涂鸦智能Debug后启动黒屏

只跟踪到WaxSicknessPity的启动,内部如何处理的,没有思路,求大神帮分析下

bool -[WaxSicknessPity application:didFinishLaunchingWithOptions:](void * self, void * _cmd, void * arg2, void * arg3) {
    r31 = r31 - 0x70;
    *(r31 + 0x10) = r28;
    *(r31 + 0x18) = r27;
    *(r31 + 0x20) = r26;
    *(r31 + 0x28) = r25;
    *(r31 + 0x30) = r24;
    *(r31 + 0x38) = r23;
    *(r31 + 0x40) = r22;
    *(r31 + 0x48) = r21;
    *(r31 + 0x50) = r20;
    *(r31 + 0x58) = r19;
    *(r31 + 0x60) = r29;
    *(r31 + 0x68) = r30;
    r22 = self;
    r19 = [arg2 retain];
    r28 = @selector(expiration);
    r21 = *(r28 + 0x9c0);
    r23 = *(@selector(performDelete) + 0x8c0);
    r20 = [arg3 retain];
    r0 = objc_msgSend(r21, r23);
    r0 = [r0 retain];
    r21 = r0;
    r0 = objc_msgSend(r0, *(@selector(allKeys) + 0x7f8));
    r29 = r31 + 0x60;
    r0 = [r0 retain];
    r24 = r0;
    [r0 release];
    [r21 release];
    if (r24 != 0x0) {
            r21 = *0x1024cb3b8;
    }
    else {
            r0 = *(@selector(expiration) + 0x7c8);
            r21 = *0x1024cb3b8;
            r0 = objc_msgSend(r0, r21);
            r29 = r29;
            r0 = [r0 retain];
            r24 = r0;
            r26 = *(@selector(performDelete) + 0x7a8);
            r0 = objc_msgSend(r0, *0x1024cb3c0);
            *(r31 + 0x8) = r24;
            if (r0 != 0x0) {
                    r29 = r29;
                    r25 = [objc_msgSend(r24, r26) retain];
            }
            else {
                    r25 = objc_alloc();
                    r0 = *(@selector(expiration) + 0xa60);
                    r0 = objc_msgSend(r0, *(@selector(performDelete) + 0xad8));
                    r0 = [r0 retain];
                    r27 = r0;
                    objc_msgSend(r0, *0x1024cb528);
                    r25 = objc_msgSend(r25, *0x1024cb538);
                    [r27 release];
                    r29 = r29;
                    r27 = [objc_msgSend(*(@selector(expiration) + 0x818), *(@selector(performDelete) + 0x758)) retain];
                    objc_msgSend(r25, *0x1024cb4f8);
                    [r27 release];
            }
            r0 = *(r28 + 0x9c0);
            r0 = objc_msgSend(r0, r23);
            r0 = [r0 retain];
            r28 = r0;
            r27 = *0x1024cb6a0;
            r0 = objc_msgSend(r0, r27);
            r0 = [r0 retain];
            r24 = r0;
            r0 = objc_msgSend(r0, r26);
            r29 = r29;
            r0 = [r0 retain];
            r26 = r0;
            [r0 release];
            [r24 release];
            [r28 release];
            if (r26 == 0x0) {
                    r0 = *(@selector(expiration) + 0x9c0);
                    r0 = objc_msgSend(r0, r23);
                    r0 = [r0 retain];
                    r23 = r0;
                    r0 = objc_msgSend(r0, r27);
                    r29 = r29;
                    r0 = [r0 retain];
                    r24 = r0;
                    objc_msgSend(r0, *(@selector(groupCount) + 0x998));
                    [r24 release];
                    [r23 release];
            }
            objc_msgSend(r25, *(@selector(normalTitleAttribute) + 0x588));
            [r25 release];
            r0 = *(r31 + 0x8);
            [r0 release];
    }
    r25 = @selector(expiration);
    r0 = *(r25 + 0x7d0);
    r23 = *(@selector(totalCount) + 0x248);
    r0 = objc_msgSend(r0, r23);
    r0 = [r0 retain];
    r24 = r0;
    objc_msgSend(r0, *(@selector(setCodeInfo:) + 0xbb0));
    [r24 release];
    objc_msgSend(r22, *(@selector(setCodeInfo:) + 0xbb8));
    r0 = *(r25 + 0x7d0);
    r0 = objc_msgSend(r0, r23);
    r29 = r29;
    r0 = [r0 retain];
    r23 = r0;
    objc_msgSend(r0, *(@selector(setCodeInfo:) + 0xbc0));
    [r23 release];
    objc_msgSend(r22, *(@selector(setCodeInfo:) + 0xbc8));
    asm{ nop };
    r0 = *(r25 + 0x7c8);
    r0 = objc_msgSend(r0, *(@selector(setCodeInfo:) + 0xbd0));
    r0 = [r0 retain];
    r22 = r0;
    objc_msgSend(r0, *(@selector(setCodeInfo:) + 0xbd8));
    [r22 release];
    r22 = [objc_msgSend(*(r25 + 0x7c8), *(@selector(normalTitleAttribute) + 0xa60)) retain];
    r23 = *(@selector(setCodeInfo:) + 0xbe0);
    r24 = [NSStringFromSelector(r23) retain];
    objc_msgSend(r22, *(@selector(normalTitleAttribute) + 0xa68));
    [r24 release];
    [r22 release];
    r0 = *(r25 + 0x7c8);
    r0 = objc_msgSend(r0, r21);
    r0 = [r0 retain];
    r21 = r0;
    objc_msgSend(r0, *0x1024cb3b0);
    [r20 release];
    [r19 release];
    [r21 release];
    r0 = r31 | 0x1;
    return r0;
}

第一步,不要用Hopper的F5

1 个赞

第二步,购买 IDA F5 然后分享给大家 :stuck_out_tongue: