资讯专栏INFORMATION COLUMN

上云采购季！| 2核2G4M爆款云服务器低至59元/年，更有多台、长期优惠，快来选购！

立即前往
首页/文章专栏/cycript的常用命令( Powerful private methods)

cycript的常用命令( Powerful private methods)

Hegel_Gu / 1958人阅读

摘要：二次打包动态库的注入二次打包动态库的注入，是通过修改可执行文件的来实现的在中增加一个写入路径这样程序执行的时候就会编译这个找到要注入的加载动态库的常用命令格式化根据地址获取对象。

前言

Cycript 是一个能够理解Objective-C语法的javascript解释器， 它能够挂钩正在运行的进程， 以在运行时修改很多东西, 一般我们用于动态调试应用, 一般来说如果要调试的代码是用OC编写的,用cycript调试会很方便, 如果是用C编写的,通过lldb来调试了.

安装Cycript

官网地址：
Github地址：

@import Substrate, so we can use MS.hookFunction

cy# @import com.saurik.substrate.MS

iPhone:/usr/lib/cycript0.9/com/saurik/substrate root# ls -lrt
total 4
-rw-r--r-- 1 root staff 1968 Jan 11  2016 MS.cy

刚开始分析逆向的时候，常常利用它进行控制器class的定位，完成类似功能的工具有AFlexLoader

注入方式

cycript注入

cycript注入动态库的方式,这必须要在越狱环境下才能实现。

cycript的原理是动态库注入,但是其动态库注入的原理,与我们常见的通过LC_LOAD_DYLIB在可执行文件中注入动态库不同. cycript的操作是 : 抓取到要挂载的应用, 由于越狱机上拥有权限,所以直接在挂载的进程上创建一个挂起的线程, 然后在这个线程里申请一片用于加载动态库的内存,然后恢复线程,动态库就被注入。

二次打包动态库的注入

二次打包动态库的注入，是通过修改可执行文件的Load Commands来实现的. 在Load Commands中增加一个LC_LOAD_DYLIB , 写入dylib路径,这样程序执行的时候, 就会编译这个 LC_LOAD_DYLIB 找到要注入的 dylib,加载动态库 .

Powerful private methods

_ivarDescription

_shortMethodDescription

nextResponder

_autolayoutTrace

recursiveDescription

_methodDescription

cycript的常用命令

格式化

.toString()

根据地址获取对象。

#address

cy# [#0x1031f9b0]
[#">"]

bundleIdentifier

 [[NSBundle mainBundle] bundleIdentifier]

可执行文件

[[NSFileManager defaultManager] URLsForDirectory:NSDocumentDirectory inDomains:NSUserDomainMask][0]

先查找进程名称

iPhone:~ root# ps -e |grep  /var/mobile*

Inject Into Processes

iPhone:~ root# cycript -p Moon

Objective-C Messages

cy# [UIApp description]
@""
cy# [#0x4870560 _ivarDescription].toString()
`:
in DFApplication:
in UIApplication:
	_delegate (*):

JavaScript Extensions

cy# [for (x of [1,2,3]) x+1]
[2,3,4]

Bridged Object Model

cy# choose(CALayer) instanceof Array
true

Foreign Function Calls

cy# var a = malloc(128)
(typedef void*)(0x8b00b90)

Magical Tab-Complete

cy# a = ({m: 4, b: 5})
{m:4,b:5}
cy# a["m"]
4

C++11 Lambda Syntax

cy#  [&](int a)->int{return a}
(extern "C" int 80904192(int))
打印出当前界面的view层级 
cy# UIApp.keyWindow.recursiveDescription().toString()
`; layer = >
   | >
   |    | >
   |    |    | >
   |    |    |    | ; layer = >
   |    |    |    |    | >
   |    |    |    |    |    | >
   |    |    |    |    |    |    | >
   |    |    |    |    |    |    |    | >
   |    |    |    |    |    |    |    |    | >
   |    |    |    |    |    |    |    |    |    | >
   |    |    |    |    |    |    |    |    |    |    | >
   |    |    |    |    |    |    |    |    |    |    | >
   |    |    |    |    |    |    |    |    |    |    |    | >
   |    |    |    |    |    |    |    |    |    |    |    | 
通过view的nextResponder方法，可以找出它所属的视图控制器ViewController

cy# [#0x181009f0 nextResponder]
#""


