美文网首页
[iOS逆向]13、Cycript

[iOS逆向]13、Cycript

作者: 史记_d5da | 来源:发表于2022-01-18 22:35 被阅读0次

1、Cycript的基本用法

1.1、基本概念

Cycript是由Cydia创始人Saurik推出的一款脚本语言,Cycript混合了OC、JavaScript语法的解释器,这意味着我们能够在一个命令中使用Oc或者JavaScript,甚至两者并用。它能够挂钩正在运行的进程,能够在运行时修改很多东西。

1.2、Cycript 使用

1、Cycript 安装
下载Cycript这个可执行文件、放在 /opt/cycript_0.9.594 配置环境变量 export PATH=/opt/cycript_0.9.594:$PATH
2、运行 MonkeyDevDemo ,编译完成后,查看 appFrameworks 中包含 libcycript.dylib 文件

libcycript.dylib
3、终端连接手机 cycript -r 192.168.3.9:6666 终端输入命令
UIWindow.keyWindow
(extern "C" id ":keyWindow"(id, SEL))

[UIApplication sharedApplication]

"<UIApplication: 0x113d1ca10>"

UIApp

"<UIApplication: 0x113d1ca10>"

var keyWd = UIWindow.keyWindow()

"<iConsoleWindow: 0x113e545e0; baseClass = UIWindow; frame = (0 0; 375 812); gestureRecognizers = <NSArray: 0x2835a4150>; layer = <UIWindowLayer: 0x283a51060>>"

keyWd.rootViewController

"<MMUINavigationController: 0x1150e0600>"

keyWd.recursiveDescription().toString()

`<iConsoleWindow: 0x160c0a680; baseClass = UIWindow; frame = (0 0; 375 812); gestureRecognizers = <NSArray: 0x283bb1680>; layer = <UIWindowLayer: 0x28340c9e0>>
   | <UILayoutContainerView: 0x15fe30040; frame = (0 0; 375 812); clipsToBounds = YES; autoresize = W+H; gestureRecognizers = <NSArray: 0x283bb1b30>; layer = <CALayer: 0x283432fe0>>
   |    | <UINavigationTransitionView: 0x15fd45230; frame = (0 0; 375 812); clipsToBounds = YES; autoresize = W+H; layer = <CALayer: 0x283434c80>>
   |    |    | <UIViewControllerWrapperView: 0x15fd6f210; frame = (0 0; 375 812); autoresize = W+H; layer = <CALayer: 0x2835e82e0>>
   |    |    |    | <UIView: 0x15fe328c0; frame = (0 0; 375 812); autoresize = W+H; layer = <CALayer: 0x28342e140>>
   |    |    |    |    | <UIView: 0x15fd1b960; frame = (0 44; 375 877); autoresize = W; layer = <CALayer: 0x28342ac80>>
   |    |    |    |    |    | <UIImageView: 0x15fd27600; frame = (0 -44; 375 812); opaque = NO; userInteractionEnabled = NO; layer = <CALayer: 0x28342b400>>
   |    |    |    |    | <UIView: 0x15fd0c510; frame = (0 693; 375 65); autoresize = W+TM; layer = <CALayer: 0x28342b760>>
   |    |    |    |    |    | <FixTitleColorButton: 0x15fe2ad30; baseClass = UIButton; frame = (20 15; 157.5 47); clipsToBounds = YES; opaque = NO; autoresize = RM; layer = <CALayer: 0x28342b800>>
   |    |    |    |    |    |    | <UIButtonLabel: 0x15fd1c7e0; frame = (60.3333 12.6667; 37 22); text = '\u767b\u5f55'; opaque = NO; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x2817b1810>>
   |    |    |    |    |    |    |    | <_UILabelContentLayer: 0x2835e2860> (layer)
   |    |    |    |    |    | <FixTitleColorButton: 0x15fe4c7b0; baseClass = UIButton; frame = (197.5 15; 157.5 47); clipsToBounds = YES; opaque = NO; autoresize = LM; layer = <CALayer: 0x2835e05c0>>
   |    |    |    |    |    |    | <UIButtonLabel: 0x15fe4ccc0; frame = (60.3333 12.6667; 37 22); text = '\u6ce8\u518c'; opaque = NO; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x2817b7c50>>
   |    |    |    |    |    |    |    | <_UILabelContentLayer: 0x2835e2080> (layer)
   |    |    |    |    | <UIButton: 0x15fd59850; frame = (287 44; 88 49); opaque = NO; autoresize = LM; layer = <CALayer: 0x2835ecbc0>>
   |    |    |    |    |    | <UIButtonLabel: 0x15fe5b060; frame = (15 16; 58 17); text = '\u7b80\u4f53\u4e2d\u6587'; opaque = NO; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x2817aa120>>
   |    |    |    |    |    |    | <_UILabelContentLayer: 0x2835e8a20> (layer)`

choose(UIButton)

[#"<FixTitleColorButton: 0x15fe2ad30; baseClass = UIButton; frame = (20 15; 157.5 47); clipsToBounds = YES; opaque = NO; autoresize = RM; layer = <CALayer: 0x28342b800>>",#"<FixTitleColorButton: 0x15fe4c7b0; baseClass = UIButton; frame = (197.5 15; 157.5 47); clipsToBounds = YES; opaque = NO; autoresize = LM; layer = <CALayer: 0x2835e05c0>>"]

4、手机连接代理

命令脚本
可在终端输入命令:
pviews()pvcs()

2、Cycript编写脚本

2.1、编写 cy 脚本
添加脚本
1、编写 test.cy 脚本
sum = function(a, b) {
    return a + b;
}

2、执行脚本
@import test && sum(10, 20)

相关文章

网友评论

      本文标题:[iOS逆向]13、Cycript

      本文链接:https://www.haomeiwen.com/subject/jnwxhrtx.html