美文网首页
[iOS逆向]13、Cycript

[iOS逆向]13、Cycript

作者: 史记_d5da | 来源:发表于2022-01-18 22:35 被阅读0次

    1、Cycript的基本用法

    1.1、基本概念

    Cycript是由Cydia创始人Saurik推出的一款脚本语言,Cycript混合了OC、JavaScript语法的解释器,这意味着我们能够在一个命令中使用Oc或者JavaScript,甚至两者并用。它能够挂钩正在运行的进程,能够在运行时修改很多东西。

    1.2、Cycript 使用

    1、Cycript 安装
    下载Cycript这个可执行文件、放在 /opt/cycript_0.9.594 配置环境变量 export PATH=/opt/cycript_0.9.594:$PATH
    2、运行 MonkeyDevDemo ,编译完成后,查看 appFrameworks 中包含 libcycript.dylib 文件

    libcycript.dylib
    3、终端连接手机 cycript -r 192.168.3.9:6666 终端输入命令
    UIWindow.keyWindow
    (extern "C" id ":keyWindow"(id, SEL))
    

    [UIApplication sharedApplication]

    "<UIApplication: 0x113d1ca10>"
    

    UIApp

    "<UIApplication: 0x113d1ca10>"
    

    var keyWd = UIWindow.keyWindow()

    "<iConsoleWindow: 0x113e545e0; baseClass = UIWindow; frame = (0 0; 375 812); gestureRecognizers = <NSArray: 0x2835a4150>; layer = <UIWindowLayer: 0x283a51060>>"
    

    keyWd.rootViewController

    "<MMUINavigationController: 0x1150e0600>"
    

    keyWd.recursiveDescription().toString()

    `<iConsoleWindow: 0x160c0a680; baseClass = UIWindow; frame = (0 0; 375 812); gestureRecognizers = <NSArray: 0x283bb1680>; layer = <UIWindowLayer: 0x28340c9e0>>
       | <UILayoutContainerView: 0x15fe30040; frame = (0 0; 375 812); clipsToBounds = YES; autoresize = W+H; gestureRecognizers = <NSArray: 0x283bb1b30>; layer = <CALayer: 0x283432fe0>>
       |    | <UINavigationTransitionView: 0x15fd45230; frame = (0 0; 375 812); clipsToBounds = YES; autoresize = W+H; layer = <CALayer: 0x283434c80>>
       |    |    | <UIViewControllerWrapperView: 0x15fd6f210; frame = (0 0; 375 812); autoresize = W+H; layer = <CALayer: 0x2835e82e0>>
       |    |    |    | <UIView: 0x15fe328c0; frame = (0 0; 375 812); autoresize = W+H; layer = <CALayer: 0x28342e140>>
       |    |    |    |    | <UIView: 0x15fd1b960; frame = (0 44; 375 877); autoresize = W; layer = <CALayer: 0x28342ac80>>
       |    |    |    |    |    | <UIImageView: 0x15fd27600; frame = (0 -44; 375 812); opaque = NO; userInteractionEnabled = NO; layer = <CALayer: 0x28342b400>>
       |    |    |    |    | <UIView: 0x15fd0c510; frame = (0 693; 375 65); autoresize = W+TM; layer = <CALayer: 0x28342b760>>
       |    |    |    |    |    | <FixTitleColorButton: 0x15fe2ad30; baseClass = UIButton; frame = (20 15; 157.5 47); clipsToBounds = YES; opaque = NO; autoresize = RM; layer = <CALayer: 0x28342b800>>
       |    |    |    |    |    |    | <UIButtonLabel: 0x15fd1c7e0; frame = (60.3333 12.6667; 37 22); text = '\u767b\u5f55'; opaque = NO; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x2817b1810>>
       |    |    |    |    |    |    |    | <_UILabelContentLayer: 0x2835e2860> (layer)
       |    |    |    |    |    | <FixTitleColorButton: 0x15fe4c7b0; baseClass = UIButton; frame = (197.5 15; 157.5 47); clipsToBounds = YES; opaque = NO; autoresize = LM; layer = <CALayer: 0x2835e05c0>>
       |    |    |    |    |    |    | <UIButtonLabel: 0x15fe4ccc0; frame = (60.3333 12.6667; 37 22); text = '\u6ce8\u518c'; opaque = NO; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x2817b7c50>>
       |    |    |    |    |    |    |    | <_UILabelContentLayer: 0x2835e2080> (layer)
       |    |    |    |    | <UIButton: 0x15fd59850; frame = (287 44; 88 49); opaque = NO; autoresize = LM; layer = <CALayer: 0x2835ecbc0>>
       |    |    |    |    |    | <UIButtonLabel: 0x15fe5b060; frame = (15 16; 58 17); text = '\u7b80\u4f53\u4e2d\u6587'; opaque = NO; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x2817aa120>>
       |    |    |    |    |    |    | <_UILabelContentLayer: 0x2835e8a20> (layer)`
    

    choose(UIButton)

    [#"<FixTitleColorButton: 0x15fe2ad30; baseClass = UIButton; frame = (20 15; 157.5 47); clipsToBounds = YES; opaque = NO; autoresize = RM; layer = <CALayer: 0x28342b800>>",#"<FixTitleColorButton: 0x15fe4c7b0; baseClass = UIButton; frame = (197.5 15; 157.5 47); clipsToBounds = YES; opaque = NO; autoresize = LM; layer = <CALayer: 0x2835e05c0>>"]
    

    4、手机连接代理

    命令脚本
    可在终端输入命令:
    pviews()pvcs()

    2、Cycript编写脚本

    2.1、编写 cy 脚本
    添加脚本
    1、编写 test.cy 脚本
    sum = function(a, b) {
        return a + b;
    }
    

    2、执行脚本
    @import test && sum(10, 20)

    相关文章

      网友评论

          本文标题:[iOS逆向]13、Cycript

          本文链接:https://www.haomeiwen.com/subject/jnwxhrtx.html