class-dump
顧名思義就是來(lái)dump頭文件的工具, 簡(jiǎn)單好用
下載地址
先下載class-dump.dmg, 然后把里面的class-dump復(fù)制出來(lái)就可以用了, 如果希望直接運(yùn)行可執(zhí)行文件那么加到/usr/bin里.
但是macos的限制, /usr/bin不讓寫文件, 可以參考這里修改權(quán)限.
然后直接復(fù)制到/usr/bin下,
chomd 777 /usr/bin/class-dump
直接調(diào)用 class-dump使用即可.
另一種在自己的用戶目錄下配置(推薦)
在當(dāng)前用戶新建一個(gè)bash_profile
mkdir ~/bin
mv ../class-dump ~.bin
open -e .bash_profile 輸入 export PATH=?$HOME/bin/:$PATH
source ~/.bash_profile
就可以了(后面theos的一些配置也可以放在bash_profile里, 還是比較方便的).
在dump有swift類可能會(huì)報(bào)錯(cuò)
Error: Cannot find offset for address 0x6800f3c2 in stringAtAddress:
運(yùn)行實(shí)例
class-dump
class-dump 3.5 (64 bit) (Debug version compiled Sep 17 2017 16:24:48)
Usage: class-dump [options] <mach-o-file>
where options are:
-a show instance variable offsets
-A show implementation addresses
--arch <arch> choose a specific architecture from a universal binary (ppc, ppc64, i386, x86_64, armv6, armv7, armv7s, arm64)
-C <regex> only display classes matching regular expression
-f <str> find string in method name
-H generate header files in current directory, or directory specified with -o
-I sort classes, categories, and protocols by inheritance (overrides -s)
-o <dir> output directory used for -H
-r recursively expand frameworks and fixed VM shared libraries
-s sort classes and categories by name
-S sort methods by name
-t suppress header in output, for testing
--list-arches list the arches in the file, then exit
--sdk-ios specify iOS SDK version (will look for /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS<version>.sdk
or /Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS<version>.sdk)
--sdk-mac specify Mac OS X version (will look for /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX<version>.sdk
or /Developer/SDKs/MacOSX<version>.sdk)
--sdk-root specify the full SDK root path (or use --sdk-ios/--sdk-mac for a shortcut)
一般用法
找到對(duì)應(yīng)的xxx.app文件, 然后定位app的可執(zhí)行文件
cd SpringBoard.app
plutil -p info.plist | grep CFBundleExecutable
"CFBundleExecutable" => "SpringBoard"
class-dump -S -s -H SpringBoard -o ~/hfiles/SpringBoardHeaders
至此SpringBoard的所有頭文件就dump出來(lái)了
SpringBoard.png
至于如何導(dǎo)出SpringBoard.app, 首先是需要一臺(tái)越獄的設(shè)備, 使用SSH或者其他文件管理從手機(jī)中導(dǎo)出, 這里不多贅述, 會(huì)有其它文檔詳細(xì)介紹, 這里只記錄工具的配置和基本使用.
