去掉某应用的feed流广告2

从UI入手:


广告为tableviewcell,所以拿到UITableView的dataSource就能找到包含该数据源代理的viewcontroller,如上图为NewsListVCSHAndSZ

观察该类的方法:

@interface NewsListVCSHAndSZ : NewsListViewController
{
}

- (id)getNewsListUrlString;
- (id)getStockCodeForRequest;

@end

只有两条,没有看到明显的方法或属性,可能在它父类里面,观察父类的属性或方法:

@interface NewsListViewController : HXStockInfoPageBaseVC <UITableViewDelegate, UITableViewDataSource, NewsInfoDefaultNewCellDelegate>
{
    _Bool _isLoadingMore;
    _Bool _noMoreData;
    _Bool _isNeedSendLoadBehavoir;
    _Bool _isNewsListSHHJClass;
    NSString *_newsUrlString;
    long long _currentPage;
    HXFooterLoadingView *_showNextBtn;
    NSString *_curStockCode;
    UITableView *_tableView;
    UIView *_footView;
    NSMutableArray *_dataArray;
    UILabel *_loadingLabel;
    NSDate *_lastRequestDate;
    NSString *_labelUrl;
    NSString *_nextPageUrl;
}

@property(copy, nonatomic) NSString *nextPageUrl; 
@property(retain, nonatomic) NSString *labelUrl;
@property(nonatomic) _Bool isNewsListSHHJClass;
@property(retain, nonatomic) NSDate *lastRequestDate;
@property(retain, nonatomic) UILabel *loadingLabel;
@property(nonatomic) _Bool isNeedSendLoadBehavoir; 
@property(nonatomic) _Bool noMoreData; 
@property(nonatomic) _Bool isLoadingMore;
@property(retain, nonatomic) NSMutableArray *dataArray; 
@property(retain, nonatomic) UIView *footView; 
@property(retain, nonatomic) UITableView *tableView; 
@property(retain, nonatomic) NSString *curStockCode;
@property(retain, nonatomic) HXFooterLoadingView *showNextBtn; 
@property(nonatomic) long long currentPage; 
@property(retain, nonatomic) NSString *newsUrlString;
。。。。。。。。。。

可以看到有个明显的属性NSMutableArray *dataArray,很有可能就是包含cell数据的可变数组,这里只看头文件已经看不出名堂了。

动态调试:

用xia0lldb脚本打印出类的各个方法的地址

(lldb) methods NewsListViewController
<NewsListViewController: 0x10491b908>:
in NewsListViewController:
	Properties:
		@property (retain, nonatomic) HXFooterLoadingView* showNextBtn;  (@synthesize showNextBtn = _showNextBtn;)
		@property (retain, nonatomic) NSString* curStockCode;  (@synthesize curStockCode = _curStockCode;)
		@property (retain, nonatomic) UITableView* tableView;  (@synthesize tableView = _tableView;)
		@property (retain, nonatomic) UIView* footView;  (@synthesize footView = _footView;)
		@property (retain, nonatomic) NSMutableArray* dataArray;  (@synthesize dataArray = _dataArray;)
。。。。。。
		- (void) setIsNeedSendLoadBehavoir:(BOOL)arg1; (0x101476cfc)
		- (void) themeChanged; (0x101476aa0)
		- (void) setDataArray:(id)arg1; (0x101476c98)

我需要知道dataArray里面有哪些数据,所以可以对它下个断点

(lldb) b 0x101476c98
Breakpoint 1: where = IHexin`___lldb_unnamed_symbol78742$$IHexin, address = 0x0000000101476c98
(lldb) c
Process 5544 resuming
Process 5544 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
    frame #0: 0x0000000101476c98 IHexin`___lldb_unnamed_symbol78742$$IHexin
IHexin`___lldb_unnamed_symbol78742$$IHexin:
->  0x101476c98 <+0>:  mov    x1, x2
    0x101476c9c <+4>:  adrp   x8, 13394
    0x101476ca0 <+8>:  ldrsw  x8, [x8, #0x404]
    0x101476ca4 <+12>: add    x0, x0, x8
    0x101476ca8 <+16>: b      0x10338e0ec               ; symbol stub for: objc_storeStrong

IHexin`___lldb_unnamed_symbol78743$$IHexin:
    0x101476cac <+0>:  adrp   x8, 13394
    0x101476cb0 <+4>:  ldrsw  x8, [x8, #0x408]
    0x101476cb4 <+8>:  ldrb   w0, [x0, x8]
Target 0: (IHexin) stopped.
(lldb) x/s $x1
0x108336aa1: "setDataArray:"
(lldb) po $x2
<__NSArrayM 0x171a51ee0>(
<NewsListCellFrameModel: 0x1745eb700>,
<NewsListCellFrameModel: 0x1743f7100>,
<NewsListCellFrameModel: 0x1707e2700>,
<NewsListCellFrameModel: 0x1707e2100>,
<NewsListCellFrameModel: 0x1707e2f00>,
<NewsListCellFrameModel: 0x1707e1f00>,
<NewsListCellFrameModel: 0x1745f4c00>,
<NewsListCellFrameModel: 0x1745f4900>,
<NewsListCellFrameModel: 0x1745f6400>,
<NewsListCellFrameModel: 0x1745f6500>,
<NewsListCellFrameModel: 0x1745ef400>,
<NewsListCellFrameModel: 0x1707e2200>,
<NewsListCellFrameModel: 0x1745f8500>,
<NewsListCellFrameModel: 0x1705fd300>,
<NewsListCellFrameModel: 0x1745eeb00>,
<NewsListCellFrameModel: 0x1705fd000>,
<NewsListCellFrameModel: 0x1705fd200>,
<NewsListCellFrameModel: 0x1705eda00>,
<NewsListCellFrameModel: 0x1707e7d00>,
<NewsListCellFrameModel: 0x1707e7f00>
)