接下来就可以对MoonWXParentViewController 进行hook分析

Powerful private methods for debugging in Cycript & LLDB

_shortMethodDescription 用于LLDB 进行打断点

_printHierarchy

Shortcut to find the ViewController’s class name on the keyWindow


快捷的获取 ViewController 的方法。


cy# [[[UIWindow keyWindow] rootViewController] _printHierarchy].toString()
`, state: appeared, view: 
   | , state: disappeared, view:  not in the window
   |    | , state: disappeared, view:  not in the window
   |    |    | , state: disappeared, view:  not in the window
   |    | , state: disappeared, view:  not in the window
   |    | , state: disappeared, view:  not in the window
   |    | , state: disappeared, view:  not in the window
   | , state: disappeared, view:  not in the window
   | , state: disappeared, view:  not in the window
   | , state: appeared, view: `



支持iOS8之后

_ivarDescription

Prints all names and values of instance variables of a specified object


比一个一个打印属性方便多了


cy# [#0x5822600 _ivarDescription].toString()



cy# [#0x5822600 _ivarDescription].toString()
`:
in H5WebViewController:
	_fontScale (NSString*): @"100%"<__NSCFConstantString: 0x338132c>
	_is3DTouchPeek (BOOL): 0
	_is3DTouchPop (BOOL): 0
	_gestureBack (BOOL): 0
	_isFromNavigationBarHidden (BOOL): 0
	_webPageLoadSuccess (BOOL): 1
	_isBackProcessing (BOOL): 0
	_isBackProcessed (BOOL): 0
	_hideLeftButtonsByJs (BOOL): 0
	_isDefaultOptionMenu (BOOL): 0
	_isWebViewBackgroundColorSetted (BOOL): 1
	_pullRefreshing (BOOL): 1
	_isFromStatusBarHidden (BOOL): 0
	_isInitAsSubView (BOOL): 0
	_isDissmissProcess (BOOL): 0
	_isAphaOverLimit (BOOL): 0
	_isWebLoading (BOOL): 0
	_isWebFinishLoad (BOOL): 1
	_isViewAppeared (BOOL): 1
	_isViewAppearAgain (BOOL): 0
	_isViewWillDisAppear (BOOL): 0
	_isViewDidDisAppear (BOOL): 0
	_isAlipaySchemeWillRedirect (BOOL): 0
	_isAlipaySchemeDidRedirect (BOOL): 0
	_isAddObserver (BOOL): 0
	_isFromStartApp (BOOL): 0
	name (NSString*): nil
	_serviceDelegate (*): nil
	_contentView (PSDView*): nil
	_delegate (*): 
	_statesView (UIView*): 
	_customPreviewActionItems (NSArray*): nil
	_interceptUrl (NSString*): nil
	_appConfig (NSDictionary*): nil
	_url (NSURL*): https://render.alipay.com/p/f/fd-j6lzqrgm/addressbook.html
	_lastPageId (NSString*): nil
	_refreshHeaderView (AUPullLoadingView*): nil
	_stickyBouncer (H5StickyBouncer*): nil
	_backDate (NSDate*): nil
	_backBtnPressCount (int): 0
	_serverErrorView (APExceptionView*): nil
	_fontBar (H5AdjustFontControl*): nil
	_statusBarStyle (int): 0
	_htmlZoomValue (NSString*): @"1"<__NSCFString: 0x11130b50>
	_lastMainRequest (NSURLRequest*): 
	_failureNumber (int): 0
	_webviewDomainLabel (UILabel*): 
	_delayExecList (NSMutableArray*): <__NSArrayM: 0x110794a0>
	_paddingBottom (float): 0
	_externNativeApiManager (H5ExternNativeApiManager*): 
	_startLoadTime (NSDate*): <__NSDate: 0x11102510>
	_co


cy# [#0x5822600 url]
#"https://render.alipay.com/p/f/fd-j6lzqrgm/addressbook.html"

