Help hook Message app

English Only
1

Hi,
I need help to grap text from ballon, i think i see the right class CKBallonTextView but i don’t know how can continue… Please help me!

2

Ideas:

  1. Use Reveal to help locate the correct view.
    2.class-dump that binary to see if there is any useful properties/IVARs.

Lemme know what do you find so I can help you further

3

I know the correct view is: CKBalloonTextView : UITextView
and this is the header:

@interface CKBalloonTextView : UITextView <NSLayoutManagerDelegate> {
    NSAttributedString *_attributedText;
    float _capOffsetFromBoundsTop;
    <CKBalloonTextViewInteractionDelegate> *_interactionDelegate;
    float _lastLineBaselineOffsetFromBoundsTop;
    BOOL _singleLine;
}

@property (nonatomic, copy) NSAttributedString *attributedText;
@property (nonatomic) float capOffsetFromBoundsTop;
@property (readonly, copy) NSString *debugDescription;
@property (readonly, copy) NSString *description;
@property (readonly) unsigned int hash;
@property (nonatomic) <CKBalloonTextViewInteractionDelegate> *interactionDelegate;
@property (nonatomic) float lastLineBaselineOffsetFromBoundsTop;
@property (getter=isSingleLine, nonatomic) BOOL singleLine;
@property (readonly) Class superclass;

- (void)_interactionStartedFromPreviewItemController:(id)arg1;
- (void)_interactionStoppedFromPreviewItemController:(id)arg1;
- (id)attributedText;
- (float)capOffsetFromBoundsTop;
- (void)dealloc;
- (id)description;
- (void)didMoveToWindow;
- (id)initReadonlyAndUnselectableWithFrame:(struct CGRect { struct CGPoint { float x_1_1_1; float x_1_1_2; } x1; struct CGSize { float x_2_1_1; float x_2_1_2; } x2; })arg1 textContainer:(id)arg2;
- (id)interactionDelegate;
- (BOOL)isSingleLine;
- (float)lastLineBaselineOffsetFromBoundsTop;
- (void)setAttributedText:(id)arg1;
- (void)setCapOffsetFromBoundsTop:(float)arg1;
- (void)setInteractionDelegate:(id)arg1;
- (void)setLastLineBaselineOffsetFromBoundsTop:(float)arg1;
- (void)setSingleLine:(BOOL)arg1;
- (struct CGSize { float x1; float x2; })sizeThatFits:(struct CGSize { float x1; float x2; })arg1 textAlignmentInsets:(struct UIEdgeInsets { float x1; float x2; float x3; float x4; }*)arg2 isSingleLine:(BOOL*)arg3;

@end

I have to grab the (id)arg1 of this function - (void)setAttributedText:(id)arg1;
but only for select sms ballon…

4

didn’t quite understand why you can’t use the attributedtext : (
mind describe your issue more clearly?

5

I tried to use attributedtext but it return (null)

6

So if i understood you right.

1.You want only SMSTexts, but directly hooking CKBalloonTextView also gives you unrelated texts.
2.Sometimes you got (NULL) for the text.

Did I understand you right?

7

Yes! I want only text of selected ballon

8

Uh…
User hold the ballon-----Prompt user if he wants to do some shit-----do some shit?

Well you’ll have to hook initializing codes, add a UIGestureResponder, so when the user selected a ballon, you method will be called and you can do the job.

9

I haven’t any problem for the user interaction with ballon, my problem is only to grab text :frowning:

10

Mind sharing your code? gist.github.com would do. And PM me the address so your code would be keep secret.

I’ll try my best to help you but I can’t promise : (

11

This is my code now:

%hook CKTranscriptCollectionViewController

- (NSArray *)menuItemsForBalloonView:(id)view {

        NSMutableArray *menuItems = [%orig mutableCopy];
        NSString *title = @"Like"[objectAtIndex:0]];
        UIMenuItem *like = [[UIMenuItem alloc] initWithTitle:title action:@selector(star:)];
        [menuItems insertObject:like atIndex:0];
        return menuItems;
    [menuItems release];
}

%new
- (void)balloonView:(id)view star:(id)sender {
NSLog(@"Like clicked");
}

%end

%hook CKBalloonTextView
- (void)setAttributedText:(id)arg1{
    %orig (arg1);
    %log(arg1);
}

%end
12

dyldCache is broken and I don’t have a JB device. The rest solution are based experience of dealing with similar situations.

if CKTranscriptCollectionViewController is CKBalloonTextView’s viewController.
There should be a method setting up CKBalloonTextView in CKTranscriptCollectionViewController.
From there you can iterate all the CKBalloonTextView ,since they are now initialized, you shouldn’t have trouble now.

Also.
Use
NSLog(@"%@",arg1);
%orig;

cuz sometimes %orig will release the argument and thus you can’t get any value

EDIT: Forwarded this issue to my fellows, they might help you better cuz i don’t have JB device for testing now

13

%hook CKBalloonTextView

  • (NSString*)attributedText{
    id ret=%orig;
    NSLog(@"Text:%@ ",ret);
    return ret;
    }

%end

14

The result:
: Text:SMS test!{
NSColor = “UIDeviceWhiteColorSpace 0 1”;
NSFont = “<UICTFont: 0x15f672dc0> font-family: “.HelveticaNeueInterface-Regular”; font-weight: normal; font-style: normal; font-size: 17.00pt”;
}
but i have results of all sms page… Now I have to understand how i can grab only text for selected balloon

15

%hook CKTranscriptCollectionViewController

  • (NSArray *)menuItemsForBalloonView:(id)view {

      NSMutableArray *menuItems = [%orig mutableCopy];
  NSString *title = @"Like"[objectAtIndex:0]];
  UIMenuItem *like = [[UIMenuItem alloc] initWithTitle:title action:@selector(balloonView:star:)];
  [menuItems insertObject:like atIndex:0];
  return menuItems;

    [menuItems release];
    }

%new

  • (void)balloonView:(id)view star:(id)sender {
    NSLog(@"%@"self.attributedString);
    }

%end

You’ll have to craft a header to avoid method not found error.

Check NSAttributedString.h for hints on how to convert NSAttributedString to NSString

16

oh shit I forgot that was ViewController hook.
You need to find the proper property of the ViewController containing the views.

Try Hopper Disassembler and see XREFs : )

17

Nothing to do…