iOS逆向实践-反编译已安装APP头文件+Reveal查看界面

作者: Everdinner | 来源:发表于2018-03-20 15:44 被阅读373次

前言

在做这个实践之前，我一直认为反编译是一件很困难很无聊的一件事。直到自己亲自动手实践了一下，发现整个过程其实没有那么难(当然，仅仅是针对逆向了一个安装包的过程来说，完整的逆向过程还是有不少东西要学的)。今天就把自己动手实现的整个反编译过程记录一下。

准备工作

一部越狱的手机(越狱工作十分简单，使用pp助手即可完成)；
安装包逆向解析工具:dumpdecrypted class-dump ,主要用于解析应用头文件并生成可阅读的OC代码
使用Reveal查看APP UI

一. 反编译目标APP头文件

1. 将手机越狱，并在越狱工具Cydia内搜索openssh、Cydia Substrate、Cycript openssh.png Cydia Substrate.png Cycript.png

2. 安装dumpdecrypted和class-dump

//以下命令在终端完成
cd /Users/jacky/Downloads/dumpdecrypted-master
make
`xcrun --sdk iphoneos --find gcc` -Os  -Wimplicit -isysroot `xcrun --sdk iphoneos --show-sdk-path` -F`xcrun --sdk iphoneos --show-sdk-path`/System/Library/Frameworks -F`xcrun --sdk iphoneos --show-sdk-path`/System/Library/PrivateFrameworks -arch armv7 -arch armv7s -arch arm64 -c -o dumpdecrypted.o dumpdecrypted.c

3.获取要反编译的APP文件目录

通过Mac终端控制手机，注意OpenSSH的默认密码是alpine，这里需要注意的是我们的电脑和手机必须在同一个WiFi的连接下，查看手机wifi的ip地址

ip地址

在终端执行命令

ssh root@192.168.0.102
root@192.168.0.102's password: //这里输入alpine

接下来保持你要反编译的app在前台运行，同时在刚刚与手机建立连接的终端输入ps -e并回车，这里我们以腾讯新闻客户端为例，手机仅仅保持腾讯客户端前台运行，在终端输入命令后打印如下：

PID TTY           TIME CMD
    1 ??         1:41.19 /sbin/launchd
  227 ??         1:12.00 /usr/sbin/syslogd
  229 ??         0:07.19 /usr/sbin/WirelessRadioManagerd
  233 ??         0:00.59 /usr/sbin/wirelessproxd
  239 ??         0:01.87 /System/Library/PrivateFrameworks/TCC.framework/tccd
  242 ??         0:17.33 /usr/libexec/fseventsd
  245 ??         0:23.28 /usr/libexec/installd
  246 ??         0:00.00 (MSUnrestrictProc)
  248 ??         0:00.57 /System/Library/PrivateFrameworks/MobileInstallation.framework/XPCServices/com.apple.MobileInstallationHelperService.xpc/
  251 ??         0:07.27 /System/Library/PrivateFrameworks/IAP.framework/Support/iaptransportd
  254 ??         0:52.72 /System/Library/PrivateFrameworks/iTunesStore.framework/Support/itunesstored
  259 ??         0:11.17 /System/Library/PrivateFrameworks/IMCore.framework/imagent.app/imagent
  261 ??         1:11.99 /usr/libexec/configd
  263 ??         0:03.92 /usr/sbin/distnoted daemon
  265 ??         0:14.64 /System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted
  267 ??        72:19.69 /usr/libexec/backboardd
  269 ??         0:00.35 /usr/libexec/nfcd
  271 ??         0:27.58 /usr/libexec/assertiond
  273 ??         0:34.17 /System/Library/PrivateFrameworks/ApplePushService.framework/apsd
  275 ??         0:04.54 /usr/sbin/fairplayd.H2
  277 ??         0:27.67 /usr/sbin/mDNSResponder
  279 ??         1:07.36 /usr/sbin/notifyd
  281 ??         1:14.47 /usr/sbin/wifid
  287 ??         9:12.79 /System/Library/CoreServices/SpringBoard.app/SpringBoard
  289 ??         0:00.26 /System/Library/PrivateFrameworks/GenerationalStorage.framework/revisiond
  293 ??        52:45.76 /usr/sbin/mediaserverd
  295 ??         0:06.61 /usr/libexec/sharingd
  297 ??         0:12.68 /System/Library/PrivateFrameworks/IDS.framework/identityservicesd.app/identityservicesd
  299 ??         0:23.42 /System/Library/CoreServices/powerd.bundle/powerd
  310 ??         0:03.73 /System/Library/Frameworks/AssetsLibrary.framework/Support/assetsd
  321 ??         1:11.29 /usr/sbin/cfprefsd daemon
  324 ??         0:07.68 /System/Library/PrivateFrameworks/MobileContainerManager.framework/Support/containermanagerd
  327 ??         0:00.96 /usr/libexec/diagnosticd
  333 ??         0:55.72 /usr/libexec/networkd
  336 ??         0:06.62 /usr/sbin/BTServer
  338 ??         0:34.36 /usr/libexec/routined
  342 ??         0:14.35 /usr/libexec/nsurlstoraged
  344 ??         0:05.26 /usr/libexec/nanoregistryd
  347 ??         0:00.01 /usr/libexec/rocketd
  350 ??         0:15.57 /System/Library/Frameworks/Accounts.framework/accountsd
  357 ??         0:43.51 /usr/libexec/hangtracerd
  359 ??         0:00.07 /usr/libexec/MobileGestaltHelper
  365 ??         0:00.18 /usr/libexec/networkd_privileged
  369 ??         0:00.05 /usr/libexec/nanoregistrylaunchd
  372 ??         0:01.71 /System/Library/PrivateFrameworks/FoundationODR.framework/ondemandd.bundle/ondemandd
  375 ??         0:04.66 /usr/libexec/lsd
  377 ??         0:00.04 /System/Library/PrivateFrameworks/TouchRemote.framework/Support/touchsetupd
  379 ??         2:23.77 /usr/libexec/nsurlsessiond
  381 ??         0:14.87 /usr/libexec/timed
  383 ??         0:03.85 /usr/libexec/nehelper
  397 ??         5:59.90 /usr/libexec/UserEventAgent (System)
  402 ??         0:00.06 /usr/libexec/misd
  406 ??         0:00.01 /usr/libexec/pfd -d
  409 ??         0:01.10 /usr/libexec/lockbot
  414 ??         0:40.08 /usr/libexec/pphelper/PPHelperLaunchd
  416 ??         0:00.09 /usr/libexec/misagent
  421 ??         0:04.58 /System/Library/PrivateFrameworks/Accessibility.framework/Frameworks/AccessibilityUI.framework/XPCServices/com.apple.acce
  424 ??        25:36.62 /usr/libexec/locationd
  427 ??         0:01.25 /usr/libexec/mobileassetd
  430 ??         0:00.09 /usr/libexec/mobileactivationd
  433 ??         0:15.84 /System/Library/PrivateFrameworks/GeoServices.framework/geod
  436 ??         1:11.79 /usr/libexec/securityd
  439 ??         0:01.14 /System/Library/PrivateFrameworks/AuthKit.framework/akd
  441 ??         4:05.72 /System/Library/Frameworks/CoreTelephony.framework/Support/CommCenter
  446 ??         0:13.47 /usr/libexec/atc
  451 ??         0:00.03 /System/Library/PrivateFrameworks/CoreSymbolication.framework/coresymbolicationd
  454 ??         0:01.85 /System/Library/PrivateFrameworks/WirelessDiagnostics.framework/Support/awdd
  457 ??         0:02.34 /System/Library/PrivateFrameworks/MusicLibrary.framework/Support/medialibraryd
  462 ??         0:14.24 /usr/libexec/lockdownd
  466 ??         0:00.10 /System/Library/PrivateFrameworks/VisualVoicemail.framework/vmd
  473 ??         0:00.05 /usr/sbin/BlueTool -R
  476 ??         0:00.76 /System/Library/PrivateFrameworks/IMDPersistence.framework/XPCServices/IMDPersistenceAgent.xpc/IMDPersistenceAgent
  481 ??         0:01.77 /usr/libexec/biometrickitd --launchd
  484 ??         2:56.85 /usr/libexec/coreduetd
  486 ??         1:07.12 /usr/libexec/symptomsd
  490 ??         0:00.52 /System/Library/PrivateFrameworks/MapsSupport.framework/mapspushd
  492 ??         0:00.33 /System/Library/PrivateFrameworks/StoreBookkeeperClient.framework/Support/storebookkeeperd
  494 ??         0:00.54 /usr/libexec/findmydeviced
  498 ??         0:27.23 /usr/libexec/SafariCloudHistoryPushAgent
  501 ??         0:00.06 /System/Library/Frameworks/Security.framework/IDSKeychainSyncingProxy.bundle/IDSKeychainSyncingProxy
  504 ??         0:00.11 /System/Library/Frameworks/Security.framework/CloudKeychainProxy.bundle/CloudKeychainProxy
  507 ??         0:03.49 /System/Library/PrivateFrameworks/DataAccess.framework/Support/dataaccessd
  510 ??         0:00.18 /System/Library/PrivateFrameworks/CallHistory.framework/Support/CallHistorySyncHelper
  513 ??         0:18.54 /usr/libexec/gamed
  516 ??         0:00.13 /System/Library/PrivateFrameworks/AskPermission.framework/askpermissiond
  519 ??         0:04.28 /System/Library/PrivateFrameworks/HomeSharing.framework/Support/itunescloudd
  522 ??         0:02.84 /System/Library/PrivateFrameworks/HomeKitDaemon.framework/Support/homed
  525 ??         0:01.00 /System/Library/PrivateFrameworks/ManagedConfiguration.framework/Support/profiled
  527 ??         0:03.63 /System/Library/Frameworks/PassKit.framework/passd
  531 ??         0:00.15 /System/Library/PrivateFrameworks/iCloudNotification.framework/ind
  534 ??         0:08.14 /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/bird
  537 ??         0:00.79 /usr/libexec/fmfd
  540 ??         0:02.69 /System/Library/PrivateFrameworks/TelephonyUtilities.framework/callservicesd
  546 ??         0:02.53 /usr/libexec/aosnotifyd
  549 ??         0:01.09 /usr/sbin/filecoordinationd
  551 ??         0:00.10 /usr/libexec/keybagd -t 15
  555 ??         0:22.69 /System/Library/PrivateFrameworks/CloudKitDaemon.framework/Support/cloudd
  558 ??         0:00.55 /usr/libexec/adid
  561 ??         0:00.13 /System/Library/PrivateFrameworks/CarKit.framework/Support/carkitd
  564 ??         0:04.04 /usr/libexec/pipelined
  566 ??         0:11.86 /usr/libexec/duetexpertd
  569 ??         0:02.11 /System/Library/PrivateFrameworks/UserActivity.framework/Agents/useractivityd
  573 ??         0:09.53 /System/Library/PrivateFrameworks/Search.framework/searchd
  576 ??         0:00.07 /System/Library/PrivateFrameworks/CoreFollowUp.framework/followupd
  583 ??         0:01.03 /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/XPCServices/ContainerMetadataExtractor.xpc/ContainerMetadataE
  586 ??         0:00.36 /System/Library/CoreServices/AppleIDAuthAgent
  589 ??         0:00.30 /System/Library/PrivateFrameworks/AssistantServices.framework/assistantd
  595 ??         0:03.52 /usr/libexec/DuetHeuristic-BM
  601 ??         0:01.60 /usr/libexec/pkd -d/var/db/PlugInKit-Annotations
  612 ??         0:02.28 /System/Library/PrivateFrameworks/CalendarDaemon.framework/Support/calaccessd
  620 ??         0:00.12 /Applications/MobileSafari.app/webbookmarksd
  622 ??         0:00.05 /System/Library/PrivateFrameworks/AppSupport.framework/Support/cplogd
  624 ??         0:15.84 /Applications/MobileMail.app/MobileMail
  626 ??         0:00.05 /System/Library/PrivateFrameworks/UIFoundation.framework/XPCServices/com.apple.uifoundation-bundle-helper.xpc/com.apple.u
  629 ??         0:00.64 /System/Library/PrivateFrameworks/CoreRecents.framework/recentsd
  634 ??         0:23.22 /var/containers/Bundle/Application/E1C69DFA-A28C-4247-9030-335808503E89/AlipayWallet.app/AlipayWallet
  636 ??         0:00.46 /System/Library/PrivateFrameworks/CoreSuggestions.framework/suggestd
  646 ??         0:02.39 /usr/libexec/wcd
  653 ??         0:00.13 /System/Library/PrivateFrameworks/CacheDelete.framework/deleted
  656 ??         0:00.13 /System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
  742 ??         0:00.09 /usr/sbin/absd
