各位大神，最近想对触动精灵做一个tweak，但是install后不起作用。按照小黄书中的教程对springboard和按键精灵做了两个例子，都成功了，但是对触动精灵就完全无效果。在论坛搜了一些关于tweak不起作用的帖子，检查了filter、检查日志看了cpu类型都没问题，按照颤抖吧，iGrimace！手把手教你hook以root权限运行的App中的说明试着修改app将dylib动态加载进来，也失败了（但是步骤跟帖子的步骤不完全一致，后面会说明一下）;按照防止tweak依附，App有高招；破解App保护，tweak留一手查看了一下，我想hook的目标进程，确实也有“Section(__RESTRICT,__restrice)”，按照步骤做了一下，闪退，这边cydia中能下载的AppSync是5.8版本，来自同步源[ios8 & ios9基础补丁]，但是描述里面没写支持ios9，不知道到底支不支持我的iOS9.2.1。无奈来论坛求助，请各位大神帮忙看一下，非常感谢。
先说下我这边的问题：
触动精灵有三个进程：
iPhone:~ root# ps -ef | grep -i touchsprite
501 3764 1 0 0:00.00 ?? 0:00.67 /Applications/TouchSprite.app/Weather
0 3770 1 0 0:00.00 ?? 0:00.28 /Applications/TouchSprite.app/Noon135a -server -b
0 3776 1 0 0:00.00 ?? 0:00.02 /Applications/TouchSprite.app/Hades 10
0 3790 3716 0 0:00.00 ttys001 0:00.01 grep -i touchsprite
其中Noon135a这个进程每次重启名字都会改变。
Weather是UI进程，我想修改Weather进程中的一个界面，直接在cycript中修改是可以的，我就想写成tweak，结果不行。Make文件内容：
THEOS_DEVICE_IP=192.168.1.169
ARCHS=armv7 armv7s arm64
TARGET=iphone:latest:8.0
include $(THEOS)/makefiles/common.mk
TWEAK_NAME = touchSpriteJHPatch
touchSpriteJHPatch_FILES = Tweak.xm
include $(THEOS_MAKE_PATH)/tweak.mk
after-install::
install.exec “killall -9 Weather”
plist文件内容：
{
Filter = {
Mode = Any;
Classes = (
“FileListViewController”
);
Executables = (
“Weather”,
“Hades”
);
Bundles = (
“com.touchsprite.ios”
);
};
}
tweak.xm文件内容：
%hook FileListViewController
- (void)refresh {
%log;
%orig;
}
%end
%ctor
{
NSLog(@“加载touchSpriteJHPatch tweak”);
%init;
}
结果在install和打开触动精灵后，日志我看不出有用的内容：
Nov 23 20:01:34 iPhone syslogd[198] : ASL Sender Statistics
Nov 23 20:01:34 iPhone com.apple.xpc.launchd[1] (com.openssh.sshd.558BB87D-931B-4E54-90E0-B76198508325[3792]) : Service exited with abnormal code: 255
Nov 23 20:01:35 iPhone SpringBoard[3376] : HW kbd: Failed to set (null) as keyboard focus
Nov 23 20:01:35 iPhone assertiond[267] : notify name “com.apple.powerlog.state_changed.ClientID.39” has been registered 20 times - this may be a leak
Nov 23 20:01:35 iPhone com.apple.xpc.launchd[1] (UIKitApplication:com.touchsprite.ios[0x45d9][3764]) : Service exited due to signal: Killed: 9
Nov 23 20:01:35 iPhone com.apple.xpc.launchd[1] (com.openssh.sshd.3A4FBBDC-3270-4340-BF32-13CAC3E650DA[3808]) : Service exited with abnormal code: 255
Nov 23 20:01:35 iPhone kernel[0] : AppleARMPMUCharger: limiting USB input current to 900 mA (measured 537 mA)
Nov 23 20:01:35 iPhone SpringBoard[3376] : Application ‘UIKitApplication:com.touchsprite.ios[0x45d9]’ exited abnormally via signal.
Nov 23 20:01:35 iPhone UserEventAgent[424] : 2349426460297: id=com.touchsprite.ios pid=3764, state=0
Nov 23 20:01:35 iPhone kernel[0] : AppleARMPMUCharger: limiting USB input current to 800 mA (measured 536 mA)
Nov 23 20:01:35 iPhone kernel[0] : AppleARMPMUCharger: limiting USB input current to 700 mA (measured 521 mA)
Nov 23 20:01:35 iPhone kernel[0] : AppleARMPMUCharger: limiting USB input current to 600 mA (measured 563 mA)
Nov 23 20:01:35 iPhone kernel[0] : AppleARMPMUCharger: limiting USB input current to 500 mA (measured 532 mA)
Nov 23 20:01:35 iPhone searchd[386] : ====^^^^ DuetExpert missing data, count → people:0 applicationDeepLinks:0 applications:8 requests:59 missingAllDataRequests:0
Nov 23 20:01:35 iPhone kernel[0] : AppleARMPMUCharger: limiting USB input current to 400 mA (measured 540 mA)
Nov 23 20:01:35 iPhone PPHelperLaunchd[506] : selfup 13 —> 0
Nov 23 20:01:35 iPhone PPHelperLaunchd[506] : state 12 —> 0
Nov 23 20:01:41 iPhone kernel[0] : Sandbox: ignoring builtin profile for platform app: /System/Library/Frameworks/UIKit.framework/Support/pasteboardd
Nov 23 20:01:41 iPhone kernel[0] : Sandbox: ignoring builtin profile for platform app: /System/Library/Frameworks/UIKit.framework/Support/pasteboardd
Nov 23 20:01:41 iPhone pasteboardd[3815] : MS:Notice: Injecting: (null) [pasteboardd] (1242.13)
请各位大神帮忙看一下，哪里有问题。
上面提到我按照颤抖吧…介绍的步骤做了一下修改，步骤如下：
我把/Application/TouchSprite.app拷贝出来，然后对里面的Weather用insert_dylib处理了一下：
./insert_dylib /var/tmp/touchSpriteJHPatch.dylib ~/dev/触动精灵/TouchSprite.app/Weather
然后将patch后的文件scp到手机的/Application/TouchSprite/目录下覆盖掉原来的Weather；
把我生成的touchSpriteJHPatch.dylib scp到手机的/var/tmp/目录下，并分别尝试了armv7、arm64不同的库，结果都是闪退。这么做有啥问题吗？因为这个程序是第三方的，所以没办法重新make package install才这么做的。