可以看到数组里面放的都是叫做NewsListCellFrameModel的对象,而且长得都一样。c一下,看手机上的广告在第五个位置,所以可以打印它的实例变量看看

(lldb) ivars 0x1707e2f00
<NewsListCellFrameModel: 0x1707e2f00>:
in NewsListCellFrameModel:
	_newsInfo (NewsInfoNewModel*): <NewsInfoNewModel: 0x1746f5900>
	_cellHeight (double): 74
	_titleFrame (struct CGRect): {{15, 15}, {290, 18}}
	_propertyFrame (struct CGRect): {{15, 37}, {28.504000000000001, 20}}
	_circleFrame (struct CGRect): {{0, 0}, {0, 0}}
	_soureFrame (struct CGRect): {{48.504000000000005, 37}, {110.26799999999999, 20}}
	_dateFrame (struct CGRect): {{167.77199999999999, 37}, {31.921875, 20}}
	_article1Frame (struct CGRect): {{0, 0}, {0, 0}}
	_article2Frame (struct CGRect): {{0, 0}, {0, 0}}
in NSObject:
	isa (Class): NewsListCellFrameModel (isa, 0x21a10495e0cd)

还是没有直接看到广告的内容,但是看到有个叫做_newsInfo (NewsInfoNewModel*)的变量,这个应该包含了广告的内容,也只能是这个了。继续打印它的变量:

(lldb) ivars 0x1746f5900
<NewsInfoNewModel: 0x1746f5900>:
in NewsInfoNewModel:
	_isReaded (BOOL): NO
	_seq (NSString*): @"623556263"
。。。。。。。。
	_label_type (NSString*): @"推广"
	_label_property (NSString*): @""
	_label_article (NSString*): @""
	_titleLayout (YYTextLayout*): <YYTextLayout: 0x17039e780>
	_label_article_ids (NSMutableArray*): <__NSArrayM: 0x1750497b0>
	_label_article_titles (NSMutableArray*): <__NSArrayM: 0x175048fd0>
	_ctimeString (NSString*): @"09:10"
in NSObject:
	isa (Class): NewsInfoNewModel (isa, 0x1a10495e02d)

这回很清楚的看到这个广告的内容,再回去看下另一个非广告内容的ivars

(lldb) ivars 0x1746eec00
<NewsInfoNewModel: 0x1746eec00>:
in NewsInfoNewModel:
	_isReaded (BOOL): NO
	_seq (NSString*): @"27016301"
。。。。。。。。
	_label_type (NSString*): @"公告"
	_label_property (NSString*): @""
	_label_article (NSString*): @""
	_titleLayout (YYTextLayout*): <YYTextLayout: 0x174185140>
	_label_article_ids (NSMutableArray*): <__NSArrayM: 0x1750490f0>
	_label_article_titles (NSMutableArray*): <__NSArrayM: 0x175049f30>
	_ctimeString (NSString*): @"09-14"
in NSObject:
	isa (Class): NewsInfoNewModel (isa, 0x1a10495e02d)

编写插件

在广告的内容中,它的label_type一定显示为“推广”,那么思路就有了,对最开始找到的dataArray搞事情,对它里面的NewsListCellFrameModel对象的属性newsInfo的属性label_type作判断,当它为“推广”时,删掉该NewsListCellFrameModel对象。:

@interface NewsInfoNewModel
{
    NSString *_label_type;
}
@property(copy, nonatomic) NSString *label_type;
@end

@interface NewsListViewController
@property(retain, nonatomic) NSMutableArray *dataArray;
@end

@interface NewsListCellFrameModel 
@property(retain, nonatomic) NewsInfoNewModel *newsInfo;
@end

%hook NewsListViewController
- (NSMutableArray *)dataArray
{
	NSMutableArray *origArr = %orig;
	NSMutableArray *adArr = [NSMutableArray new];
	if(origArr.count > 0)
		for(NewsListCellFrameModel *model in origArr)
		{
			if([MSHookIvar<NSString *>(model.newsInfo, "_label_type") isEqualToString:@"推广"])
				[adArr addObject:model];
		}
	
	if(adArr.count > 0)
		[origArr removeObjectsInArray:adArr];
	
	return origArr;
}
%end
1 Like

lookin 怎么看别人的APP?

lookinloader

这个脚本是好东西哈。

我都用xcode更牛逼