_autolayoutTrace

展示的架构是基于layout


cy# [[UIApp keyWindow] _autolayoutTrace].toString()
`
UIWindow:0x46c54d0
|   UILayoutContainerView:0x8c1aa10
|   |   UINavigationTransitionView:0x8757090
|   |   |   UIViewControllerWrapperView:0xb68c2d0
|   |   |   |   DTBaseView:0xd8e9180
|   |   |   |   |   H5WebView:0x46ba350
|   |   |   |   |   |   UILabel:0xfb63630"u7f51u9875u7531 render.alipay.com u63d0u4f9b"
|   |   |   |   |   |   _UIWebViewScrollView:0xfaaacf0
|   |   |   |   |   |   |   UIWebBrowserView:0x5984a00
|   |   |   |   |   |   |   UIImageView:0xfaa4850
|   |   |   |   |   |   |   UIImageView:0xfaaa940
|   |   |   |   |   UIView:0xd9fa5d0
|   |   |   |   |   NBProgressView:0x1108ae60
|   |   |   |   |   |   UIView:0x1108c790
|   |   APNavigationBar:0x8734d50
|   |   |   _UINavigationBarBackground:0x8735800
|   |   |   |   _UIBackdropView:0x11106fd0
|   |   |   |   |   _UIBackdropEffectView:0x111018d0
|   |   |   |   |   UIView:0x11111bb0
|   |   |   |   UIImageView:0x8735c20
|   |   |   H5NavigationTitleView:0x1114f680
|   |   |   |   UIControl_mainTitleConten...:0xfbf7f70
|   |   |   |   |   UILabel:0x11100e30"u901au8bafu5f55u670bu53cb"
|   |   |   |   UIControl_subtitleContent...:0xfbf7a90
|   |   |   |   |   UILabel:0xb6f4050
|   |   |   |   UIControl_rightIconConten...:0xb681ca0
|   |   |   |   |   UIImageView:0xfbfa810
|   |   |   UIView:0x46a0090
|   |   |   AUBarButtonItemButton_bac...:0x11146fb0
|   |   |   |   UIImageView:0x1112ffe0
|   |   |   |   UILabel:0xfb8a8c0"u8fd4u56de"
|   |   |   _UINavigationBarBackIndicatorView:0x8c0a660`

查看安装的app进程

iPhone:~ root# ps -e |grep  /var/mobile*
  333 ??         0:13.39 /var/mobile/Containers/Bundle/Application/DB9E7889-BC60-4B5C-91BD-E59D08204958/WeChat.app/WeChat
  552 ??         0:34.13 /var/mobile/Containers/Bundle/Application/239A0B7E-AA8C-4E43-873D-16254934321A/Taobao4iPhone.app/Taobao4iPhone
  635 ??         5:42.15 /var/mobile/Containers/Bundle/Application/3FDB82B6-8D3A-47BF-A27C-184D1E052854/AlipayWallet.app/AlipayWallet
  923 ??         0:01.37 /var/mobile/Containers/Bundle/Application/3A5795F5-1E2B-42B6-A904-D7BF2178D5EB/KillOneMosquito.app/KillOneMosquito
  928 ttys000    0:00.01 grep /var/mobile

cycript @import

MS


/usr/lib/cycript0.9/com


MS.cy 位于/usr/lib/cycript0.9/com/saurik/substrate 因此可以使用`cy# @import com.saurik.substrate.MS
`进行导入。


如果要导入Cycript utils的时候，用法：


Install to utils.cy to /usr/lib/cycript0.9/com/tyilo:

mkdir -p /usr/lib/cycript0.9/com
git clone https://github.com/Tyilo/cycript-utils.git /usr/lib/cycript0.9/com/tyilo
Then in cycript:

