snakeninnysiMac:Code snakeninny$ /opt/theos/bin/nic.pl NIC 2.0 - New Instance Creator ------------------------------ [1.] iphone/application [2.] iphone/cydget [3.] iphone/framework [4.] iphone/library [5.] iphone/notification_center_widget [6.] iphone/preference_bundle [7.] iphone/sbsettingstoggle [8.] iphone/tool [9.] iphone/tweak [10.] iphone/xpc_service
snakeninnysiMac:iosreproject snakeninny$ ls -l total 40 -rw-r--r-- 1 snakeninny staff 184 Dec 3 09:05 Makefile -rw-r--r-- 1 snakeninny staff 1045 Dec 3 09:05 Tweak.xm -rw-r--r-- 1 snakeninny staff 223 Dec 3 09:05 control -rw-r--r-- 1 snakeninny staff 57 Dec 3 09:05 iOSREProject.plist lrwxr-xr-x 1 snakeninny staff 11 Dec 3 09:05 theos -> /opt/theos
include theos/makefiles/common.mk
TWEAK_NAME = iOSREProject
iOSREProject_FILES = Tweak.xm
include $(THEOS_MAKE_PATH)/tweak.mk
after-install::
install.exec "killall -9 SpringBoard"
下面来逐行解读。
include theos/makefiles/common.mk
固定写法，不要更改。
TWEAK_NAME = iOSREProject
tweak的名字，即用Theos创建工程时指定的“Project Name”，跟control文件中的“Name”字段对应，不要更改。
iOSREProject_FILES = Tweak.xm
tweak包含的源文件（不包括头文件），多个文件间以空格分隔，如：
iOSREProject_FILES = Tweak.xm Hook.xm New.x ObjC.m ObjC++.mm
可以按需更改。
include $(THEOS_MAKE_PATH)/tweak.mk
ARCHS = armv7 arm64
TARGET = iphone:latest:7.0
include theos/makefiles/common.mk
TWEAK_NAME = iOSREProject
iOSREProject_FILES = Tweak.xm
iOSREProject_PRIVATE_FRAMEWORK = BaseBoard
include $(THEOS_MAKE_PATH)/tweak.mk
after-install::
install.exec "killall -9 SpringBoard"
“-lx This option tells the linker to search for libx.dylib or libx.a in the library search path. If string x is of the form y.o, then that file is searched for in the same places, but without prepending `lib’ or appending `.a’ or `.dylib’ to the filename.”
大致意思是说，-lx代表链接libx.a或libx.dylib，即给“x”加上“lib”的前缀，以及“.a”或“.dylib”的后缀；如果x是“y.o”的形式，则直接链接y.o，不加任何前缀或后缀。由图3-3可知，iOS支持链接的Mach-O对象全是以“libx.dylib”和“y.o”形式命名的，完全兼容GNU Linker。
/* How to Hook with Logos Hooks are written with syntax similar to that of an Objective-C @implementation. You don't need to #include, it will be done automatically, as will the generation of a class list and an automatic constructor. %hook ClassName // Hooking a class method + (id)sharedInstance { return %orig; } // Hooking an instance method with an argument. - (void)messageName:(int)argument { %log; // Write a message about this call, including its class, name and arguments, to the system log. %orig; // Call through to the original function with its original arguments. %orig(nil); // Call through to the original function with a custom argument. // If you use %orig(), you MUST supply all arguments (except for self and _cmd, the automatically generated ones.) } // Hooking an instance method with no arguments. - (id)noArguments { %log; id awesome = %orig; [awesome doSomethingElse]; return awesome; } // Always make sure you clean up after yourself; Not doing so could have grave consequences! %end */
%hook
指定需要hook的class，必须以%end结尾，如下：
