美文网首页
关于CydiaSubstrate.framework在iOS13

关于CydiaSubstrate.framework在iOS13

作者: xiaoliang1 | 来源:发表于2020-04-18 03:42 被阅读0次

    最近发现MSHookFunction无论我怎么写都失效,我的手机是iPhone X Max ,非常苦恼。

    void hooksvc8() {
    
        long long gifIMFrameworkHeader = 0x0000000000000000;
        long long sub854c98 = 0x0000000000000000;
        long long sub33d4fc0 = 0x0000000000000000;
        for (int i = 0; i < _dyld_image_count (); i++) {
            char *pathCString = _dyld_get_image_name (i);
            NSString *path = [[NSString alloc] initWithCString:pathCString encoding:NSUTF8StringEncoding];
    //        NSLog (@"path :%@", path);
            if ([path containsString:@"gifBaseFramework"]) {
                gifIMFrameworkHeader = _dyld_get_image_vmaddr_slide (i);
    
                NSLog(@"gifIMFrameworkHeader :%#016llx",(long long)gifIMFrameworkHeader);
                sub854c98 = gifIMFrameworkHeader + 0x854c98;
                
                sub33d4fc0 = gifIMFrameworkHeader + 0x00000000033d4fc0;
            }
        }
    
    
        MSHookFunction((void *)sub33d4fc0, (void *)sub_33d4fc0, (void *)&or_sub_33d4fc0);
    
        NSLog(@"or_sub_33d4fc0 :%#016llx",or_sub_33d4fc0);
        NSLog(@"sub33d4fc0 :%#016llx",(long long)sub33d4fc0);
        NSLog(@"sub_33d4fc0 :%#016llx",(long long)sub_33d4fc0);
        NSLog(@"打印结束");
        MSHookFunction ((void *)sub854c98, (void *)sub_854c98, (void **)&or_sub_854c98);
    }
    
    

    每次调试都可以看到or_sub_33d4fc0和or_sub_854c98在执行hook之后都是0x000000.
    于是我试了下我手机越狱之后系统自带,居然可以hook到,无语。。。
    到此解决了手机CydiaSubstrate失效的问题,当然这个库也可在非IPhone X max 手机上使用,但是系统要满足这个俩库要求的最低系统,iOS11.0。
    文件名字做了一些更改,这里要多导入一个libsubstitute.dylib,别的到没多什么。
    这个俩动态库要求iOS11系统以上。
    更改文件名字后,目录结构如下:


    WX20200418-033650@2x.png

    以下题外话:
    我把我手机里的CydiaSubstrate提取出来,对比了下以下,以前的CydiaSubstrate。

    WX20200418-032418@2x.png

    这个sharedLibrary(???)居然 是Arm64e,MachOView由于很久没更新没识别出来。就连Appstore所有的App都没这Arm64e。唯一有的只有系统的文件包含这个Arm64e。
    官方的解释:
    https://developer.apple.com/documentation/security/preparing_your_app_to_work_with_pointer_authentication?language=objc
    我们的动态库和App也可以测试这个这个Arm64e。如官方所说:

    WX20200418-033001@2x.png
    就这样就可以编译出这个arm64e.但是苹果不允许提交到appstore.
    了解这么多,我就把手机导出的CydiaSubstrate.framework导到编译用的文件但是必须编写脚本更改动态库问题,代码如下:
    cp -rf "${SRCROOT}/InjectionFrameworks/CydiaSubstrate.framework" "$TARGET_APP_FRAMEWORKS_PATH"
    
    
    /usr/bin/codesign --force --sign "$EXPANDED_CODE_SIGN_IDENTITY" "$TARGET_APP_FRAMEWORKS_PATH/CydiaSubstrate.framework/libsubstitute.dylib"
    
    install_name_tool -change "/Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate" "@rpath/CydiaSubstrate.framework/CydiaSubstrate" "$TARGET_APP_FRAMEWORKS_PATH/InjectionFrameworks.framework/InjectionFrameworks"
    
    install_name_tool -change "/usr/lib/libsubstrate.dylib" "@rpath/CydiaSubstrate.framework/CydiaSubstrate" "$TARGET_APP_FRAMEWORKS_PATH/InjectionFrameworks.framework/InjectionFrameworks"
    
    install_name_tool -change "/usr/lib/libsubstitute.0.dylib" "@rpath/libsubstitute.dylib" "$TARGET_APP_FRAMEWORKS_PATH/CydiaSubstrate.framework/CydiaSubstrate"
    install_name_tool -add_rpath "@executable_path" "$TARGET_APP_FRAMEWORKS_PATH/CydiaSubstrate.framework/CydiaSubstrate"
    install_name_tool -add_rpath "@rpath" "$TARGET_APP_FRAMEWORKS_PATH/CydiaSubstrate.framework/CydiaSubstrate"
    install_name_tool -add_rpath "@loader_path" "$TARGET_APP_FRAMEWORKS_PATH/CydiaSubstrate.framework/CydiaSubstrate"
    install_name_tool -add_rpath "@executable_path/../Frameworks" "$TARGET_APP_FRAMEWORKS_PATH/CydiaSubstrate.framework/CydiaSubstrate"
    

    可能是CydiaSubstrate更新了??,也可能跟A12芯片有关系

    相关文章

      网友评论

          本文标题:关于CydiaSubstrate.framework在iOS13

          本文链接:https://www.haomeiwen.com/subject/tyfmvhtx.html