FixTitleColorButton: 0x10b11d960; baseClass = UIButton; frame = (20 18; 177 47); clipsToBounds = YES; opaque = NO; autoresize = RM; layer = <CALayer: 0x283e20a20>>",#"<FixTitleColorButton: 0x10b1477b0; baseClass = UIButton; frame = (217 18; 177 47); clipsToBounds = YES; opaque = NO; autoresize = LM; layer = <CALayer: 0x283ef8020>>"]

cy# keyWindow.recursiveDescription().toString() //打印所有的視圖層級(jí)
`<iConsoleWindow: 0x10b139fc0; baseClass = UIWindow; frame = (0 0; 414 736); gestureRecognizers = <NSArray: 0x283099110>; layer = <UIWindowLayer: 0x283e296e0>>
   | <UILayoutContainerView: 0x10b13a2f0; frame = (0 0; 414 736); clipsToBounds = YES; autoresize = W+H; gestureRecognizers = <NSArray: 0x283099b30>; layer = <CALayer: 0x283e29ac0>>
...

Shell腳本連接

1. 創(chuàng)建一個(gè)Shell腳本文件cylogin.sh, 路徑如下

$ open ~/ 打開根目錄

2. 添加可執(zhí)行權(quán)限

$ chmod +x  cylogin.sh

3. 配置環(huán)境變量

export NJSHELL=/Users/niujf/NJShell
export PATH=$CY_PATH_ROOT:$PATH:$NJSHELL
如果以前沒有配置環(huán)境變量就是
export PATH=$NJSHELL

4. 執(zhí)行Shell腳本文件cylogin.sh

$ sh cylogin.sh

Cycript的高級(jí)用法

cy# APPID
@"com.ttt.jinxiao"
cy# pviews
function (){return UIApp.keyWindow.recursiveDescription().toString()}
cy# pviews()    //打印當(dāng)前頁面的view
`<iConsoleWindow: 0x11bd49860; baseClass = UIWindow; frame = (0 0; 414 736); gestureRecognizers = <NSArray: 0x2831f62b0>; layer = <UIWindowLayer: 0x283f7e320>>
   | <UILayoutContainerView: 0x11bd48310; frame = (0 0; 414 736); clipsToBounds = YES; autoresize = W+H; gestureRecognizers = <NSArray: 0x2831cb0f0>; layer = <CALayer: 0x283f7d380>>
   |    | <UINavigationTransitionView: 0x11be2c9b0; frame = (0 0; 414 736); clipsToBounds = YES; autoresize = W+H; layer = <CALayer: 0x283f65300>>
   |    |    | <UIViewControllerWrapperView: 0x11bd601d0; frame = (0 0; 414 736); autoresize = W+H; layer = <CALayer: 0x283fa09e0>>
   |    |    |    | <UIView: 0x11bd24df0; frame = (0 0; 414 736); autoresize = W+H; layer = <CALayer: 0x283f749a0>>
   |    |    |    |    | <UIView: 0x11bd37310; frame = (0 20; 414 801); autoresize = W; layer = <CALayer: 0x283f74bc0>>
   |    |    |    |    |    | <UIImageView: 0x11be11970; frame = (0 -20; 414 736); opaque = NO; userInteractionEnabled = NO; layer = <CALayer: 0x283f70ec0>>
   |    |    |    |    | <UIView: 0x11be12b70; frame = (0 651; 414 65); autoresize = W+TM; layer = <CALayer: 0x283f70fc0>>
   |    |    |    |    |    | <FixTitleColorButton: 0x11be35910; baseClass = UIButton; frame = (20 18; 177 47); clipsToBounds = YES; opaque = NO; autoresize = RM; layer = <CALayer: 0x283f71040>>
   |    |    |    |    |    |    | <UIButtonLabel: 0x11bd0dfe0; frame = (70 12.6667; 37 22); text = '\u767b\u5165'; opaque = NO; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x281c4e760>>
   |    |    |    |    |    |    |    | <_UILabelContentLayer: 0x283fa0ee0> (layer)
   |    |    |    |    |    | <FixTitleColorButton: 0x11be40660; baseClass = UIButton; frame = (217 18; 177 47); clipsToBounds = YES; opaque = NO; autoresize = LM; layer = <CALayer: 0x283faba40>>