%hook SpringBoard
- (void)_menuButtonDown:(id)down
{
NSLog(@"You've pressed home button.");
%orig; // call the original _menuButtonDown:
}
%end
这段代码的意思是钩住（hook）SpringBoard类里的_menuButtonDown:函数，先将一句话写入syslog，再执行函数的原始操作。
%log
该指令在%hook内部使用，将函数的类名、参数等信息写入syslog，可以以%log([(), ...])的格式追加其他打印信息，如下：
%hook SpringBoard
- (void)_menuButtonDown:(id)down
{
%log((NSString *)@"iOSRE", (NSString *)@"Debug");
%orig; // call the original _menuButtonDown:
}
%end
打印结果如下：
Dec 3 10:57:44 FunMaker-5 SpringBoard[786]: -[ _menuBu-ttonDown:+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Timestamp: 75607608282
Total Latency: 20266 us
SenderID: 0x0000000100000190
BuiltIn: 1
AttributeDataLength: 16
AttributeData: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ValueType: Absolute
EventType: Keyboard
UsagePage: 12
Usage: 64
Down: 1
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
]: iOSRE, Debug
%orig
该指令在%hook内部使用，执行被钩住（hook）的函数的原始代码，如下：
%hook SpringBoard
- (void)_menuButtonDown:(id)down
{
NSLog(@"You've pressed home button.");
%orig; // call the original _menuButtonDown:
}
%end
如果去掉%orig，那么原始函数不会得到执行，例如：
%hook SpringBoard
- (void)_menuButtonDown:(id)down
{
NSLog(@"You've pressed home button but it's not functioning.");
}
%end
还可以利用%orig更改原始函数的参数，例如：
%hook SBLockScreenDateViewController
- (void)setCustomSubtitleText:(id)arg1 withColor:(id)arg2
{
%orig(@"iOS 8 App Reverse Engineering", arg2);
}
%end
%group iOS7Hook
%hook iOS7Class
- (id)iOS7Method
{
id result = %orig;
NSLog(@"This class & method only exist in iOS 7.");
return result;
}
%end
%end // iOS7Hook
%group iOS8Hook
%hook iOS8Class
- (id)iOS8Method
{
id result = %orig;
NSLog(@"This class & method only exist in iOS 8.");
return result;
}
%end
%end // iOS8Hook
%hook SpringBoard
-(void)powerDown
{
%orig;
}
%end
这段代码的意思是在%group iOS7Hook中钩住iOS7Class的iOS7Method，在%group iOS8Hook中钩住iOS8Class的iOS8Method函数，然后在%group _ungrouped中钩住SpringBoard类的powerDown函数。
需要注意的是，%group必须配合下面的%init使用才能生效。
%init
该指令用于初始化某个%group，必须在%hook或%ctor内调用；如果带参数，则初始化指定的group，如果不带参数，则初始化_ungrouped，如下：
#ifndef kCFCoreFoundationVersionNumber_iOS_8_0
#define kCFCoreFoundationVersionNumber_iOS_8_0 1140.10
#endif
%hook SpringBoard
- (void)applicationDidFinishLaunching:(id)application
{
%orig;
%init; // Equals to %init(_ungrouped)
if (kCFCoreFoundationVersionNumber >= kCFCoreFoundationVersionNumber_iOS_7_0 && kCFCoreFoundationVersionNumber < kCFCoreFoundationVersionNumber_iOS_8_0) %init(iOS7Hook);
if (kCFCoreFoundationVersionNumber >= kCFCoreFoundationVersionNumber_iOS_8_0) init(iOS8Hook);
}
%end
只有调用了%init，对应的%group才能起作用，切记切记！
%ctor
tweak的constructor，完成初始化工作；如果不显式定义，Theos会自动生成一个%ctor，并在其中调用%init(_ungrouped)。因此，
%hook SpringBoard
- (void)reboot
{
NSLog(@"If rebooting doesn't work then I'm screwed.");
%orig;
}
%end
可以成功生效，因为Theos隐式定义了如下内容：
%ctor
{
%init(_ungrouped);
}
而
%hook SpringBoard
- (void)reboot
{
NSLog(@"If rebooting doesn't work then I'm screwed.");
%orig;
}
%end
%ctor
{
// Need to call %init explicitly!
