看了颤抖吧，iGrimace！手把手教你hook以root权限运行的App（http://bbs.iosre.com/t/igrimace-hook-root-app/440） 这篇文章 自己搞了依稀NZT 但是把动态链接库添加到/var/tmp/下后，并做了LC_LOAD_DYLIB操作，总是crash，有谁遇到过吗
Incident Identifier: A5E031FD-7523-4E50-BC8C-9D8165F2E5A3
CrashReporter Key: 69c528cbffb67587df1fb9865ea678c04febf1b1
Hardware Model: iPhone5,2
Process: NZT [768]
Path: //private/var/db/stash/_.K39t41/Applications/NZT.app/NZT
Identifier: com.hello.ntz
Version: 8.1.1 (8.1.1)
Code Type: ARM (Native)
Parent Process: launchd [1]
Date/Time: 2016-05-12 00:19:40.421 +0800
Launch Time: 2016-05-12 00:19:40.326 +0800
OS Version: iOS 8.2 (12D508)
Report Version: 105
Exception Type: EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Triggered by Thread: 0
Thread 0 name: Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0 libsystem_kernel.dylib 0x36e6cdf0 __pthread_kill + 8
1 libsystem_pthread.dylib 0x36eeacc2 pthread_kill + 58
2 libsystem_c.dylib 0x36e08904 abort + 72
3 libsystem_malloc.dylib 0x36e9632c free + 392
4 NZT 0x00062834 0x58000 + 43060
5 libdyld.dylib 0x36da2aac start + 0
Thread 0 crashed with ARM Thread State (32-bit):
r0: 0x00000000 r1: 0x00000000 r2: 0x00000000 r3: 0x00000000
r4: 0x00000006 r5: 0x3987e9dc r6: 0x00000000 r7: 0x006b7b78
r8: 0x00000002 r9: 0x00000001 r10: 0x006fb000 r11: 0x006bb3e1
ip: 0x00000148 sp: 0x006b7b6c lr: 0x36eeacc7 pc: 0x36e6cdf0
cpsr: 0x00000010
Binary Images:
0x58000 - 0x57bfff NZT armv7 /var/db/stash/_.K39t41/Applications/NZT.app/NZT
0x6b8000 - 0x6b8fff gjzhello.dylib armv7 /var/tmp/gjzhello.dylib
0x6bb000 - 0x6d2fff CydiaSubstrate armv7 /Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate
0x1febd000 - 0x1fee0fff dyld armv7s /usr/lib/dyld
0x27410000 - 0x2757cfff AVFoundation armv7s <339e734775eb39b982ec0c089a752320> /System/Library/Frameworks/AVFoundation.framework/AVFoundation
0x2757d000 - 0x275dbfff libAVFAudio.dylib armv7s /System/Library/Frameworks/AVFoundation.framework/libAVFAudio.dylib
0x27615000 - 0x27615fff Accelerate armv7s /System/Library/Frameworks/Accelerate.framework/Accelerate
0x27626000 - 0x27841fff vImage armv7s /System/Library/Frameworks/Accelerate.framework/Frameworks/vImage.framework/vImage
0x27842000 - 0x27928fff libBLAS.dylib armv7s <153f3233991f3c47b762ef1743c32e0a> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libBLAS.dylib
0x27929000 - 0x27bedfff libLAPACK.dylib armv7s /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libLAPACK.dylib
0x27bee000 - 0x27bfffff libLinearAlgebra.dylib armv7s <1ea6ed99c4863d4085eb884e9a616903> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libLinearAlgebra.dylib
0x27c00000 - 0x27c7cfff libvDSP.dylib armv7s <708711e55e7c3d67a44ca33803d225af> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libvDSP.dylib
0x27c7d000 - 0x27c8ffff libvMisc.dylib armv7s <3c7e8723a7233076a6a0ff239e4c58eb> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/libvMisc.dylib
0x27c90000 - 0x27c90fff vecLib armv7s <0a8061e9131332f28e903a478d0b6e36> /System/Library/Frameworks/Accelerate.framework/Frameworks/vecLib.framework/vecLib
0x27c91000 - 0x27cb8fff Accounts armv7s <09f1e91f2f903f0d9e91ea22c584cfba> /System/Library/Frameworks/Accounts.framework/Accounts
0x27cba000 - 0x27d28fff AddressBook armv7s /System/Library/Frameworks/AddressBook.framework/AddressBook
0x27d29000 - 0x27e52fff AddressBookUI armv7s <4a01e230f037317d82a10b210d2a292a> /System/Library/Frameworks/AddressBookUI.framework/AddressBookUI
0x27feb000 - 0x2825ffff AudioToolbox armv7s /System/Library/Frameworks/AudioToolbox.framework/AudioToolbox