   |    |    |    |    |    |    | <UIButtonLabel: 0x11be40a70; frame = (70 12.6667; 37 22); text = '\u8a3b\u518a'; opaque = NO; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x281c45cc0>>
   |    |    |    |    |    |    |    | <_UILabelContentLayer: 0x283fa0da0> (layer)
   |    |    |    |    | <UIButton: 0x11bd37fc0; frame = (269 20; 145 49); opaque = NO; autoresize = LM; layer = <CALayer: 0x283f52600>>
   |    |    |    |    |    | <UIButtonLabel: 0x11be427b0; frame = (15 16; 115 17); text = '\u7e41\u9ad4\u4e2d\u6587\uff08\u81fa\u7063\uff09'; opaque = NO; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x281c45950>>
   |    |    |    |    |    |    | <_UILabelContentLayer: 0x283fa0d20> (layer)`
cy# pvcs()     //打印當(dāng)前頁面的控制器
"<MMUINavigationController 0x11c0f3e00>, state: appeared, view: <UILayoutContainerView 0x11bd48310>\n   | <WCAccountLoginFirstViewController 0x11c87ae00>, state: appeared, view: <UIView 0x11bd24df0>"
cy# pactions(#0x11be35910)      //獲取對(duì)象的action
"<WCAccountLoginControlLogic: 0x281c4a8a0> onFirstViewLogin"
cy# rp(#0x11be35910)      //獲取對(duì)象的響應(yīng)者
`<FixTitleColorButton: 0x11be35910; baseClass = UIButton; frame = (20 18; 177 47); clipsToBounds = YES; opaque = NO; autoresize = RM; layer = <CALayer: 0x283f71040>>
<UIView: 0x11be12b70; frame = (0 651; 414 65); autoresize = W+TM; layer = <CALayer: 0x283f70fc0>>
<UIView: 0x11bd24df0; frame = (0 0; 414 736); autoresize = W+H; layer = <CALayer: 0x283f749a0>>
<WCAccountLoginFirstViewController: 0x11c87ae00>
<UIViewControllerWrapperView: 0x11bd601d0; frame = (0 0; 414 736); autoresize = W+H; layer = <CALayer: 0x283fa09e0>>
<UINavigationTransitionView: 0x11be2c9b0; frame = (0 0; 414 736); clipsToBounds = YES; autoresize = W+H; layer = <CALayer: 0x283f65300>>
<UILayoutContainerView: 0x11bd48310; frame = (0 0; 414 736); clipsToBounds = YES; autoresize = W+H; gestureRecognizers = <NSArray: 0x2831cb0f0>; layer = <CALayer: 0x283f7d380>>
<MMUINavigationController: 0x11c0f3e00>
<iConsoleWindow: 0x11bd49860; baseClass = UIWindow; frame = (0 0; 414 736); gestureRecognizers = <NSArray: 0x2831f62b0>; layer = <UIWindowLayer: 0x283f7e320>>
<UIWindowScene: 0x11be11c40; scene = <FBSSceneImpl: 0x28113c500; identifier: sceneID:com.ttt.jinxiao-default>; persistentIdentifier = 62B17F00-49F3-4938-80BC-83289F774DF4; activationState = UISceneActivationStateForegroundActive; settingsCanvas = <UIWindowScene: 0x11be11c40>; windows = (
    "<iConsoleWindow: 0x11bd1a530; baseClass = UIWindow; frame = (0 0; 414 736); gestureRecognizers = <NSArray: 0x2831a7600>; layer = <UIWindowLayer: 0x283f1dee0>>",
    "<iConsoleWindow: 0x11bd49860; baseClass = UIWindow; frame = (0 0; 414 736); gestureRecognizers = <NSArray: 0x2831f62b0>; layer = <UIWindowLayer: 0x283f7e320>>",
    "<UITextEffectsWindow: 0x11be3cc90; frame = (0 0; 414 736); opaque = NO; autoresize = W+H; layer = <UIWindowLayer: 0x283fb3f00>>"
)>
<UIApplication: 0x11bd16880>
<MicroMessengerAppDelegate: 0x28032ef00>`

