颤抖吧,iGrimace!手把手教你hook以root权限运行的App

注入玩之后,可以重启了,但是第二次重启 程序闪退啊
日志如下:
Oct 23 14:33:19 FR9Q wifid[75] : WiFi:[435738799.858831]: Client identityservices set type to background application
Oct 23 14:33:19 FR9Q wifid[75] : WiFi:[435738799.859486]: BG Application: Not Present, BG Daemon: Present. Daemons: networkd lockdownd sharingd apsd identityservices
Oct 23 14:33:19 FR9Q wifid[75] : WiFi:[435738799.859834]: Already connected to LinkSys2013.
Oct 23 14:33:19 FR9Q com.apple.imfoundation.IMRemoteURLConnectionAgent[522] : MS:Notice: Injecting: com.apple.imfoundation.IMRemoteURLConnectionAgent [com.apple.imfoundation.IMRemoteURLConnectionAgent] (847.21)
Oct 23 14:33:19 FR9Q wifid[75] : WiFi:[435738799.895152]: Creating client for “IMRemoteURLConne”
Oct 23 14:33:21 FR9Q SpringBoard[28] : LICreateIconForImage passed NULL CGImageRef image
Oct 23 14:33:21 FR9Q networkd[152] : Analytics Engine: double ON for app: com.mobisentry.rootapp
Oct 23 14:33:21 FR9Q ReportCrash[526] : MS:Notice: Injecting: (null) [ReportCrash] (847.21)
Oct 23 14:33:21 FR9Q ReportCrash[526] : ReportCrash acting against PID 524
Oct 23 14:33:21 FR9Q ReportCrash[526] : Formulating crash report for process RootApp[524]
Oct 23 14:33:21 FR9Q com.apple.launchd[1] (UIKitApplication:com.mobisentry.rootapp[0x2988][524]) : (UIKitApplication:com.mobisentry.rootapp[0x2988]) Job appears to have crashed: Trace/BPT trap: 5
Oct 23 14:33:21 FR9Q com.apple.launchd[1] (UIKitApplication:com.mobisentry.rootapp[0x2988]) : (UIKitApplication:com.mobisentry.rootapp[0x2988]) Throttling respawn: Will start in 2147483647 seconds
Oct 23 14:33:21 FR9Q backboardd[34] : Application ‘UIKitApplication:com.mobisentry.rootapp[0x2988]’ exited abnormally with signal 5: Trace/BPT trap: 5
Oct 23 14:33:21 FR9Q ReportCrash[526] : Saved crashreport to /Library/Logs/CrashReporter/RootApp_2014-10-23-143321_FR9Q.plist using uid: 0 gid: 0, synthetic_euid: 0 egid: 0
Oct 23 14:33:25 FR9Q wifid[75] : WiFi:[435738805.467847]: MIS state is Disabled
Oct 23 14:33:25 FR9Q wifid[75] : WiFi:[435738805.468378]: MIS state queried by “identityservices” is Disable
Oct 23 14:33:25 FR9Q wifid[75] : WiFi:[435738805.473084]: Client identityservices set type to normal application
Oct 23 14:33:25 FR9Q wifid[75] : WiFi:[435738805.473875]: BG Application: Not Present, BG Daemon: Present. Daemons: networkd lockdownd sharingd apsd
Oct 23 14:33:27 FR9Q wifid[75] : WiFi:[435738807.730726]: Client identityservices set type to background application
Oct 23 14:33:27 FR9Q wifid[75] : WiFi:[435738807.731012]: BG Application: Not Present, BG Daemon: Present. Daemons: networkd lockdownd sharingd apsd identityservices
Oct 23 14:33:27 FR9Q wifid[75] : WiFi:[435738807.731322]: Already connected to LinkSys2013.
Oct 23 14:33:31 FR9Q wifid[75] : WiFi:[435738811.373107]: MIS state is Disabled
Oct 23 14:33:31 FR9Q wifid[75] : WiFi:[435738811.373615]: MIS state queried by “identityservices” is Disable
Oct 23 14:33:31 FR9Q wifid[75] : WiFi:[435738811.377730]: Client identityservices set type to normal application
Oct 23 14:33:31 FR9Q wifid[75] : WiFi:[435738811.378338]: BG Application: Not Present, BG Daemon: Present. Daemons: networkd lockdownd sharingd apsd
Oct 23 14:33:31 FR9Q wifid[75] : WiFi:[435738811.997320]: WiFi unquiescing requested by “locationd”
Oct 23 14:33:32 FR9Q wifid[75] : WiFi:[435738812.015318]: WiFi unquiescing requested by “locationd”
Oct 23 14:33:42 FR9Q wifid[75] : WiFi:[435738822.023478]: WiFi unquiescing requested by “locationd”
Oct 23 14:33:52 FR9Q wifid[75] : WiFi:[435738832.863926]: Client identityservices set type to background application
Oct 23 14:33:52 FR9Q wifid[75] : WiFi:[435738832.864218]: BG Application: Not Present, BG Daemon: Present. Daemons: networkd lockdownd sharingd apsd identityservices
Oct 23 14:33:52 FR9Q wifid[75] : WiFi:[435738832.864530]: Already connected to LinkSys2013.
Oct 23 14:33:54 FR9Q wifid[75] : WiFi:[435738834.119713]: MIS state is Disabled
Oct 23 14:33:54 FR9Q wifid[75] : WiFi:[435738834.120213]: MIS state queried by “identityservices” is Disable
Oct 23 14:33:54 FR9Q wifid[75] : WiFi:[435738834.124242]: Client identityservices set type to normal application
Oct 23 14:33:54 FR9Q wifid[75] : WiFi:[435738834.124934]: BG Application: Not Present, BG Daemon: Present. Daemons: networkd lockdownd sharingd apsd
Oct 23 14:33:56 FR9Q wifid[75] : WiFi:[435738836.290840]: IMRemoteURLConne requesting removal of BGScan networks
Oct 23 14:33:56 FR9Q wifid[75] : WiFi:[435738836.294658]: No change in Background Scan candidates. Skip re-programming Background Scan
Oct 23 14:33:56 FR9Q wifid[75] : WiFi:[435738836.295721]: Already connected to LinkSys2013.
Oct 23 14:33:56 FR9Q wifid[75] : WiFi:[435738836.296210]: Removing client for “IMRemoteURLConne”
Oct 23 14:33:56 FR9Q wifid[75] : WiFi:[435738836.385078]: Client identityservices set type to background application

