求解dumpdecrypted砸壳后，显示object is not a Mach-O file type

技能讨论
1

并且砸壳后使用class-dump和otool都提示文件不是Mach-O类型

求大神帮忙提醒下哪里出了问题 :rofl:

2

iphone-for-zhanglei:/var/mobile/Containers/Data/Application/BF857FCC-4A1C-4C0F-BBFF-AF044DCE0A4A/Documents root# DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/containers/Bundle/Application/D9EC8997-637B-4D30-AA24-327A9353E473/WeChat.app/WeChat
objc[8161]: Class MarsReachability is implemented in both /private/var/containers/Bundle/Application/D9EC8997-637B-4D30-AA24-327A9353E473/WeChat.app/Frameworks/mars.framework/mars (0x10ee3b228) and /private/var/containers/Bundle/Application/D9EC8997-637B-4D30-AA24-327A9353E473/WeChat.app/Frameworks/matrixreport.framework/matrixreport (0x10d6c9590). One of the two will be used. Which one is undefined.
mach-o decryption dumper

DISCLAIMER: This tool is only meant for security research purposes, not for application crackers.

[+] detected 64bit ARM binary in memory.
[+] offset to cryptid found: @0x104a54d48(from 0x104a54000) = d48
[+] Found encrypted data at address 0021c000 of length 4096 bytes - type 1.
[+] Opening /private/var/containers/Bundle/Application/D9EC8997-637B-4D30-AA24-327A9353E473/WeChat.app/WeChat for reading.
[+] Reading header
[+] Detecting header type
[+] Executable is a plain MACH-O image
[+] Opening WeChat.decrypted for writing.
[+] Copying the not encrypted start of the file
[+] Dumping the decrypted data into the file
[+] Copying the not encrypted remainder of the file
[+] Setting the LC_ENCRYPTION_INFO->cryptid to 0 at offset d48
[+] Closing original file
[+] Closing dump file

3

jiulvxing@localhost ~ % class-dump -H /Users/jiulvxing/Desktop/WeChat.decrypted -o /Users/jiulvxing/Desktop
class-dump: Input file (/Users/jiulvxing/Desktop/WeChat.decrypted) is neither a Mach-O file nor a fat archive.
jiulvxing@localhost ~ % class-dump -H /Users/jiulvxing/Desktop/WeChat.app -o /Users/jiulvxing/Desktop
class-dump: Input file (/Users/jiulvxing/Desktop/WeChat.app/WeChat) is neither a Mach-O file nor a fat archive.
jiulvxing@localhost ~ % otool -l /Users/jiulvxing/Desktop/WeChat.decrypted | grep crypt
llvm-objdump: error: /Users/jiulvxing/Desktop/WeChat.decrypted’: object is not a Mach-O file type.
jiulvxing@localhost ~ % cd /Users/jiulvxing/Desktop
jiulvxing@localhost Desktop % otool -l WeChat.decrypted | grep crypt
llvm-objdump: error: WeChat.decrypted’: object is not a Mach-O file type.