}
里的%hook无法生效，因为这里显式定义了%ctor，却没有显式调用%init，%group(_ungrouped)不起作用。%ctor一般可以用来初始化%group，以及进行MSHookFunction等操作，如下：
#ifndef kCFCoreFoundationVersionNumber_iOS_8_0
#define kCFCoreFoundationVersionNumber_iOS_8_0 1140.10
#endif
%ctor
{
%init;
if (kCFCoreFoundationVersionNumber >= kCFCoreFoundationVersionNumber_iOS_7_0 && kCFCoreFoundationVersionNumber < kCFCoreFoundationVersionNumber_iOS_8_0) %init(iOS7Hook);
if (kCFCoreFoundationVersionNumber >= kCFCoreFoundationVersionNumber_iOS_8_0) %init(iOS8Hook);
MSHookFunction((void *)&AudioServicesPlaySystemSound,
(void *)&replaced_AudioServicesPlaySystemSound,
(void **)&original_AudioServicesPlaySystemSound);
}
注意，%ctor不需要以%end结尾。
%new
在%hook内部使用，给一个现有class添加新函数，功能与class_addMethod相同。它的用法如下：
%hook SpringBoard
%new
- (void)namespaceNewMethod
{
NSLog(@"We've added a new method to SpringBoard.");
}
%end
@interface SpringBoard (iOSRE)
- (void)namespaceNewMethod;
@end
@implementation SpringBoard (iOSRE)
- (void)namespaceNewMethod
{
NSLog(@"We've added a new method to SpringBoard.");
}
@end
如果尝试编译上面的代码，会得到“error：cannot find interface declaration for ‘SpringBoard’”的报错信息，即编译器找不到SpringBoard类的定义。可以构造一个SpringBoard的定义，骗过编译器，如下：
@interface SpringBoard : NSObject
@end
@interface SpringBoard (iOSRE)
- (void)namespaceNewMethod;
@end
@implementation SpringBoard (iOSRE)
- (void)namespaceNewMethod
{
NSLog(@"We've added a new method to SpringBoard.");
}
@end
重新编译，仍然会报错，如下：
Undefined symbols for architecture armv7:
"_OBJC_CLASS_$_SpringBoard", referenced from:
l_OBJC_$_CATEGORY_SpringBoard_$_iOSRE in Tweak.xm.b1748661.o
ld: symbol(s) not found for architecture armv7
clang: error: linker command failed with exit code 1 (use -v to see invocation)
ld找不到“SpringBoard”的定义。一般来说，iOS程序员在碰到这个错误时的第一反应是：“是不是忘了导入哪个framework？”，但是转念一想，SpringBoard类是SpringBoard这个App里的一个类，而不是一个framework，要怎么导入？现在你是不是觉得%new非常可爱了呢？
%c
该指令的作用等同于objc_getClass或NSClassFromString，即动态获取一个类的定义，在%hook或%ctor内使用。
Logos的预处理指令还有%subclass和%config，但笔者到现在也没有用过，感兴趣的读者可以移步http://iphonedevwiki.net/index.php/Logos一探究竟，也可以来http://bbs.iosre.com跟大家一起讨论。
（3）control
control文件记录了deb包管理系统所需的基本信息，会被打包进deb包里。iOSREProject里control文件的内容如下：
Package: com.iosre.iosreproject
Name: iOSREProject
Depends: mobilesubstrate
Version: 0.0.1
Architecture: iphoneos-arm
Description: An awesome MobileSubstrate tweak!
Maintainer: snakeninny
Author: snakeninny
Section: Tweaks
Package: com.iosre.iosreproject Name: iOSREProject Depends: mobilesubstrate Architecture: iphoneos-arm Description: An awesome MobileSubstrate tweak! Maintainer: snakeninny Author: snakeninny Section: Tweaks Version: 0.0.1-1 Installed-Size: 104
snakeninnysiMac:iosreproject snakeninny$ make Making all for tweak iOSREProject... Preprocessing Tweak.xm... Compiling Tweak.xm... Linking tweak iOSREProject... Stripping iOSREProject... Signing iOSREProject... 从输出的信息看，Theos完成了预处理、编译、签名等一系列动作，此时会发现当前目录下多了一个新的“obj”文件夹，如下： snakeninnysiMac:iosreproject snakeninny$ ls -l total 32 -rw-r--r-- 1 snakeninny staff 262 Dec 3 09:20 Makefile -rw-r--r-- 1 snakeninny staff 0 Dec 3 11:28 Tweak.xm -rw-r--r-- 1 snakeninny staff 223 Dec 3 09:05 control -rw-r--r--@ 1 snakeninny staff 175 Dec 3 09:48 iOSREProject.plist drwxr-xr-x 5 snakeninny staff 170 Dec 3 11:28 obj lrwxr-xr-x 1 snakeninny staff 11 Dec 3 09:05 theos -> /opt/theos 里面有一个.dylib文件，如下： snakeninnysiMac:iosreproject snakeninny$ ls -l ./obj total 272 -rw-r--r-- 1 snakeninny staff 33192 Dec 3 11:28 Tweak.xm.b1748661.o -rwxr-xr-x 1 snakeninny staff 98784 Dec 3 11:28 iOSREProject.dylib 它就是tweak的核心。 （2）打包 打包使用的“make package”命令来自于Theos本身，其实就是先执行“make”命令，然后再执行“dpkg-deb”命令，如下： snakeninnysiMac:iosreproject snakeninny$ make package Making all for tweak iOSREProject... Preprocessing Tweak.xm... Compiling Tweak.xm... Linking tweak iOSREProject... Stripping iOSREProject... Signing iOSREProject... Making stage for tweak iOSREProject... dm.pl: building package `com.iosre.iosreproject' in `./com.iosre.iosreproject_0.0.1-7_iphoneos-arm.deb'. 上面生成了一个名为“com.iosre.iosreproject_0.0.1-7_iphoneos-arm.deb”的文件，这就是可以最终发布的安装包。 “make package”命令还有一个很重要的功能。在执行完“make package”之后，除了“obj”文件夹外，你会发现tweak工程目录下还生成了一个 “_”文件夹，如下： snakeninnysiMac:iosreproject snakeninny$ ls -l total 40 -rw-r--r-- 1 snakeninny staff 262 Dec 3 09:20 Makefile -rw-r--r-- 1 snakeninny staff 0 Dec 3 11:28 Tweak.xm drwxr-xr-x 4 snakeninny staff 136 Dec 3 11:35 _ -rw-r--r-- 1 snakeninny staff 2396 Dec 3 11:35 com.iosre.iosreproject_0.0.1-7 _iphoneos-arm.deb -rw-r--r-- 1 snakeninny staff 223 Dec 3 09:05 control -rw-r--r--@ 1 snakeninny staff 175 Dec 3 09:48 iOSREProject.plist drwxr-xr-x 5 snakeninny staff 170 Dec 3 11:35 obj lrwxr-xr-x 1 snakeninny staff 11 Dec 3 09:05 theos -> /opt/theos 这个文件夹是干什么的？打开它，可以看到2个文件夹，分别是“DEBIAN”和“Library”： snakeninnysiMac:iosreproject snakeninny$ ls -l _ total 0 drwxr-xr-x 3 snakeninny staff 102 Dec 3 11:35 DEBIAN drwxr-xr-x 3 snakeninny staff 102 Dec 3 11:35 Library 其中“DEBIAN”里只有tweak工程里的control文件，Theos在编译过程中向control文件里稍稍增加了几个字段而已，如下： snakeninnysiMac:iosreproject snakeninny$ ls -l _/DEBIAN total 8 -rw-r--r-- 1 snakeninny staff 245 Dec 3 11:35 control
snakeninnysiMac:iosreproject snakeninny$ dpkg -c com.iosre.iosreproject_0.0.1-7_iphoneos-arm.deb drwxr-xr-x snakeninny/staff 0 2014-12-03 11:35 ./ drwxr-xr-x snakeninny/staff 0 2014-12-03 11:35 ./Library/ drwxr-xr-x snakeninny/staff 0 2014-12-03 11:35 ./Library/MobileSubstrate/ drwxr-xr-x snakeninny/staff 0 2014-12-03 11:35 ./Library/MobileSubstrate/DynamicLibraries/ -rwxr-xr-x snakeninny/staff 98784 2014-12-03 11:35 ./Library/MobileSubstrate/DynamicLibraries/iOSREProject.dylib -rw-r--r-- snakeninny/staff 175 2014-12-03 11:35 ./Library/MobileSubstrate/DynamicLibraries/iOSREProject.plist
snakeninnysiMac:iosreproject snakeninny$ make clean rm -rf ./obj rm -rf "/Users/snakeninny/Code/iosreproject/_" snakeninnysiMac:iosreproject snakeninny$ rm *.deb snakeninnysiMac:iosreproject snakeninny$ ls -l total 32 -rw-r--r-- 1 snakeninny staff 262 Dec 3 09:20 Makefile -rw-r--r-- 1 snakeninny staff 0 Dec 3 11:28 Tweak.xm -rw-r--r-- 1 snakeninny staff 223 Dec 3 09:05 control -rw-r--r--@ 1 snakeninny staff 175 Dec 3 09:48 iOSREProject.plist lrwxr-xr-x 1 snakeninny staff 11 Dec 3 09:05 theos -> /opt/theos 然后生成一个空的“layout”目录，如下： snakeninnysiMac:iosreproject snakeninny$ mkdir layout 并在“layout”下随便放一些空文件，如下： snakeninnysiMac:iosreproject snakeninny$ touch ./layout/1.test snakeninnysiMac:iosreproject snakeninny$ mkdir ./layout/Developer snakeninnysiMac:iosreproject snakeninny$ touch ./layout/Developer/2.test snakeninnysiMac:iosreproject snakeninny$ mkdir -p ./layout/var/mobile/Library/Preferences snakeninnysiMac:iosreproject snakeninny$ touch ./layout/var/mobile/Library/Preferences/3.test