cy# @import com.tyilo.utils; 0


此时可以借助apt  进行安装git


iPhone:~ root# apt-get install git
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following extra packages will be installed:
  curl expat
The following NEW packages will be installed:
  curl expat git
0 upgraded, 3 newly installed, 0 to remove and 16 not upgraded.
Need to get 3065kB of archives.
After this operation, 21.1MB of additional disk space will be used.
Do you want to continue [Y/n]? y
WARNING: The following packages cannot be authenticated!
  curl expat git
Install these packages without verification [y/N]? y
Get:1 http://apt.saurik.com ios/1141.14/main curl 7.33.0-9 [276kB]
Get:2 http://apt.saurik.com ios/1141.14/main expat 2.0.1-3 [69.3kB]
Get:3 http://apt.saurik.com ios/1141.14/main git 2.8.1-5 [2720kB]
Fetched 3065kB in 25s (120kB/s)                                                                                                                                           
Selecting previously unselected package curl.
(Reading database ... 1926 files and directories currently installed.)
Preparing to unpack .../curl_7.33.0-9_iphoneos-arm.deb ...
Unpacking curl (7.33.0-9) ...
Selecting previously unselected package expat.
Preparing to unpack .../expat_2.0.1-3_iphoneos-arm.deb ...
Unpacking expat (2.0.1-3) ...
Selecting previously unselected package git.
Preparing to unpack .../git_2.8.1-5_iphoneos-arm.deb ...
Unpacking git (2.8.1-5) ...
Setting up curl (7.33.0-9) ...
Setting up expat (2.0.1-3) ...
Setting up git (2.8.1-5) ...


apt-get 第一次通过Lydia下载“APT0.6 Transitional" 之后可以先update


iPhone:~ root#  git -c http.sslVerify=false clone https://github.com/zhangkn/cycript-utils.git /usr/lib/cycript0.9/com/tyilo
Cloning into "/usr/lib/cycript0.9/com/tyilo"...
remote: Counting objects: 46, done.
remote: Total 46 (delta 0), reused 0 (delta 0), pack-reused 46
Unpacking objects: 100% (46/46), done.
Checking connectivity... done.


choose : a = choose(MyClass) 当前堆栈中查找到特定类的对象数据  Effortless Exploration

返回值是一个 数组，表示在当前堆栈中查找到的所有MyClass类的对象数据。


Effortless Exploration


cy# a = choose(UILabel).toString()
">,; layer = <_UILabelLayer: 0x10321d30>>,>,>,>,>,>,>,>,>,>,>,
hook OC函数

MS.HookMessage : 这个函数的实现是调用MSHookMessageEx ,用法如下 ：

osx cycript image not found

devzkndeMacBook-Pro:lib devzkn$ /Users/devzkn/Downloads/cycript_0.9.594/cycript 
dyld: Library not loaded: /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/libruby.2.0.0.dylib
  Referenced from: /Users/devzkn/Downloads/cycript_0.9.594/Cycript.lib/cycript-apl
  Reason: image not found
Abort trap: 6



关掉sip创建个符号链接即可


devzkndeMacBook-Pro:.ssh devzkn$ sudo mkdir -p /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/
Password:
mkdir: /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/: Operation not permitted


先关闭系统的SIP，然后运行如下命令，把原来引用的位置创建符号链接到现在新版本的位置:


sudo mkdir -p /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/
sudo ln -s /System/Library/Frameworks/Ruby.framework/Versions/2.3/usr/lib/libruby.2.3.0.dylib /System/Library/Frameworks/Ruby.framework/Versions/2.0/usr/lib/libruby.2.0.0.dylib



处理方法也很简单，直接把2.3的复制一份，改为2.0即可


/System/Library/Frameworks/Ruby.framework/Versions/Current/usr/lib
云服务器 GPU云服务器 常用的linux命令 linux常用的命令 linux的常用命令 hbase的常用命令

文章版权归作者所有，未经允许请勿转载,若此文章存在违规行为，您可以联系管理员删除。

转载请注明本文地址：https://www.ucloud.cn/yun/89324.html

相关文章

  • java面向对象的三大特征

    摘要：面向对象的三大特征封装继承多态。以本文为例，类中的变量为私有变量，只能通过创建对象此时构造方法自动调用来赋值。 java面向对象的三大特征：封装、继承、多态。 以本文为例，User类中的变量为私有变量，只能通过创建对象（此时构造方法自动调用）来赋值。外界只能通过公有方法api()来访问User类。 Admin类继承了User类，调用了其构造方法，还重写了method_1方法，增加了...

    susheng 评论0 收藏0

发表评论

登陆后可评论

0条评论

Hegel_Gu

男|高级讲师
我要私信

TA的文章

阅读更多
最新活动
阅读需要支付1元查看
<