在MonkeyDev的MDConfig.plist文件中幔翰，里面有鏈接，打開可以看到上面的命令其實(shí)都是已經(jīng)封裝好的

cy文件的封裝

1. 在MonkeyDev中新建一個(gè)空的文件西壮，命名test.cy
2. 在Build Phases->Copy Files中添加test.cy文件


3. 將test.cy文件類型改為 javaScript Source類型遗增，擼代碼，可以參考mjcript
4. 運(yùn)行項(xiàng)目款青，終端調(diào)用

$ sh cylogin.sh
cy# @import test
{}
cy# MJAppId
@"com.ttt.jinxiao"
...

里面封裝了很多命令就不一一演示了

最后編輯于 ：
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請聯(lián)系作者
  • 人面猴
    序言：七十年代末做修，一起剝皮案震驚了整個(gè)濱河市，隨后出現(xiàn)的幾起案子抡草，更是在濱河造成了極大的恐慌饰及，老刑警劉巖，帶你破解...
    沈念sama閱讀 206,214評(píng)論 6贊 481
  • 死咒
    序言：濱河連續(xù)發(fā)生了三起死亡事件康震，死亡現(xiàn)場離奇詭異燎含，居然都是意外死亡，警方通過查閱死者的電腦和手機(jī)腿短，發(fā)現(xiàn)死者居然都...
    沈念sama閱讀 88,307評(píng)論 2贊 382
  • 救了他兩次的神仙讓他今天三更去死
    文/潘曉璐 我一進(jìn)店門屏箍，熙熙樓的掌柜王于貴愁眉苦臉地迎上來，“玉大人橘忱，你說我怎么就攤上這事赴魁。” “怎么了钝诚？”我有些...
    開封第一講書人閱讀 152,543評(píng)論 0贊 341
  • 道士緝兇錄：失蹤的賣姜人
    文/不壞的土叔 我叫張陵颖御，是天一觀的道長。 經(jīng)常有香客問我敲长，道長郎嫁，這世上最難降的妖魔是什么秉继？ 我笑而不...
    開封第一講書人閱讀 55,221評(píng)論 1贊 279
  • ?港島之戀（遺憾婚禮）
    正文 為了忘掉前任祈噪，我火速辦了婚禮，結(jié)果婚禮上尚辑，老公的妹妹穿的比我還像新娘辑鲤。我一直安慰自己，他們只是感情好杠茬，可當(dāng)我...
    茶點(diǎn)故事閱讀 64,224評(píng)論 5贊 371
  • 惡毒庶女頂嫁案：這布局不是一般人想出來的
    文/花漫 我一把揭開白布月褥。 她就那樣靜靜地躺著，像睡著了一般瓢喉。 火紅的嫁衣襯著肌膚如雪宁赤。 梳的紋絲不亂的頭發(fā)上，一...
    開封第一講書人閱讀 49,007評(píng)論 1贊 284
  • 城市分裂傳說
    那天栓票，我揣著相機(jī)與錄音决左，去河邊找鬼。 笑死，一個(gè)胖子當(dāng)著我的面吹牛佛猛，可吹牛的內(nèi)容都是我干的惑芭。 我是一名探鬼主播，決...
    沈念sama閱讀 38,313評(píng)論 3贊 399
  • 雙鴛鴦連環(huán)套：你想象不到人心有多黑
    文/蒼蘭香墨 我猛地睜開眼继找，長吁一口氣：“原來是場噩夢啊……” “哼遂跟！你這毒婦竟也來了？” 一聲冷哼從身側(cè)響起婴渡，我...
    開封第一講書人閱讀 36,956評(píng)論 0贊 259
  • 萬榮殺人案實(shí)錄
    序言：老撾萬榮一對(duì)情侶失蹤幻锁，失蹤者是張志新（化名）和其女友劉穎，沒想到半個(gè)月后边臼，有當(dāng)?shù)厝嗽跇淞掷锇l(fā)現(xiàn)了一具尸體越败，經(jīng)...
    沈念sama閱讀 43,441評(píng)論 1贊 300
  • ?護(hù)林員之死
    正文 獨(dú)居荒郊野嶺守林人離奇死亡，尸身上長有42處帶血的膿包…… 初始之章·張勛 以下內(nèi)容為張勛視角 年9月15日...
    茶點(diǎn)故事閱讀 35,925評(píng)論 2贊 323
  • ?白月光啟示錄
    正文 我和宋清朗相戀三年硼瓣，在試婚紗的時(shí)候發(fā)現(xiàn)自己被綠了究飞。 大學(xué)時(shí)的朋友給我發(fā)了我未婚夫和他白月光在一起吃飯的照片。...
    茶點(diǎn)故事閱讀 38,018評(píng)論 1贊 333
  • 活死人
    序言：一個(gè)原本活蹦亂跳的男人離奇死亡堂鲤，死狀恐怖亿傅，靈堂內(nèi)的尸體忽然破棺而出，到底是詐尸還是另有隱情瘟栖，我是刑警寧澤葵擎，帶...
    沈念sama閱讀 33,685評(píng)論 4贊 322
  • ?日本核電站爆炸內(nèi)幕
    正文 年R本政府宣布，位于F島的核電站半哟，受9級(jí)特大地震影響酬滤，放射性物質(zhì)發(fā)生泄漏。R本人自食惡果不足惜寓涨，卻給世界環(huán)境...
    茶點(diǎn)故事閱讀 39,234評(píng)論 3贊 307
  • 男人毒藥：我在死后第九天來索命
    文/蒙蒙 一盯串、第九天 我趴在偏房一處隱蔽的房頂上張望。 院中可真熱鬧戒良，春花似錦体捏、人聲如沸。這莊子的主人今日做“春日...
    開封第一講書人閱讀 30,240評(píng)論 0贊 19
  • 一樁弒父案几缭，背后竟有這般陰謀
    文/蒼蘭香墨 我抬頭看了看天上的太陽。三九已至沃呢，卻和暖如春年栓，著一層夾襖步出監(jiān)牢的瞬間，已是汗流浹背薄霜。 一陣腳步聲響...
    開封第一講書人閱讀 31,464評(píng)論 1贊 261
  • 情欲美人皮
    我被黑心中介騙來泰國打工某抓， 沒想到剛下飛機(jī)就差點(diǎn)兒被人妖公主榨干…… 1. 我叫王不留竿刁，地道東北人。 一個(gè)月前我還...
    沈念sama閱讀 45,467評(píng)論 2贊 352
  • 代替公主和親
    正文 我出身青樓搪缨，卻偏偏與公主長得像食拜，于是被迫代替她去往敵國和親。 傳聞我的和親對(duì)象是個(gè)殘疾皇子副编，可洞房花燭夜當(dāng)晚...
    茶點(diǎn)故事閱讀 42,762評(píng)論 2贊 345