iOSRe论坛一直很友好，没有屏蔽无帐号的用户。对于知识传播这是非常利好的。
作为一个站在众多前辈无私分险干货的肩膀上的菜鸟，分享此基础教程混个脸熟。
感谢列表：
@Aimer
@0xBBC
iOSRE官方交流群的众多热心人士
概述:
MacQQ防消息撤回 源自BlueCocoa分享的干货代码。官方链接在此：
https://blog.0xbbc.com/2017/04/prevent-qq-message-recall-in-macos/
因之前正好问过张总，在macOS下有啥好的Hook框架，张总介绍过一款神器。
因为没有应用场景，就一直没有玩儿过。
正好BlueCocoa在官方交流群分享了代码，借着BlueCocoa的代码
来完成一次动手实践活动，学习技术，顺便分享技能骗个TL2帐号:)
- substitute 下载，解决问题，编译
- 创建macOS dylib工程，抄袭BlueCocoa的工作成果
- DYLD_INSERT_LIBRARIES 与 load command
- insert_dylib 下载，编译
- 注入QQ
- @executable_path @loader_path @rpath
- install_name_tool 修复路径
- 完结撒花
0x01
开发环境
CocoaPods : 1.2.0
Ruby : ruby 2.2.6p396 (2016-11-15 revision 56800) [x86_64-darwin16]
RubyGems : 2.6.11
Host : Mac OS X 10.12.4 (16E195)
Xcode : 8.3.1 (8E1000a)
Git : git version 2.11.0 (Apple Git-81)
QQ : QQ for Mac V5.5.1(25725)
张总介绍的macOS上面的Hook神器为：substitute
下载并查看readme.md，发现只有 To compile for iOS 描述，没有for macOS。。。
先执行一次万能的make试试水深。
davis-MBP:substitute-master daviyang$ ./configure
Xcode SDK platform path: u'/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform'
Using architectures for 'host': (native)
Found cpp for 'host': /usr/bin/xcrun --sdk macosx cc -E
Xcode SDK platform path: u'/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform'
Using architectures for 'asm-x86_64': ['x86_64']
Xcode SDK platform path: u'/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform'
Using architectures for 'asm-i386': ['i386']
Xcode SDK platform path: u'/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform'
Using architectures for 'asm-arm': ['armv7']
Xcode SDK platform path: u'/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform'
Using architectures for 'asm-arm64': ['arm64']
Found cc for 'host': /usr/bin/xcrun --sdk macosx cc
Found dsymutil for 'host': /usr/bin/xcrun --sdk macosx dsymutil
Found cc for 'asm-x86_64': /usr/bin/xcrun --sdk macosx cc -arch x86_64
Found cc for 'asm-i386': /usr/bin/xcrun --sdk macosx cc -arch i386
Found cc for 'asm-arm': /usr/bin/xcrun --sdk iphoneos cc -arch armv7
Found cc for 'asm-arm64': /usr/bin/xcrun --sdk iphoneos cc -arch arm64
Writing out/main.mk
Writing Makefile
Writing config.status
接下来就是make。这命令不要笑，是readme.md推荐的，跟我没关系:)
davis-MBP:substitute-master daviyang$ make -j8
··· 省略一些内容
./lib/darwin/find-syms.c:157:13: error: 'syscall' is deprecated: first deprecated in macOS 10.12 - syscall(2) is unsupported; please switch to a supported interface. For
SYS_kdebug_trace use kdebug_signpost(). [-Werror,-Wdeprecated-declarations]
if (syscall(294, &start_address)) /* shared_region_check_np */
^
/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.12.sdk/usr/include/unistd.h:733:6: note: 'syscall' has been explicitly marked
deprecated here
int syscall(int, ...);
^
1 error generated.
make: *** [out/lib/darwin/find-syms.o] Error 1
make: *** Waiting for unfinished jobs....
出错了，但是平台确实选择了macOS，有得有失。
通过咨询一个不存在的网站找到一个解决方案。
到这里下载老的MacOSX10.11.sdk，放入 /Applications/XCode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs
友情提醒，仓库的Release中有独立的下载压缩包。
再次make -j8 
，得到相同的错误，这肯定得改编译参数了。
davis-MBP:substitute-master daviyang$ ./configure --help
*省略版面
Xcode SDK options (host):
--xcode-sdk ... Use Xcode SDK - `xcodebuild -showsdks` lists; typical
values: macosx, iphoneos, iphonesimulator, watchos,
watchsimulator
*省略版面
找到了–xcode-sdk改变编译SDK，并且提示了 xcodebuild -showsdks 命令可以查看列表。
davis-MBP:substitute-master daviyang$ xcodebuild -showsdks
iOS SDKs:
iOS 10.3 -sdk iphoneos10.3
iOS Simulator SDKs:
Simulator - iOS 10.3 -sdk iphonesimulator10.3
macOS SDKs:
OS X 10.11 -sdk macosx10.11
macOS 10.12 -sdk macosx10.12
tvOS SDKs:
tvOS 10.2 -sdk appletvos10.2
tvOS Simulator SDKs:
Simulator - tvOS 10.2 -sdk appletvsimulator10.2
watchOS SDKs:
watchOS 3.2 -sdk watchos3.2
watchOS Simulator SDKs:
Simulator - watchOS 3.2 -sdk watchsimulator3.2
重建正确的编译环境并编译。
davis-MBP:substitute-master daviyang$ ./configure --xcode-sdk macosx10.11 && make -j8
davis-MBP:substitute-master daviyang$ ls out/
_calc_darwin_target_conditionals.c lib libsubstitute.dylib mconfig-hashes.txt
generated libsubstitute.0.dylib main.mk
davis-MBP:substitute-master daviyang$ file out/libsubstitute.dylib
out/libsubstitute.dylib: Mach-O 64-bit dynamically linked shared library x86_64
我们成功编译出了x86_64平台的libsubstitute.dylib，同时把substrate目录下的头文件拷贝备用。
