逆向工程一:逆向iOS桌面

当iPhone启动的时候,我们所看到的界面以及进行交互的界面是系统的springboard进程,bundle id为com.apple.springboard。通过ssh登录iPhonessh root@192.168.2.24, 查看进程信息ps -e | grep SpringBoard

创建theos工程

创建tweak工程:/opt/theos/bin/nic.pl

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
NIC 2.0 - New Instance Creator
------------------------------
[1.] iphone/activator_event
[2.] iphone/application_modern
[3.] iphone/cydget
[4.] iphone/flipswitch_switch
[5.] iphone/framework
[6.] iphone/ios7_notification_center_widget
[7.] iphone/library
[8.] iphone/notification_center_widget
[9.] iphone/preference_bundle_modern
[10.] iphone/tool
[11.] iphone/tweak
[12.] iphone/xpc_service
Choose a Template (required):

选择11创建tweak工程

1
2
3
4
5
6
7
8
9
10
11
12
//项目名称    
Project Name (required): demo
//项目的包名,即bundle id
Package Name [com.yourcompany.demo]: cc.onezen.demo
//开发者名称
Author/Maintainer Name [wz]: wz
//需要注入的进程的 bundle id
[iphone/tweak] MobileSubstrate Bundle filter [com.apple.springboard]: com.apple.springboard
//deb包安装完成后需要重启的进程名字
[iphone/tweak] List of applications to terminate upon installation (space-separated, '-' for none) [SpringBoard]: SpringBoard
Instantiating iphone/tweak in demo/...
Done.

theos工程文件

Makefile 默认生成信息如下

1
2
3
4
5
6
7
8
9
10
11
12
13
#theos通用头文件
include $(THEOS)/makefiles/common.mk
#项目名 -> Project Name
TWEAK_NAME = demo
#tweak包含的源文件,指定多个文件时用空格隔开
demo_FILES = Tweak.xm

#tweak工程的头文件,一般有application.mk、tweak.mk和tool.mk几类
include $(THEOS_MAKE_PATH)/tweak.mk

#安装之后,需要做的事情,这里是杀掉SpringBoard进程,SpringBoard是系统进程杀掉会重启
after-install::
install.exec "killall -9 com.apple.springboard"

tweak.xm文件:xm中的x代表这个文件支持Logos语法,如果后缀名是单独一个x,说明源文件支持Logos和C语法;如果后缀名是xm,说明源文件支持Logos和C/C++语法。

  • %hook 指定需要hook的class,必须以%end结尾
  • %log 该指令在%hook内部使用,将函数的类名、参数等信息写入syslog
  • %orig该指令在%hook内部使用,执行被hook的函数的原始代码
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
/* How to Hook with Logos
Hooks are written with syntax similar to that of an Objective-C @implementation.
You don't need to #include <substrate.h>, it will be done automatically, as will
the generation of a class list and an automatic constructor.

%hook ClassName

// Hooking a class method
+ (id)sharedInstance {
return %orig;
}

// Hooking an instance method with an argument.
- (void)messageName:(int)argument {
%log; // Write a message about this call, including its class, name and arguments, to the system log.

%orig; // Call through to the original function with its original arguments.
%orig(nil); // Call through to the original function with a custom argument.

// If you use %orig(), you MUST supply all arguments (except for self and _cmd, the automatically generated ones.)
}

// Hooking an instance method with no arguments.
- (id)noArguments {
%log;
id awesome = %orig;
[awesome doSomethingElse];

return awesome;
}

// Always make sure you clean up after yourself; Not doing so could have grave consequences!
%end
*/

control 文件记录了deb包所需的基本信息,会被打包进deb包里

1
2
3
4
5
6
7
8
9
Package: cc.onezen.demo
Name: demo
Depends: mobilesubstrate
Version: 0.0.1
Architecture: iphoneos-arm
Description: An awesome MobileSubstrate tweak!
Maintainer: wz
Author: wz
Section: Tweaks

手动安装包

根据上面介绍的默认生成的Makefile,是手动安装deb包的配置。

修改Tweak里的代码

1
2
3
4
5
6
7
8
9
%hook SpringBoard

- (void)_menuButtonDown:(struct __IOHIDEvent *)arg1 {
%orig;
UIAlertView *alert = [[UIAlertView alloc] initWithTitle:@"Hello" message:@"wz hook the iphone test" delegate:nil cancelButtonTitle:@"owesome" otherButtonTitles:nil, nil];
[alert show];
[alert release];
}
%end

