头文件：
将iOS中的
/Library/Frameworks/CydiaSubstrate.framework/Headers/CydiaSubstrate.h
复制到编译环境目录
toolchain4/sys/usr/include
库文件：
将iOS中的
/Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate
复制到编译环境目录
toolchain4/sys/usr/lib目录下改名为libsubstrate.dylib
因为在iOS系统中
/usr/lib/libsubstrate.dylib是一个符号连接指向/Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate
写个测试程序：
/*
testsubstrate.c
used to log which files is opened by fopen in target process.
arm-apple-darwin9-gcc testsubstrate.c -dynamiclib -o testlib.dylib -lsubstrate -init _substrateInit
*/
#include <stdio.h>
#include <stdlib.h>
#include “CydiaSubstrate.h”
#define BUFSIZE 256
FILE *(*org_fopen)(const char *path, const char *mode);
FILE *hLog = NULL;
bool log_open(void)
{
if(hLog == NULL){
char pathBuffer[BUFSIZE];
snprintf(pathBuffer, sizeof(pathBuffer), “%s/Library/hooks-%li.log”, getenv(“HOME”), time(NULL));
hLog = fopen(pathBuffer, “wb+”);
}
return hLog != NULL;
}
void log_progress(const char *msg, …)
{
va_list varargs;
va_start(varargs, msg);
if(log_open()){
char msgbuf[0x1000];
vsnprintf(msgbuf, sizeof(msgbuf), msg, varargs);
fprintf(hLog, “%s”, msgbuf);
fflush(hLog);
fsync(fileno(hLog));
}
va_end(varargs);
}
FILE *my_fopen(const char *path, const char *mode)
{
FILE *fp;
log_progress(“fopen(%s, %s)”, path, mode);
fp = org_fopen(path, mode);
log_progress(“=%d\n”, fp);
return fp;
}
int substrateInit(void)
{
log_progress(“substrateInit\n”);
MSHookFunction(fopen, my_fopen, (void **)&org_fopen);
return 0;
}
编译命令：
arm-apple-darwin9-gcc testsubstrate.c -dynamiclib -o testlib.dylib -lsubstrate -init _substrateInit
这样就生成了动态库文件：testlib.dylib
按照substrate框架，为了对某个应用程序进行过滤，需要写个同名的plist文件：testlib.plist
<?xml version=”1.0″ encoding=”UTF-8″?>
<!DOCTYPE plist PUBLIC “-//Apple//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd”>
<plist version=”1.0″>
<dict>
<key>Filter</key>
<dict>
<key>Bundles</key>
<array>
<string>com.luckoo.tdbeta</string>
</array>
</dict>
</dict>
</plist>
然后将这两个文件复制到iOS设备的/Library/MobileSubstrate/DynamicLibraries目录下
重启目标程序：com.luckoo.tdbeta
然后在/private/var/mobile/Applications/39809BB6-96CE-4DE5-8701-44B3AB7738D2/Library目录下看到文件：hooks-1388226641.log
(因为sandbox机制，只能将log文件放在应用程序的目录下，尝试过写别的目录，程序会直接退出)
内容如下：
substrateInit
fopen(/private/var/mobile/Applications/39809BB6-96CE-4DE5-8701-44B3AB7738D2/tdbeta.app/Data/Managed/mscorlib.dll, rb)=19687164
fopen(/var/mobile/Applications/39809BB6-96CE-4DE5-8701-44B3AB7738D2/tdbeta.app/Data/Managed/mono/gac/policy.2.0.mscorlib/0.0.0.0__7cec85d7bea7798e/policy.2.0.mscorlib.dll, rb)=0
fopen(/var/mobile/Applications/39809BB6-96CE-4DE5-8701-44B3AB7738D2/tdbeta.app/Data/mainData, rb)=19687164
fopen(/var/mobile/Applications/39809BB6-96CE-4DE5-8701-44B3AB7738D2/tdbeta.app/Data/mainData, rb)=19687164
fopen(/var/mobile/Applications/39809BB6-96CE-4DE5-8701-44B3AB7738D2/Library/Caches/com.luckoo.tdbeta/com.apple.opengl/shaders.maps, r+)=19810092
fopen(/var/mobile/Applications/39809BB6-96CE-4DE5-8701-44B3AB7738D2/Library/Caches/com.luckoo.tdbeta/com.apple.opengl/shaders.data, r+)=19810956
fopen(/var/mobile/Applications/39809BB6-96CE-4DE5-8701-44B3AB7738D2/tdbeta.app/Data/Managed/UnityEngine.dll, rb)=19243932
fopen(/var/mobile/Applications/39809BB6-96CE-4DE5-8701-44B3AB7738D2/tdbeta.app/Data/Managed/Assembly-CSharp-firstpass.dll, rb)=19243932
fopen(/var/mobile/Applications/39809BB6-96CE-4DE5-8701-44B3AB7738D2/tdbeta.app/Data/Managed/Assembly-CSharp.dll, rb)=19243932
fopen(/var/mobile/Applications/39809BB6-96CE-4DE5-8701-44B3AB7738D2/tdbeta.app/Data/Managed/mono/gac/policy.2.0.System/0.0.0.0__7cec85d7bea7798e/policy.2.0.System.dll, rb)=0
…
substrate项目的源码位于：
http://gitweb.saurik.com/substrate.git
git clone git://git.saurik.com/substrate.git

[课程]Linux pwn 探索篇！