传入手机 /var/tmp/ 下的 iosre.dylib 在手机重启后没有了 求解释

因为这个目录就是临时目录啊,重启会自动清空的

我晕 给忘了

第二次不能重启的原因就是 我把iosre.dylib 库放在了临时目录下,放到别的路径下是对的。

1 个赞

狗神大大 重新生成的新app make package install 之后闪退…

我修改的app二进制文件的路径是 /Users/mac/iosrebooter/.theos/obj/debug/iOSREbooter.app/iOSREbooter

附上闪退日志:

Jan 27 18:20:07 iPhone com.apple.xpc.launchd[1] (UIKitApplication:com.naken.iosrebooter[0xe09a][744]) : Service exited due to signal: Killed: 9
Jan 27 18:20:07 iPhone SpringBoard[264] : LICreateIconForImage passed NULL CGImageRef image
Jan 27 18:20:07 iPhone SpringBoard[264] : Application ‘UIKitApplication:com.naken.iosrebooter[0xe09a]’ exited abnormally via signal.

@snakeninny 狗神大大

@snakeninny 狗神 刚才的问题 我换了个手机 就好了, 之前app闪退的手机是iphone6 , ios9.2
现在的手机是iphone5 , ios8.1.1

@snakeninny 狗神 这个root app 是我们自己写的demo , 如果我想hook别人写的root app 我直接用这个工具改别人root app 的二进制文件 然后把改好的二进制 又塞进去吗? 我刚试了下 好像不行 别人的root app闪退