RootViewController.mm
class CPPClass
{
public:
void CPPFuntion(const char *);
};
void CPPClass::CPPFuntion(const char* arg)
{
int a = 10;
int b = 20;
int c = 30;
b += a;
c += b;
for (int i = 0; i< 10; i++)
{
u_int32_t randomNumber;
if(i%3 == 0 ) randomNumber = arc4random_uniform(i);
NSProcessInfo *processInfo = [NSProcessInfo processInfo];
NSString *hostName = processInfo.hostName;
int pid = processInfo.processIdentifier;
NSLog(@"%d %@",pid,hostName);
c += b;
c *= b;
c -=a;
c *=a;
c *=b; c += b;
c *= b;
c -=a;
c *=a;
c *=b; c += b;
c *= b;
c -=a;
c *=a;
c *=b; c += b;
c *= b;
c -=a;
c *=a;
c *=b; c += b;
c *= b;
c -=a;
c *=a;
c *=b; c += b;
c *= b;
c -=a;
c *=a;
c *=b;
}
NSLog(@"CPPFuntion:%s",arg);
}
- (void)viewDidLoad
{
[super viewDidLoad];
NSLog(@"viewDidLoad");
CPPClass cppClass;
cppClass.CPPFuntion("doesn't tweak");
CFunction("doesn't tweak");
}
Tweak.xm
%hook RootViewController
- (void)viewDidLoad
{
%orig;
NSLog(@"hook viewDidLoad success");
old_CFunction("old_CFunction in viewDidLoad");
new_CFunction("xxxxxxxx");
}
%end
%ctor
{
NSLog(@"walk in ctor");
@autoreleasepool
{
MSImageRef image = MSGetImageByName("/Applications/Test.app/Test");
void *__CPPFunctionSymbol = MSFindSymbol(image, "__ZN8CPPClass10CPPFuntionEPKc");
if(__CPPFunctionSymbol)
{
NSLog(@" found CPPFuntion");
MSHookFunction(__CPPFunctionSymbol,(void *)&new_CPPFunction,(void **)&old_CPPFunction);
NSLog(@"cppSymbol is %p function is %p old_funtion is %p",__CPPFunctionSymbol,new_CPPFunction,old_CPPFunction);
}
void *__CFunctionSymbol = MSFindSymbol(image, "_CFunction");
if(__CFunctionSymbol)
{
NSLog(@" found CFuntion");
MSHookFunction(__CFunctionSymbol,(void*)&new_CFunction,(void**)&old_CFunction);
NSLog(@"CSymbol is %p function is %p old_funtion is %p",__CFunctionSymbol,new_CFunction,old_CFunction);
//new_CFunction("new hello world");
//old_CFunction("old hello world");
}
/*
void *__CShortFunctionSymbol = MSFindSymbol(image, "_CShortFunction");
if(__CShortFunctionSymbol)
{
NSLog(@" found CShortFuntion");
MSHookFunction(__CShortFunctionSymbol,(void*)&new_CShortFunction,(void**)&old_CShortFunction);
}
*/
}
}
log
Jul 31 11:00:30 Chans-5s Test[1023] <Warning>: viewDidLoad
Jul 31 11:00:30 Chans-5s Test[1023] <Warning>: hook viewDidLoad success
Jul 31 11:00:30 Chans-5s Test[1023] <Warning>: CFuntion1987:old_CFunction in viewDidLoad
Jul 31 11:00:30 Chans-5s Test[1023] <Warning>: CFuntion1987:hijack CFunction old
Jul 31 11:00:30 Chans-5s Test[1023] <Warning>: Application windows are expected to have a root view controller at the end of application launch
Jul 31 11:00:30 Chans-5s locationd[103] <Notice>: Gesture EnabledForTopCLient: 0, EnabledInDaemonSettings: 0
Jul 31 11:00:31 Chans-5s kernel[0] <Notice>: ART: 30 4d 02 01 00 30 26 02 03 01 66 9c 04 14 6e aa b3 13 72 8f 96 bc 1a f5 dc b5 fb 63 75 b6 f5 f4 51 e0 04 00 04 00 31 05 c0 03 01 5d 99 04 20 f4 fc ba 11 27 e8 0e e2 48 b4 14 32 18 43 e7 b5 20 ed 1e 20 30 f6 a5 74 09 49 90 3c 20 63 bf 1d
Jul 31 11:00:31 Chans-5s cloudd[588] <Notice>: (Note ) MC: User has completed cloud configuration. Not showing UI again.
Jul 31 11:00:43 Chans-5s locationd[103] <Notice>: NETWORK: no response from server, reachability, 2, queryRetries, 0
Jul 31 11:00:51 Chans-5s kernel[0] <Notice>: 003343.016772 wlan0.A[73] AppleBCMWLANCore::dumpWmeCounters(): per AC tx counters: 8367 6878 103 300, rx counters: 19514 0 0 59
Jul 31 11:00:51 Chans-5s kernel[0] <Notice>: 003343.016802 wlan0.A[74] AppleBCMWLANCore::dumpWmeCounters(): AWDL: Tx 54 0 0 0 Rx: 175 0 0 0
Jul 31 11:00:52 Chans-5s locationd[103] <Notice>: NETWORK: requery, 0, 0, 0, 0, 1, items, fQueryRetries, 1, fLastRetryTimestamp, 460004427.0
Jul 31 11:00:52 Chans-5s locationd[103] <Notice>: NETWORK: query, cells, 0, 0, 0, 0, wifis, 1
Jul 31 11:01:05 Chans-5s Test[1023] <Warning>: 1023 Chans-5s
Jul 31 11:01:05 Chans-5s Test[1023] <Warning>: CPPFuntion:doesn't tweak
Jul 31 11:01:05 Chans-5s Test[1023] <Warning>: CFuntion1987:doesn't tweak
观察结果， MSHookFunction(__CPPFunctionSymbol,(void *)&new_CPPFunction,(void **)&old_CPPFunction);执行完，app中的old_xxx方法已经找到，但是没有hook上，%ctor已经运行，但原app调用时的还是原方法。
测试环境 iphone5s ios8.4
代码有点多。。。
