如果你想逆向 某些app的调用流程 或者 系统app的一些功能的 私有framework class api 调用流程, 可以试试此工具
只需要 配置需要挂接的 类名和app名, 就可以实时追踪 相关功能的 调用流程。 支持批量 hook n多个类名
一、安装方法:
1.配置需要挂接的应用,相关参数:
在mac下通过xcode打开 iTracer.plist ,就改 filter 下 bundles 列表,设置需要挂接的app名,具体设置可以参考
mobilesubstrate的相关文档:
http://www.iphonedevwiki.net/index.php/MobileSubstrate
例如要挂接SpringBoard(挂接这个一般比较危险,做好会白苹果的准备 = =!, 真白了 也没事: 同时按开机键+home, 之后再按 开机+音量+, 进入无插件模式,用itools吧对应的插件删了重启就行了):
Filter = {
Bundles = (com.apple.springboard);
};
2.配置需要挂接的 class 的 所有 api, 例如:
Trace = {
item0 = (UIView),
item1 = (UIViewController),
item2 = (UIApplication),
};
3.配置是否开启 打印api详细参数值功能(这个还有些不稳定,打印某些值会挂掉,不过通常情况下 够用了,先凑活着用吧 = =)
TraceArgs = YES/NO
如果不巧打印的时候 真挂了,就把这个功能禁用,仅仅 trace api的调用流程, 还是很稳定的。。
2.利用itool等工具,讲 iTracer.dylib 和 iTracer.plist 放到系统 mobilesubstrate 插件目录:
/Library/MobileSubstrate/DynamicLibraries
3.然后重启SpringBoard(可以通过PPHelper注销、或者ssh登上去 killall -9 SpringBoard)
二、下面是我 trace PPHelper的 一些log, 注: log 的实际输出在: Xcode-Organizer-Console 中:
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView _addSubview:positioned:relativeTo:]: >: -1: null
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView superview]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView window]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView window]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView _shouldTryPromoteDescendantToFirstResponder]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView _isAncestorOfFirstResponder]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView description]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView frame]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView transform]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView clipsToBounds]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView layer]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView alpha]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView isHidden]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView isOpaque]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView autoresizingMask]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView autoresizesSubviews]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView isUserInteractionEnabled]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView tag]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView willMoveToSuperview:]: >
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView _unsubscribeToScrollNotificationsIfNecessary:]: null
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView _makeSubtreePerformSelector:withObject:]: : null
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView _makeSubtreePerformSelector:withObject:withObject:copySublayers:]: : null: null: 0
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView _invalidateSubviewCache]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView actionForLayer:forKey:]: : sublayers
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView description]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView frame]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView transform]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView clipsToBounds]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView layer]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView alpha]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView isHidden]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView isOpaque]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView autoresizingMask]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView autoresizesSubviews]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView isUserInteractionEnabled]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView tag]
Dec 11 10:50:46 unknown PPHelper[3090] : [iTracer]: [UIView _subscribeToScrollNotificationsIfNecessary:]: >
再比如 我 trace iTunes-U的 一些log:
Dec 11 11:03:56 unknown iTunesU[3393] : [iTracer]: [SSAccountStore init]
Dec 11 11:03:56 unknown iTunesU[3393] : [iTracer]: [SSAccountStore activeAccount]
Dec 11 11:03:56 unknown iTunesU[3393] : [iTracer]: [SSAccountStore _reloadAccountsIfNeeded]
Dec 11 11:03:56 unknown iTunesU[3393] : [iTracer]: [SSAccountStore _setAccounts:]: (
": (1096041240, xxxxxx@gmail.com)",
": (1264698560, xxxxxx@gmail.com)"
)
Dec 11 11:03:56 unknown iTunesU[3393] : [iTracer]: [SSAccountStore activeAccount]
Dec 11 11:03:56 unknown iTunesU[3393] : [iTracer]: [SSAccountStore _reloadAccountsIfNeeded]
Dec 11 11:03:56 unknown iTunesU[3393] : [iTracer]: [SSAccountStore activeAccount]
Dec 11 11:03:56 unknown iTunesU[3393] : [iTracer]: [SSAccountStore _reloadAccountsIfNeeded]
[注意]看雪招聘,专注安全领域的专业人才平台!