iOS越狱:去除百思不得姐首页广告

1.使用MJAppTools查看App信息

【百思不得姐】 <com.kufaxian.wanwanmeixiangdao>
  /private/var/containers/Bundle/Application/C0CC7935-C092-44FD-9016-E58B6C71550B/MyWeiboJingXuan.app
  /private/var/mobile/Containers/Data/Application/28A6ED10-AC34-4D5E-85BA-6184B7F48686
  Universal binary
      arm_v7
      arm_64

发现未加壳

2.根据路径,使用iFunBox拿到App的Mach-O文件(MyWeiboJingXuan),放到一个指定文件夹

3.使用class-dump导出头文件

class-dump  -H MyWeiboJingXuan -o Headers

4.查看广告的cell是SPAdFlowCell,普通视屏播放cell是PostContentCell

5.使用thoes编写代码

%hook SPAdFlowCell

+ (double)flowAdCellHeight{
    return 0;
}
%end

fail.jpeg

发现cell重叠在一起,这种方法不可取,考虑把广告的模型去掉

查看PostsViewController->tableView

dongheide-iPhone:~ root# cycript -p MyWeiboJingXuan
cy# #0x14d195c00.dataSource
#"<PostsViewController: 0x14c7e5190>"
cy# 

结论:tableView的dataSource就是PostsViewController

查看控制器PostsViewController的成员变量

{
    _Bool _hasTabbar;
    _Bool _reloading;
    _Bool _isActive;
    _Bool _needPullDownLoadLocalData;
    float _menuHeight;
    PostsFragmentController *_parentController;
    NSString *_name;
    PostsDataSource *_dataSource;
    SecondTabItem *_secondTabItem;
    UITableView *_tableView;
    CContentTipView *_contentTipView;
    NSString *_adFlowId;
    NSString *_contentOffsetKey;
    NSMutableDictionary *_heightCache;
    NSString *_refreshMethod;
    NSNumber *_tableOffset;
    SpriteNativeAd *_nativeAd;
}

查看_dataSource的数量

cy# #0x14c7e5190->_dataSource->_data.count
21

21条,不包括广告,说明广告在另一个数组里面,SpriteNativeAd十分可疑,查看头文件SpriteNativeAd

@interface SpriteNativeAd : NSObject
{
    _Bool _usedDefaultParameter;
    _Bool _isFirst;
    UIViewController *_currentController;
    NSDictionary *_adConfig;
    NSArray *_adPlayKeyList;
    NSDictionary *_adResDict;
    long long _first;
    long long _interval;
    long long _stepinc;
    NSMutableDictionary *_adIndexConfig;
    NSTimer *_adTimer;
    NSMutableDictionary *_logReloadDict;
    NSDictionary *_defaultAdData;
}

+ (id)shareNativeAd;
+ (id)startNativeAdWithController:(id)arg1;
@property _Bool isFirst; // @synthesize isFirst=_isFirst;
@property(retain, nonatomic) NSDictionary *defaultAdData; // @synthesize defaultAdData=_defaultAdData;
@property(retain, nonatomic) NSMutableDictionary *logReloadDict; // @synthesize logReloadDict=_logReloadDict;
@property(retain, nonatomic) NSTimer *adTimer; // @synthesize adTimer=_adTimer;
@property(retain, nonatomic) NSMutableDictionary *adIndexConfig; // @synthesize adIndexConfig=_adIndexConfig;
@property _Bool usedDefaultParameter; // @synthesize usedDefaultParameter=_usedDefaultParameter;
@property long long stepinc; // @synthesize stepinc=_stepinc;
@property long long interval; // @synthesize interval=_interval;
@property long long first; // @synthesize first=_first;
@property(retain, nonatomic) NSDictionary *adResDict; // @synthesize adResDict=_adResDict;
@property(retain, nonatomic) NSArray *adPlayKeyList; // @synthesize adPlayKeyList=_adPlayKeyList;
@property(retain, nonatomic) NSDictionary *adConfig; // @synthesize adConfig=_adConfig;
@property(nonatomic) __weak UIViewController *currentController; // @synthesize currentController=_currentController;
- (void).cxx_destruct;
- (void)reportClick:(id)arg1 atIndex:(long long)arg2;
- (void)reportExposure:(id)arg1 atIndex:(long long)arg2;
- (void)calAdIndex:(long long)arg1;
- (long long)getAdCountWithTotalCount:(long long)arg1;
- (_Bool)isAdViewWithIndex:(long long)arg1;
- (_Bool)hasAdInfoWithIndex:(long long)arg1;
- (long long)getAdOffsetWithIndex:(long long)arg1;
- (long long)getAdPlayIndexWithIndex:(long long)arg1;
- (id)getAdContentInfoWithIndex:(long long)arg1;
- (id)getSingleAdContentInfo;
- (void)analyseAdData;
- (void)parseNativeAdData:(id)arg1;
- (void)getAdData;
- (void)refreshAllAd:(id)arg1;

@end

使用cycript查看相关信息

cy# #0x14c7e5190->_nativeAd
#"<SpriteNativeAd: 0x14d909240>"
cy# #0x14c7e5190->_nativeAd->_adPlayKeyList
@["api.gdt.95","api.gdt.95","api.gdt.95","api.gdt.95","api.gdt.95","api.gdt.95"]

猜测这个就是广告模型

编写代码注释掉解析data的方法

%hook SpriteNativeAd
 -(void)parseNativeAdData:(id)arg1{
    return ;
 }
%end

至此实现了百思不得姐首页的去除广告