ios objc 方法调用记录插件：itracer v1.1
如果你想逆向 某些app的调用流程 或者 系统app的一些功能的 私有 framework class api 调用流程， 可以试试此工具
只需要 配置需要挂接的 类名和app名， 就可以实时追踪 相关功能的 调用流程。 支持批量 hook n多个类名
更新内容：
1. 增强程序稳定性， 但是偶尔trace某些method的参数信息还是会挂（比以前好多了 = =）
2. 增加对ios 系统服务进程的支持， 不再依赖mobilesubstrate插件，采用直接注入方式进行hook
3. 可配置需要挂接的class， 配置文件以xml格式描述
4. mac 上 x86/x64 支持（x64上暂时还不稳定，所以mac上版本暂时先不透露了。）
5. 挂接过程中无需重启springboard， 更加方便
1.配置需要挂接的class
修改itrace.xml配置文件，增加需要hook的类名：
<?xml version="1.0" encoding="utf-8"?>
<itrace>
<class>
<SSDevice/>
<SSDownload/>
<SSDownloadManager/>
<SSDownloadQueue/>
<CPDistributedMessagingCenter/>
<CPDistributedNotificationCenter/>
<NSString args="0"/>
</class>
</itrace>
注： 尽量不要去hook， 频繁调用的class， 比如 UIView NSString， 否则会很卡，操作就不方便了。
注： 如果挂接某个class， 中途打印参数信息挂了， 可以在对应的类名后面 加上 args="0" 属性， 来禁止打印参数信息， 这样会稳定点。
如果要让所有类都不打印参数信息， 可以直接设置： <class args="0">
2.安装文件
将整个itracer目录下的所有文件用手机助手工具，上传到ios系统上的 /tmp 下面：
/tmp/itracer
/tmp/itrace.dylib
/tmp/itrace.xml
3. 进行trace
进入itracer所在目录： cd /tmp
修改执行权限： chmod 777 ./itracer
运行程序: ./itracer springboard (spingboard 为需要挂接的进程名， 支持简单的模糊匹配)
4. 查看 trace log， 注： log 的实际输出在： Xcode-Windows菜单-Organizer-Console 中：
Jan 21 11:12:58 unknown SpringBoard[5706] <Warning>: [itrace]: [3edc9d98]: [SSDownloadQueue downloads]
Jan 21 11:12:58 unknown SpringBoard[5706] <Warning>: [itrace]: [3edc9d98]: [SSDownloadManager downloads]
Jan 21 11:12:58 unknown SpringBoard[5706] <Warning>: [itrace]: [3edc9d98]: [SSDownloadManager _copyDownloads]
Jan 21 11:12:58 unknown SpringBoard[5706] <Warning>: [itrace]: [3edc9d98]: [SSDownloadQueue _sendDownloadStatusChangedAtIndex:]: 0
Jan 21 11:12:58 unknown SpringBoard[5706] <Warning>: [itrace]: [3edc9d98]: [SSDownloadQueue _messageObserversWithFunction:context:]: 0x334c5d51: 0x2fe89de0
Jan 21 11:12:58 unknown SpringBoard[5706] <Warning>: [itrace]: [3edc9d98]: [SSDownloadQueue downloads]
Jan 21 11:12:58 unknown SpringBoard[5706] <Warning>: [itrace]: [3edc9d98]: [SSDownloadManager downloads]
Jan 21 11:12:58 unknown SpringBoard[5706] <Warning>: [itrace]: [3edc9d98]: [SSDownloadManager _copyDownloads]
Jan 21 11:12:58 unknown SpringBoard[5706] <Warning>: [itrace]: [3edc9d98]: [SSDownload cachedApplicationIdentifier]
Jan 21 11:12:58 unknown SpringBoard[5706] <Warning>: [itrace]: [3edc9d98]: [SSDownload status]
Jan 21 11:12:58 unknown SpringBoard[5706] <Warning>: [itrace]: [3edc9d98]: [SSDownload cachedApplicationIdentifier]
Jan 21 11:12:58 unknown SpringBoard[5706] <Warning>: [itrace]: [3edc9d98]: [CPDistributedNotificationCenter postNotificationName:userInfo:]: SBApplicationNotificationStateChanged: {
SBApplicationStateDisplayIDKey = "com.apple.AppStore";
SBApplicationStateKey = 2;
SBApplicationStateProcessIDKey = 5868;
SBMostElevatedStateForProcessID = 2;
}
Jan 21 11:12:58 unknown SpringBoard[5706] <Warning>: [itrace]: [3edc9d98]: [CPDistributedNotificationCenter postNotificationName:userInfo:toBundleIdentifier:]: SBApplicationNotificationStateChanged: {
SBApplicationStateDisplayIDKey = "com.apple.AppStore";
SBApplicationStateKey = 2;
SBApplicationStateProcessIDKey = 5868;
SBMostElevatedStateForProcessID = 2;
}: null
Jan 21 11:12:59 unknown SpringBoard[5706] <Warning>: [itrace]: [105d7000]: [SSDownloadManager _handleMessage:fromServerConnection:]: 0xe6920b0: 0xe007040
Jan 21 11:12:59 unknown SpringBoard[5706] <Warning>: [itrace]: [105d7000]: [SSDownloadManager _handleDownloadStatesChanged:]: 0xe6920b0
Jan 21 11:12:59 unknown SpringBoard[5706] <Warning>: [itrace]: [105d7000]: [SSDownloadManager _copyDownloads]