  794 ??         0:00.19 /usr/libexec/notification_proxy
  811 ??         0:02.68 /System/Library/Frameworks/HealthKit.framework/healthd
  825 ??         0:00.05 /usr/libexec/afcd
  826 ??         0:00.00 (MSUnrestrictProc)
  836 ??         0:03.20 /System/Library/Frameworks/Metal.framework/XPCServices/MTLCompilerService.xpc/MTLCompilerService
  852 ??         0:03.09 /usr/libexec/rtcreportingd
  866 ??         0:00.18 /usr/libexec/online-auth-agent
  869 ??         0:00.10 /Applications/Contacts.app/PlugIns/ContactsCoreSpotlightExtension.appex/ContactsCoreSpotlightExtension
  872 ??         0:00.68 /Applications/MobileCal.app/PlugIns/CalendarWidget.appex/CalendarWidget
  874 ??         0:12.29 /Applications/Stocks.app/PlugIns/StocksWidget.appex/StocksWidget
  933 ??         0:00.08 /System/Library/CoreServices/EscrowSecurityAlert.app/EscrowSecurityAlert
  941 ??         0:00.07 /usr/libexec/companion_proxy
  948 ??         0:04.46 /System/Library/TextInput/kbd
  951 ??         0:41.09 /private/var/containers/Bundle/Application/CCE14291-E925-45A2-A759-18E084E261C1/SogouInput.app/PlugIns/com.sogou.sogouinp
  957 ??         0:03.48 /usr/libexec/mobile_installation_proxy
  960 ??         0:00.04 /System/Library/CoreServices/CacheDeleteSystemFiles
  962 ??         0:00.06 /System/Library/CoreServices/CacheDeleteITunesStore
  964 ??         0:00.52 /System/Library/CoreServices/CacheDeleteAppContainerCaches
  967 ??         0:00.65 aslmanager
  969 ??         0:00.09 /usr/libexec/replayd
  975 ??         0:05.61 /usr/libexec/swcd
  987 ??         0:02.04 /System/Library/PrivateFrameworks/MapsSupport.framework/navd
  996 ??         0:01.36 /usr/libexec/mmaintenanced
 1004 ??         0:00.57 /usr/libexec/seld
 1013 ??         0:00.12 /System/Library/PrivateFrameworks/CommunicationsFilter.framework/CMFSyncAgent.app/CMFSyncAgent
 1016 ??         0:08.80 /Applications/InCallService.app/InCallService
 1052 ??         0:25.06 /System/Library/PrivateFrameworks/StreamingZip.framework/XPCServices/com.apple.StreamingUnzipService.xpc/com.apple.Stream
 1058 ??         0:02.81 /usr/libexec/splashboardd
 1181 ??         0:05.55 /var/containers/Bundle/Application/EEE70959-6650-4665-964A-CE4B77FD5DD8/WeChat.app/WeChat
 1206 ??         0:12.51 /Applications/SafariViewService.app/SafariViewService
 1208 ??         0:00.25 /System/Library/Frameworks/WebKit.framework/XPCServices/com.apple.WebKit.Networking.xpc/com.apple.WebKit.Networking
 1214 ??         0:00.18 /System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
 1281 ??         0:00.14 /System/Library/PrivateFrameworks/FamilyCircle.framework/familycircled
 1355 ??         0:00.79 /Applications/MessagesNotificationViewService.app/MessagesNotificationViewService
 1447 ??         0:00.09 /usr/libexec/OTAPKIAssetTool
 1806 ??         0:00.10 /System/Library/PrivateFrameworks/QuickLookThumbnailing.framework/Support/com.apple.quicklook.ThumbnailsAgent
 1812 ??         0:00.06 /usr/libexec/tipsd
 2046 ??         0:00.75 /usr/libexec/tzd
 2134 ??         0:01.36 /var/containers/Bundle/Application/EFB23F4D-BC89-4835-890D-7C6B1B25A020/WeRead.app/WeRead
 2147 ??         0:00.08 /System/Library/PrivateFrameworks/SafariShared.framework/XPCServices/com.apple.Safari.History.xpc/com.apple.Safari.Histor
 2505 ??         2:32.07 /System/Library/PrivateFrameworks/AggregateDictionary.framework/Support/aggregated
 2692 ??         0:01.05 /System/Library/PrivateFrameworks/SoftwareBehaviorServices.framework/Support/softwarebehaviorservicesd
 2817 ??         0:00.09 /usr/libexec/limitadtrackingd
 2820 ??         0:00.21 /System/Library/PrivateFrameworks/AssetCacheServices.framework/XPCServices/AssetCacheLocatorService.xpc/AssetCacheLocator
 2972 ??         0:02.33 /usr/libexec/ptpd -t usb
 3026 ??         0:01.53 /Applications/StoreKitUIService.app/StoreKitUIService
 3099 ??         0:00.23 sshd: root@ttys000 
 3106 ??         0:07.53 /var/containers/Bundle/Application/80A788E7-9FEE-4896-B963-DE0D37911FB1/QQNews.app/QQNews
 3108 ??         0:00.07 /System/Library/Frameworks/UIKit.framework/Support/pasteboardd
 3111 ??         0:00.05 /System/Library/Frameworks/WebKit.framework/XPCServices/com.apple.WebKit.Networking.xpc/com.apple.WebKit.Networking
 3113 ??         0:00.06 /System/Library/Frameworks/WebKit.framework/XPCServices/com.apple.WebKit.WebContent.xpc/com.apple.WebKit.WebContent
 3101 ttys000    0:00.03 -sh
 3116 ttys000    0:00.01 ps -e

