iOS越狱:去除腾讯视频启动页广告

1.使用reveal查看腾讯视频的启动页

发现首页最外层是TADSplashWindow类,猜测是启动页的广告

lanch.png

2.使用MJAppTools查看App的基本信息

# 06 【腾讯视频】 <com.tencent.live4iphone>
  /private/var/containers/Bundle/Application/C6AC9D06-F6B4-4A38-B00D-EE19DDA9E2DE/live4iphone.app
  /private/var/mobile/Containers/Data/Application/BFA918E3-5D51-46BD-A139-414CB17853C4
  Universal binary
      arm_v7
      arm_64
-----

发现没有加壳(在pp助手下载,所以未加壳)

3.根据App路径使用iFunBox把手机的Mach-O文件拖拽出来

4.使用class-dump导出App头文件

把导出的头文件放到subline查看,cmd+p,输入TADSplashWindow

#import "TADSplashBaseWindow.h"

@interface TADSplashWindow : TADSplashBaseWindow
{
}

- (Class)preferredRootViewControllerClass;

@end

发现只有一个方法,而且不是我们想要的,查看父类头文件,cmd+p,输入TADSplashBaseWindow

@class NSTimer, TADSplashBaseViewController, TADSplashItem;

@interface TADSplashBaseWindow : UIWindow
{
    _Bool _shouldFadeOutWhenTimeOut;
    TADSplashItem *_currentSplashItem;
    id <TADSplashWindowDelegate> _splashDelegate;
    TADSplashBaseViewController *_splashViewController;
    NSTimer *_timer;
    CDUnknownBlockType _finishBlock;
    double _timeCost_begin;
}

+ (void)updateUserInfo:(id)arg1;
+ (_Bool)isSplashing;
+ (void)PurgeSplashWindow;
+ (void)HideSplashWindow;
+ (_Bool)ShowSplashWindow:(id)arg1 userInfo:(id)arg2;
+ (_Bool)ShowSplashWindow:(id)arg1;
+ (_Bool)ShowSplashWindow:(id)arg1 LaunchImage:(id)arg2 LogoView:(id)arg3 adSkipButton:(id)arg4 withFinishBlock:(CDUnknownBlockType)arg5;
@property(nonatomic) double timeCost_begin; // @synthesize timeCost_begin=_timeCost_begin;
@property(copy, nonatomic) CDUnknownBlockType finishBlock; // @synthesize finishBlock=_finishBlock;
@property(retain, nonatomic) NSTimer *timer; // @synthesize timer=_timer;
@property(retain, nonatomic) TADSplashBaseViewController *splashViewController; // @synthesize splashViewController=_splashViewController;
@property(nonatomic) __weak id <TADSplashWindowDelegate> splashDelegate; // @synthesize splashDelegate=_splashDelegate;
@property(nonatomic) _Bool shouldFadeOutWhenTimeOut; // @synthesize shouldFadeOutWhenTimeOut=_shouldFadeOutWhenTimeOut;
@property(retain, nonatomic) TADSplashItem *currentSplashItem; // @synthesize currentSplashItem=_currentSplashItem;
- (void).cxx_destruct;
- (void)splashViewControllerWillOpenWXMiniprogram;
- (void)splashViewControllerUserDidSkipedAd;
- (void)splashViewControllerWillCancelAdCountdown;
- (void)splashViewControllerLandingPageDidAppear;
- (void)splashViewControllerWillOpenLandingPage;
- (void)splashViewControllerWillDisappear;
- (void)splashViewControllerDidAppear;
- (void)splashViewControllerWillAppear;
- (void)delayHideSplash;
- (void)endSplashWindow;
- (void)hideSplash;
- (void)splashWithoutOrder;
- (void)showSplash;
- (void)createRootViewController;
- (_Bool)isRetina5P5Inch;
- (_Bool)isRetina4P7Inch;
- (_Bool)isRetina4Inch;
- (void)timeoutHandle:(id)arg1;
- (void)createPlaceholderViewController;
- (Class)preferredRootViewControllerClass;
- (void)dealloc;
- (id)initWithSplashItem:(id)arg1 splashDelegate:(id)arg2;

@end

发现init方法,初步猜测返回nil,实现去广告

- (id)initWithSplashItem:(id)arg1 splashDelegate:(id)arg2;

5.使用theos编写插件

- (id)initWithSplashItem:(id)arg1 splashDelegate:(id)arg2{
    return nil
}

结果发现会黑屏:启动页显示1秒左右->黑屏1秒左右->进入首页
猜测这个广告页只是view没有显示出来,定时器方法仍然在走.猜测大概是广告显示时候,调用了定时器,定时器结束操作了一些根控制器设置的方法

仔细查看其他方法,发现- (void)showSplash;和- (void)hideSplash;
在显示广告页的方法中,直接调用hideSplash方法

重写编写插件

@interface DXClass
- (void)hideSplash;
@end

%hook TADSplashWindow
- (void)showSplash{
    [self hideSplash];
}
%end

重新编译安装后,成功去除启动页广告,再次使用Reveal查看

home.png

注意:使用theos时候,如果文件夹路径使用了中文命名,执行make指令会报错

make[3]: *** No rule to make target `/Users/lidongxi/Documents/iOS/?', needed by `/Users/lidongxi/Documents/iOS/腾讯视频/tencenttweak/.theos/obj/debug/armv7/tencentTweak.dylib'.  Stop.

更改为英文名称即可.