Hit a shell

作者: lifeLL | 来源:发表于2017-09-12 17:20 被阅读0次

Hit a shell
SO FAR AWAY FROM GO
hit
HIT
尚好的世间，尚好的我们
《你的名字》
e-pcr的使用
美剧记单词 0426 绝望的主妇 s07 e21
hit refresh
Knife Hit

//1.      ssh进入手机  ssh root@iphone id

//2.      找到目标app路径
Yuanlingde-iPhone:~ root# ps -e|grep Containers
  977 ??         0:33.20 /var/mobile/Containers/Bundle/Application/2BCF44DF-4B58-4074-85B4-1A6E75E5F4DA/WeChat.app/WeChat

//3.      用Cycript找出TargetApp的Documents目录路径
way1 ：
Yuanlingde-iPhone:~ root# cycript -p 1050
cy#
cy#
cy# NSHomeDirectory()
@"/var/mobile/Containers/Data/Application/311A8B61-191B-4468-9DDE-CFA00AAB2574”
然后自己拼接上 “/Documents/”
way 2 ：
cy# [[NSFileManager defaultManager] URLsForDirectory:NSDocumentDirectory inDomains:NSUserDominMask][0]
#"file:///var/mobile/Containers/Data/Application/311A8B61-191B-4468-9DDE-CFA00AAB2574/Documents/"

//4.     将dumpdecrypted.dylib拷贝到目标app路径的Documents目录下
lifedeMBP:~ life$ scp /Users/life/iOS/reverse/dumpdecrypted-master/dumpdecrypted.dylib root@192.168.2.204:/var/mobile/Containers/Data/Application/311A8B61-191B-4468-9DDE-CFA00AAB2574/Documents/
root@192.168.2.204's password:
dumpdecrypted.dylib                                        100%  193KB 192.9KB/s   00:00
lifedeMBP:~ life$

//5.     砸 cd进入docment目录
FunMaker-5:~ root# cd /var/mobile/Containers/Data/Application/D41C4343-63AA-4BFF-904B-2146128611EE/Documents/
DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Containers/Bundle/Application/2BCF44DF-4B58-4074-85B4-1A6E75E5F4DA/WeChat.app/WeChat

//6.     拷回MAC
lifedeMBP:~ life$ scp root@192.168.2.204:/var/mobile/Containers/Data/Application/311A8B61-191B-4468-9DDE-CFA00AAB2574/Documents/WeChat.decrypted /Users/life/iOS/reverse/wechat
root@192.168.2.204's password:
WeChat.decrypted                                           100%  116MB 506.2KB/s   03:55

//7.     class dump
lifedeMBP:~ life$ class-dump --arch armv7 -H /Users/life/iOS/reverse/dumpdecrypted-master/WeChat.decrypted -o /Users/life/iOS/reverse/heads.h
（不加-H选项就会打印在终端上）