编译:make

打包:make package

拷贝到iPhone scp packages/cc.onezen.demo_0.0.1-1+debug_iphoneos-arm.deb root@192.168.2.24:/tmp

切换到iphone上安装: dpkg -i /tmp/cc.onezen.demo_0.0.1-1+debug_iphoneos-arm.deb

重启springboard killall -9 SpringBoard。这时候会出现白苹果,几秒后会重新到桌面

点击home键,效果图

1.png

自动安装包

修改Makefile文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
#debug=0是release包
DEBUG = 0
#iphone的ip地址
THEOS_DEVICE_IP = 192.168.2.24
#当前包支持的cpu架构
ARCHS = armv7 arm64
#支持的ios版本
TARGET = iphone:latest:8.0
include $(THEOS)/makefiles/common.mk

TWEAK_NAME = demo
demo_FILES = Tweak.xm
#需要导入的库
demo_FRAMEWORKS = UIKit
demo_PRIVATE_FRAMEWORKS = AppSupport
include $(THEOS_MAKE_PATH)/Tweak.mk

#clean 是指调用make clean的时执行的操作
after-install::
install.exec "killall -9 SpringBoard"
clean::
rm -rf ./packages/*
rm -rf ./.theos/*

编译make

安装make package install

输入两次密码后到桌面

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
➜  demo make package install
> Making all for tweak demo…
make[2]: Nothing to be done for `internal-library-compile'.
> Making stage for tweak demo…
dpkg-deb: warning: deprecated compression type 'lzma'; use xz instead
dpkg-deb: warning: ignoring 1 warning about the control file(s)
dpkg-deb: building package 'cc.onezen.demo' in './packages/cc.onezen.demo_0.0.1-2_iphoneos-arm.deb'.
==> Installing…
root@192.168.2.24's password:
(Reading database ... 4547 files and directories currently installed.)
Preparing to unpack /tmp/_theos_install.deb ...
Unpacking cc.onezen.demo (0.0.1-2) over (0.0.1-1+debug) ...
Setting up cc.onezen.demo (0.0.1-2) ...
install.exec "killall -9 SpringBoard"
root@192.168.2.24's password:

deb包

删除原先的包 dpkg -r cc.onezen.demo 然后手动重启 killall -9 SpringBoard

查看包的结构:dpkg -c cc.onezen.demo_0.0.1-1+debug_iphoneos-arm.deb

1
2
3
4
5
6
drwxr-xr-x wz/staff          0 2017-09-21 18:19 ./
drwxr-xr-x wz/staff 0 2017-09-21 18:19 ./Library/
drwxr-xr-x wz/staff 0 2017-09-21 18:19 ./Library/MobileSubstrate/
drwxr-xr-x wz/staff 0 2017-09-21 18:19 ./Library/MobileSubstrate/DynamicLibraries/
-rwxr-xr-x wz/staff 116368 2017-09-21 18:19 ./Library/MobileSubstrate/DynamicLibraries/demo.dylib
-rw-r--r-- wz/staff 57 2017-09-21 18:19 ./Library/MobileSubstrate/DynamicLibraries/demo.plist

dpkg 打包的时候会把theos根目录下的layout文件夹,映射到安装的设备的根目录下。

脚本文件

1
2
3
4
5
6
7
8
9
10
11
 preinst
在Deb包文件解包之前,运行的脚本。许多“preinst”脚本的任务是停止作用于待升级软件包的服务,直到软件包安装或升级完成。

postinst
该脚本的主要任务是完成安装包时的配置工作。许多“postinst”脚本负责执行有关命令为新安装或升级的软件重启服务。

prerm
该脚本负责停止与软件包相关联的daemon服务。它在删除软件包关联文件之前执行。

postrm
该脚本负责修改软件包链接或文件关联,或删除由它创建的文件。

相关命令

查看签名信息和或者bundle id : codesign -dvvv WeChat

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
Executable=/Users/leaf/yy/WeChat
Identifier=com.tencent.xin
Format=Mach-O thin (arm64)
CodeDirectory v=20200 size=511823 flags=0x0(none) hashes=15987+5 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha1=d6e410a862077728c19fb53f6938e1bbbc723202
CandidateCDHash sha256=0925ea0e119b16a34f890d85ad8e8a4781d4d984
Hash choices=sha1,sha256
CDHash=0925ea0e119b16a34f890d85ad8e8a4781d4d984
Signature size=4297
Authority=Apple iPhone OS Application Signing
Authority=Apple iPhone Certification Authority
Authority=Apple Root CA
Info.plist=not bound
TeamIdentifier=88L2Q4487U
Sealed Resources=none
Internal requirements count=1 size=96