本文主要讲解最新版的子校验■■方法，离线等■■方法请看此文http://bbs.iosre.com/t/hopper-mac/1428
进入正题：
搜索特征字符串 “ForceQuit”，然后查看交叉引用，一共有2出，我们看第一处
来到这里：
000000010000b5fc mov rsi, qword [ds:0x10016ec58] ; @selector(boolForKey:), argument “selector” for method imp___got__objc_msgSend, XREF=_main+239
000000010000b603 lea rdx, qword [ds:cfstring_ForceQuit] ; @“ForceQuit”
000000010000b60a mov rdi, r13
000000010000b60d call qword [ds:imp___got__objc_msgSend]
000000010000b613 test al, al
000000010000b615 jmp 0x10000b61b
通过阅读上面的代码，我们发现有个md5的计算，下面就是几个跳转语句：把那几个跳转语句nop掉就可以了。我为了省事，就直接跳转到下一句：
000000010000b5ca mov bl, al
000000010000b5cc mov r14b, byte [ss:rbp+var_29]
000000010000b5d0 mov rdi, qword [ds:objc_cls_ref_NSUserDefaults] ; objc_cls_ref_NSUserDefaults, argument “instance” for method _objc_msgSend
000000010000b5d7 mov r12, qword [ds:0x10016ec40] ; @selector(standardUserDefaults)
000000010000b5de mov rsi, r12 ; argument “selector” for method _objc_msgSend
000000010000b5e1 call r15 ; _objc_msgSend
000000010000b5e4 mov r13, rax
000000010000b5e7 test bl, bl
000000010000b5e9 jmp 0x10000b5ef
000000010000b5eb sbb al, 0x1
000000010000b5ed add byte [ds:rax], al
000000010000b5ef movzx eax, r14b ; XREF=_main+226
000000010000b5f3 cmp eax, 0x1
000000010000b5f6 jmp 0x10000b5fc
000000010000b5f8 sgdt qword [ds:rax]
000000010000b5fb db 0x00 ; ‘.’
000000010000b5fc mov rsi, qword [ds:0x10016ec58] ; @selector(boolForKey:), argument “selector” for method imp___got__objc_msgSend, XREF=_main+239
000000010000b603 lea rdx, qword [ds:cfstring_ForceQuit] ; @“ForceQuit”
000000010000b60a mov rdi, r13
000000010000b60d call qword [ds:imp___got__objc_msgSend]
000000010000b613 test al, al
000000010000b615 jmp 0x10000b61b
000000010000b617 db 0x3f ; ‘?’
000000010000b618 db 0x01 ; ‘.’
000000010000b619 db 0x00 ; ‘.’
000000010000b61a db 0x00 ; ‘.’
000000010000b61b mov rbx, qword [ds:objc_cls_ref_NSMutableDictionary] ; objc_cls_ref_NSMutableDictionary, XREF=_main+270
000000010000b622 mov r12, qword [ds:0x10016e748] ; @selector(objectForKey:)
000000010000b629 lea rdx, qword [ds:cfstring_ThunderInstallCountDict] ; @“ThunderInstallCountDict”
000000010000b630 mov rdi, r13 ; argument “instance” for method _objc_msgSend
000000010000b633 mov rsi, r12 ; argument “selector” for method _objc_msgSend
000000010000b636 call r15 ; _objc_msgSend
000000010000b639 mov rsi, qword [ds:0x10016ec60] ; @selector(dictionaryWithDictionary:), argument “selector” for method _objc_msgSend
000000010000b640 mov rdi, rbx ; argument “instance” for method _objc_msgSend
000000010000b643 mov rdx, rax
000000010000b646 call r15 ; _objc_msgSend
