需求: hook installd中的方法
比如 [MIClientConnection _doInstallationForURL:withOptions:completion:]这个方法 , 打印方法中参数内容
操作步骤:
-
用ida分析 /usr/libexec/installd，看到 [MIClientConnection _doInstallationForURL:withOptions:completion:]这个方法
-
通过oslog看日志，配合LLDB查看，安装App的时候会执行_doInstallationForURL:withOptions:completion:这个方法
-
对installd写tweak（MSHookFunction 或者 Logos），然后通过oslog看日志，发现没有执行hook方法
日志:
Jan 3 15:12:50 test installd[647] <Notice>: 0x16dfc7000 -[MIClientConnection _doInstallationForURL:withOptions:completion:]: Install of "/var/mobile/Library/Caches/com.apple.appstored/AppPlaceholders/-6680498241233546627.app" type Placeholder (LSInstallType = 1) requested by lsd (pid 78)
代码:
Tweak.xm（MSHookFunction）
void * (*old_symbol1)(void *, void *, void *);
void * new_symbol1(void * arg0, void * arg1, void * arg2) {
NSLog(@"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
NSLog(@"Hook!!!!!!!!! %@", arg1);
return old_symbol1(arg0, arg1, arg2);
}
void (*old_symbol2)(void *, void *, void *);
void new_symbol2(void * arg0, void * arg1, void * arg2) {
NSLog(@"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
NSLog(@"Hook!!!!!!!!! %@", arg1);
old_symbol2(arg0, arg1, arg2);
}
%ctor
{
@autoreleasepool {
NSLog(@"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
MSImageRef image = MSGetImageByName("/usr/libexec/installd");
// void *symbol1 = MSFindSymbol(image, "__MIInstaller_initWithURL_options_forClient__");
void *symbol1 = MSFindSymbol(image, "initWithURL:options:forClient:");
if (symbol1) NSLog(@"Hook __MIInstaller_initWithURL_options_forClient__ !!!!!!!!!!");
MSHookFunction((void *)symbol1, (void *)&new_symbol1, (void **)&old_symbol1);
// void *symbol2 = MSFindSymbol(image, "__MIClientConnection__doInstallationForURL_withOptions_completion__");
void *symbol2 = MSFindSymbol(image, "_doInstallationForURL:withOptions:completion:");
if (symbol2) NSLog(@"Hook __MIClientConnection__doInstallationForURL_withOptions_completion__ !!!!!!!!!!");
MSHookFunction((void *)symbol2, (void *)&new_symbol2, (void **)&old_symbol2);
}
}
Tweak.xm（Logos）
%hook MIClientConnection
- (void)_doInstallationForURL:(NSURL *)url withOptions:(NSDictionary *)options completion:(id)block {
%orig;
%log((NSString *)@"!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
%log((NSString *)@"iOSRE: MIClientConnection _doInstallationForURL", options);
}
%end
Makefile
include $(THEOS)/makefiles/common.mk
TWEAK_NAME = installTweak
installTweak_FILES = Tweak.xm
installTweak_CFLAGS += -fvisibility=hidden
isntallTweak_LIBRARIES = substrate
include $(THEOS_MAKE_PATH)/tweak.mk
after-install::
install.exec "killall -9 installd"
installTweak.plist
{ Filter = { Executables = ( "installd" ); }; }