在这么多的打印中我们只找以/var/containers开头的打印信息，因为真机的应用程序目录都是这个格式，最终我们确定腾讯新闻的文件目录：

/var/containers/Bundle/Application/80A788E7-9FEE-4896-B963-DE0D37911FB1/QQNews.app/QQNews

4. 使用Cycript找出反编译APP的Documents目录路径

通过上面操作我们知道腾讯新闻的名称应该是QQNews

1234:~ root# cycript -p QQNews
//使用FileManager查找Documents文件夹
cy# [[NSFileManager defaultManager] URLsForDirectory:NSDocumentDirectory inDomains:NSUserDomainMask][0]
//下面的打印信息就是我们要找的Documents文件夹路径
#"file:///var/mobile/Containers/Data/Application/43E3939B-59E5-4442-8A80-ED0E33C8EDBD/Documents/"
cy# 
//control+z退出

5.将dumpdecrypted.dylib拷贝到Documents目录下

dumpdecrypted-master jacky$ scp /Users/jacky/Downloads/dumpdecrypted-master/dumpdecrypted.dylib root@192.168.3.37:/var/mobile/Containers/Data/Application/43E3939B-59E5-4442-8A80-ED0E33C8EDBD/Documents/
root@192.168.3.37's password: 
dumpdecrypted.dylib                           100%  193KB   2.8MB/s   00:00

这里需要注意的是我们不能直接在第四步结束后的终端上直接执行这样的命令，因为此时的终端是直接控制手机的，你直接在上面运行拷贝命令会提示“/Users/jacky/Downloads/dumpdecrypted-master/dumpdecrypted.dylib: No such file or directory”

6. 使用dumpdecrypted.dylib工具进行砸壳处理

cd /var/mobile/Containers/Data/Application/43E3939B-59E5-4442-8A80-ED0E33C8EDBD/Documents/
1234:/var/mobile/Containers/Data/Application/43E3939B-59E5-4442-8A80-ED0E33C8EDBD/Documents root# DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/containers/Bundle/Application/80A788E7-9FEE-4896-B963-DE0D37911FB1/QQNews.app/QQNews mach-o decryption dumper
Killed: 9
1234:/var/mobile/Containers/Data/Application/43E3939B-59E5-4442-8A80-ED0E33C8EDBD/Documents root# su mobile
1234:~/Containers/Data/Application/43E3939B-59E5-4442-8A80-ED0E33C8EDBD/Documents mobile$ DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/containers/Bundle/Application/80A788E7-9FEE-4896-B963-DE0D37911FB1/QQNews.app/QQNews mach-o decryption dumper
mach-o decryption dumper

DISCLAIMER: This tool is only meant for security research purposes, not for application crackers.

[+] detected 64bit ARM binary in memory.
[+] offset to cryptid found: @0x1000d8ca8(from 0x1000d8000) = ca8
[+] Found encrypted data at address 00004000 of length 42254336 bytes - type 1.
[+] Opening /private/var/containers/Bundle/Application/80A788E7-9FEE-4896-B963-DE0D37911FB1/QQNews.app/QQNews for reading.
[+] Reading header
[+] Detecting header type
[+] Executable is a plain MACH-O image
[+] Opening QQNews.decrypted for writing.
[+] Copying the not encrypted start of the file
[+] Dumping the decrypted data into the file
[+] Copying the not encrypted remainder of the file
[+] Setting the LC_ENCRYPTION_INFO->cryptid to 0 at offset ca8
[+] Closing original file
[+] Closing dump file
1234:~/Containers/Data/Application/43E3939B-59E5-4442-8A80-ED0E33C8EDBD/Documents mobile$ ls
HLLiteFiles   dumpdecrypted.dylib  qn_my_concern_global.data      qn_sorted_tagitems_.data       submenu.data
QQNews.decrypted  fontsizetype.value   qn_my_concern_list_.data       subMenuChannel_news_live.data  tadConfig.plist
QQNewsData.db     helpInfo.data        qn_my_concern_recommand_.data  subMenuInCurrent.data

遇到的问题：在执行命令时报killed: 9，在github上查看原来这是iOS9.3.2-9.3.3才会遇到的问题，查看issues发现有人给出解决方案，经过尝试，直接在终端输入“su mobile”命令后重新执行一次即可

7. 使用class-dump解析文件

在解析文件之前，我们首先需要将得到的QQNews.decrypted文件拷贝到电脑上，这里同样需要注意不能直接在控制手机的端口上执行拷贝命令，而是要新开一个窗口执行拷贝命令：

scp root@192.168.3.37:/var/mobile/Containers/Data/Application/43E3939B-59E5-4442-8A80-ED0E33C8EDBD/Documents/QQNews.decrypted ~/Desktop
root@192.168.3.37's password: 
QQNews.decrypted                                          100%   51MB  12.9MB/s   00:03

这里我们选择将文件拷贝到电脑桌面，之后你可以在桌面看到QQNews.decrypted文件，然后就是使用class-dump将文件解析成OC代码

cd /Users/jacky/Desktop 
//这里需要将arm64指定为自己手机的架构，如果是64位架构就没有问题，如果是iPhone5之前的手机则需要替换为armv7
jjb-pyxw:Desktop jacky$ class-dump --arch arm64 QQNews.decrypted > QQNews.m

如果一切顺利，我们已经可以在桌面看到QQNews.m的文件，打开它你会发现一切好像都有点熟悉的味道！

二. 使用Reveal查看APP界面

1.打开Reveal(1.6.3版本)，在菜单栏里找到Help/Show Reveal Library in Finder/ iOS Library，找到libReveal.dylib和Reveal.framework

D0AFAE57-FFA1-42F5-8D3A-EACFAD5C5BD9.png

2.将libReveal.dylib拷贝到手机的/Library/MobileSubstrate/DynamicLibraries文件夹下

//这里注意不要使用控制手机的那个终端窗口执行拷贝命令，原因前面已经说过
scp /Applications/Reveal.app/Contents/SharedSupport/iOS-Libraries/libReveal.dylib root@192.168.3.37:/Library/MobileSubstrate/DynamicLibraries
root@192.168.3.37's password: 
libReveal.dylib                               100% 4282KB   9.8MB/s   00:00

3.获取目标APP的bundle id，并新建一个libReveal.plist文件，将目标APP的bundle id填入里面

这里的问题就来了，怎么获得目标APP的bundle id？
在以前，我们可以选择在iTunes上直接下载目标APP的ipa文件解压或者使用iTools来获得，但是现在这条路已经行不通了
经过一番搜索，得到的可行方法是:
1.直接在App Store搜索目标APP，将链接分享到电脑，获得id编号
例如腾讯新闻的为：https://itunes.apple.com/cn/app/%E8%85%BE%E8%AE%AF%E6%96%B0%E9%97%BB-%E4%BA%8B%E5%AE%9E%E6%B4%BE%E7%9A%84%E7%83%AD%E7%82%B9%E8%B5%84%E8%AE%AF%E5%A8%B1%E4%B9%90%E7%9F%AD%E8%A7%86%E9%A2%91%E8%BD%AF%E4%BB%B6/id399363156?mt=8
2.然后在浏览器中打开https://itunes.apple.com/lookup?id=399363156，即可获得一个txt文档，打开文档搜索bundleid即可获得
3.使用Xcode新建一个plist，命名为libReveal.plist，填入目标APP的bundleid

DAD88E0F-734A-40E7-B778-3C3AFBB28F89.png
将libReveal.plist拷贝到手机/Library/MobileSubstrate/DynamicLibraries文件夹下

scp /Users/jacky/Desktop/Test/oc/JailbreakDemo/JailbreakDemo/libReveal.plist root@192.168.3.37:/Library/MobileSubstrate/DynamicLibraries
root@192.168.3.37's password: 
libReveal.plist                               100%  343    45.2KB/s   00:00

4.重新打开目标APP，并使用Reveal查看

Reveal截图.png

结束语

以上就是关于本次逆向实践的全过程记录，更深入的学习还在进行中，在此只是希望把整个操作和踩坑过程记录下来，提醒自己的同时也可以帮助其他对逆向感兴趣节省整个操作时间。整个过程中特别需要注意的就是文件从Mac拷贝到手机和从手机拷贝到Mac上时一定不要在控制手机的那个终端窗口上进行，否则你会头大的！

iOS逆向实践-反编译已安装APP头文件+Reveal查看界面

前言

准备工作

一. 反编译目标APP头文件

1. 将手机越狱，并在越狱工具Cydia内搜索openssh、Cydia Substrate、Cycript openssh.png Cydia Substrate.png Cycript.png

2. 安装dumpdecrypted和class-dump

3.获取要反编译的APP文件目录

4. 使用Cycript找出反编译APP的Documents目录路径

5.将dumpdecrypted.dylib拷贝到Documents目录下

6. 使用dumpdecrypted.dylib工具进行砸壳处理

遇到的问题：在执行命令时报killed: 9，在github上查看原来这是iOS9.3.2-9.3.3才会遇到的问题，查看issues发现有人给出解决方案，经过尝试，直接在终端输入“su mobile”命令后重新执行一次即可

7. 使用class-dump解析文件

二. 使用Reveal查看APP界面

1.打开Reveal(1.6.3版本)，在菜单栏里找到Help/Show Reveal Library in Finder/ iOS Library，找到libReveal.dylib和Reveal.framework

2.将libReveal.dylib拷贝到手机的/Library/MobileSubstrate/DynamicLibraries文件夹下

3.获取目标APP的bundle id，并新建一个libReveal.plist文件，将目标APP的bundle id填入里面

结束语

相关文章

网友评论

延伸阅读

深度阅读

栏目导航

热点阅读

反编译

技术分享