THEOS_DEVICE_IP = iOSIP ARCHS = armv7 arm64 TARGET = iphone:latest:8.0 然后调用“make package install”命令完成编译打包安装一条龙服务，如下： snakeninnysiMac:iosreproject snakeninny$ make package install Making all for tweak iOSREProject... Preprocessing Tweak.xm... Compiling Tweak.xm... Linking tweak iOSREProject... Stripping iOSREProject... Signing iOSREProject... Making stage for tweak iOSREProject... dm.pl: building package `com.iosre.iosreproject:iphoneos-arm' in `./com.iosre.iosreproject_0.0.1-15_iphoneos-arm.deb' install.exec "cat > /tmp/_theos_install.deb; dpkg -i /tmp/_theos_install.deb && rm /tmp/_theos_install.deb" < "./com.iosre.iosreproject_0.0.1-15_iphoneos-arm.deb" root@iOSIP's password: Selecting previously deselected package com.iosre.iosreproject. (Reading database ... 2864 files and directories currently installed.) Unpacking com.iosre.iosreproject (from /tmp/_theos_install.deb) ... Setting up com.iosre.iosreproject (0.0.1-15) ... install.exec "killall -9 SpringBoard" root@iOSIP's password:
从以上信息可以看到，Theos在整个安装过程中要求我们输入两次root密码。虽然多次输入密码给人很安全的感觉，但实在是太麻烦了。好在通过设置iOS的authorized_keys可以省略SSH输密码的步骤，让“make package install”真正地从“一只多脚虫”变成“一条飞天龙”，具体步骤如下：
1）删除“/Users/snakeninny/.ssh/known_hosts”中iOSIP对应的条目。 假设iOS的IP地址是iOSIP。编辑“/Users/snakeninny/.ssh/known_hosts”，找到iOSIP所在的那一行，如下： iOSIP ssh-rsa hXFscxBCVXgqXhwm4PUoUVBFWRrNeG6gVI3Ewm4dqwusoRcyCxZtm5bRiv4bXfkPjsRkWVVfrW3uT52Hhx4RqIuCOxtWE7tZqc1vVap4HIzUu3mwBuxog7WiFbsbbaJY4AagNZmX83Wmvf8li5aYMsuKeNagdJHzJNtjM3vtuskK4jKzBkNuj0M89TrV4iEmKtI4VEoEmHMYzWwMzExXbyX5NyEg5CRFmA46XeYCbcaY0L90GExXsWMMLA27tA1Vt1ndHrKNxZttgAw31J90UDnOGlMbWW4M7FEqRWQsWXxfGPk0W7AlA54vaDXllI5CD5nLAu4VkRjPIUBrdH5O1fqQ3qGkPayhsym3g0VZeYgU4JAMeFc3 完整删掉这一行。 2）生成authorized_keys。 在Terminal中执行如下命令： snakeninnysiMac:~ snakeninny$ ssh-keygen -t rsa Generating public/private rsa key pair. Enter file in which to save the key (/Users/snakeninny/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /Users/snakeninny/.ssh/id_rsa. Your public key has been saved in /Users/snakeninny/.ssh/id_rsa.pub. …… snakeninnysiMac:~ snakeninny$ cp /Users/snakeninny/.ssh/id_rsa.pub ~/authorized_keys 就会在用户目录下生成authorized_keys。 3）配置iOS。 在Terminal中执行如下命令： FunMaker-5:~ root# ssh-keygen Generating public/private rsa key pair. Enter file in which to save the key (/var/root/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /var/root/.ssh/id_rsa. Your public key has been saved in /var/root/.ssh/id_rsa.pub. …… FunMaker-5:~ root# logout Connection to iOSIP closed. snakeninnysiMac:iosreproject snakeninny$ scp ~/authorized_keys root@iOSIP:/var/root/.ssh The authenticity of host 'iOSIP (iOSIP)' can't be established. RSA key fingerprint is 75:98:9a:05:a3:27:2d:23:08:d3:ee:f4:d1:28:ba:1a. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'iOSIP' (RSA) to the list of known hosts. root@iOSIP's password: authorized_keys 100% 408 0.4KB/s 00:00
