- iOS逆向工程的工具大致可分为四类：
-
检测工具
如：Reveal、tcpdump等 -
反编译工具（反汇编工具 - 分析二进制文件并得到一些信息）
如：IDA、Hopper Disassembler、classdump等 -
调试工具
如：lldb、Cycript等 -
开发工具
如：Xcode、theos等
- classdump
可以将Mach-O文件中的Objective-C运行时的声明的信息导出，即编写OC代码时的 .h文件。class-dump只能导出未经加密的App的头文件。classdump是对"otool -ov" 信息的翻译，以一种我们熟悉的易读的方式呈现。官网http://stevenygard.com/projects/class-dump/
-
otool工具简介
otool(object file displaying tool) ：目标文件的展示工具。可以用来发现应用中使用到了哪些系统库，调用了其中哪些方法，使用了库中哪些对象及属性，它是Xcode自带的常用工具。-f print the fat headers -a print the archive header -h print the mach header -l print the load commands -L print shared libraries used -D print shared library id name -t print the text section (disassemble with -v) -p <routine name> start dissassemble from routine name -s <segname> <sectname> print contents of section -d print the data section -o print the Objective-C segment -r print the relocation entries -S print the table of contents of a library -T print the table of contents of a dynamic shared library -M print the module table of a dynamic shared library -R print the reference table of a dynamic shared library -I print the indirect symbol table -H print the two-level hints table -G print the data in code table -v print verbosely (symbolically) when possible -V print disassembled operands symbolically -c print argument strings of a core file -X print no leading addresses or headers -m don't use archive(member) syntax -B force Thumb disassembly (ARM objects only) -q use llvm's disassembler (the default) -Q use otool(1)'s disassembler -mcpu=arg use `arg' as the cpu for disassembly -j print opcode bytes -P print the info plist section as strings -C print linker optimization hints --version print the version of /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/otool-
依赖库的查询
如： otool -L WeChart -
是否加壳
如：otool -l WeChart | grep -B 2 crypt
-
-
classdump的使用
class-dump -s -S -H /Applications/Memenet/Memenet.app/Contents/MacOS/memenet -o ./MyHeaders``` 查看某文件夹下文件的个数，包括子文件夹里的。 ls -lR|grep "^-"|wc -l 查看某文件夹下文件夹的个数，包括子文件夹里的。 ls -lR|grep "^d"|wc -l
- dumpdecrypted 砸壳工具
下载最新源码: git clone https://github.com/stefanesser/dumpdecrypted.git
编译动态库文件(dumpdecrypted.dylib): make
定位要砸壳的StoreApp的执行文件名字TargetApp (ps -e 可以得到全路径)
定位要砸壳的StoreApp的Document目录:
cycript -p TargetApp
[[NSFileManager defaultManager]URLsForDirectory:NSDocumentDirectory inDomains:NSUserDomainMask][0]
得到路径:#"file:///var/mobile/Containers/Data/Application/986376B5-EF08-4CAF-81FB-CAE48D1FE4AE/Documents/"
进入Document目录: cd /var/mobile/Containers/Data/Application/986376B5-EF08-4CAF-81FB-CAE48D1FE4AE/Documents/
拷贝dumpdecrypted.dylib: cp dumpdecrypted.dylib .
DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Containers/Bundle/Application/749DC69A-3A8D-4B5C-9926-1220E69FC85F/WeChat.app/WeChat
网友评论