Jan 21 11:12:59 unknown SpringBoard[5706] <Warning>: [itrace]: [105d7000]: [SSDownload persistentIdentifier]
Jan 21 11:12:59 unknown SpringBoard[5706] <Warning>: [itrace]: [105d7000]: [SSDownload _addCachedPropertyValues:]: {
I = SSDownloadPhaseDownloading;
}
Jan 21 11:12:59 unknown SpringBoard[5706] <Warning>: [itrace]: [105d7000]: [SSDownload _applyPhase:toStatus:]: SSDownloadPhaseDownloading: <SSDownloadStatus: 0xe6b8e80>
Jan 21 11:12:59 unknown SpringBoard[5706] <Warning>: [itrace]: [105d7000]: [SSDownloadQueue downloadManager:downloadStatesDidChange:]: <SSDownloadManager: 0x41ea60>: (
"<SSDownload: 0xe6bd970>: -4085275246093726486"
)
5. 下面是我trace mac上 迅雷的一些log：
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURL description]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURL baseURL]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURL _cfurl]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURL relativeString]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURL _cfurl]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURLRequest initWithURL:cachePolicy:timeoutInterval:]: http://liveupdate.mac.sandai.net/MacThunderLiveUpdate.xml: 1: 15.000000
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURLRequest description]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURLRequest URL]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURL description]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURL baseURL]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURL _cfurl]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURL relativeString]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURL _cfurl]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURLDownload initWithRequest:delegate:]: <NSURLRequest http://liveupdate.mac.sandai.net/MacThunderLiveUpdate.xml>: <LiveUpdate: 0x15b8c0>
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURLDownload init]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURLRequest _CFURLRequest]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURLDownload _setDelegate:]: <LiveUpdate: 0x15b8c0>
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURL path]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURL _cfurl]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [b03c9000]: [NSURLRequest _initWithCFURLRequest:]: 0x186eca0
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURLDownload setDestination:allowOverwrite:]: /Users/ruki/Library/Application Support/Thunder/MacThunderLiveUpdate.xml: 1
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [b03c9000]: [NSURLRequest _URLHasScheme:]: about
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURLRequest dealloc]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [b03c9000]: [NSURL scheme]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURL release]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [b03c9000]: [NSURL _cfurl]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [b03c9000]: [NSURLRequest dealloc]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURLDownload _downloadActive]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURLDownload _delegate]
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURLDownload sendDidStart:]: 0x185d0c0
Jan 21 10:41:10 ruki-3.local Thunder[23354] <Warning>: [itrace]: [ac7c3a28]: [NSURLDownload _downloadActive]
后记：
由于最近空闲时间少，这个工具暂时就先弄到这了， 后续有时间在加上 native funtion 的 支持和 参数配置功能。
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
