很简单一段代码:
#import <substrate.h>
extern "C" CFTypeRef MGCopyAnswer(CFStringRef);
MSHook(CFTypeRef, MGCopyAnswer, CFStringRef key)
{
return _MGCopyAnswer(key);
}
%ctor
{
NSString *appID = [[NSBundle mainBundle] bundleIdentifier];
if ( appID && [appID isEqualToString:@"com.test.test"]) //这里的ID是演示用的,可自己修改成目标进程ID
{
NSLog(@"[test] %@ 开始, IOS版本: %.1f...", appID, kCFCoreFoundationVersionNumber);
MSHookFunction(MGCopyAnswer, MSHake(MGCopyAnswer));
}
}
MAKEFILE:
ARCHS = armv7 armv7s arm64
TARGET = iphone:latest:8.0
test2_FRAMEWORKS = UIKit
include theos/makefiles/common.mk
TWEAK_NAME = test2
test2_FILES = Tweak.xm
test2_LIBRARIES = MobileGestalt
include $(THEOS_MAKE_PATH)/tweak.mk
after-install::
install.exec "killall -9 SpringBoard"
不管在7系统还是8系统上面必然闪退,注释掉 MSHookFunction(MGCopyAnswer, MSHake(MGCopyAnswer)); 就没事了,求解~
附上崩溃日志:
Version: 1.44 (1.4)
Code Type: ARM-64 (Native)
Parent Process: launchd [1]
Date/Time: 2016-04-25 01:09:31.810 +0800
Launch Time: 2016-04-25 01:09:31.564 +0800
OS Version: iOS 8.3 (12F70)
Report Version: 105
Exception Type: EXC_BAD_INSTRUCTION (SIGILL)
Exception Codes: 0x0000000000000001, 0x000000000068fe68
Triggered by Thread: 0
Thread 0 name: Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0 libMobileGestalt.dylib 0x0000000195af7e84 0x195af4000 + 16004
1 libMobileGestalt.dylib 0x0000000195af82bc MGGetBoolAnswer + 32
2 AppSupport 0x000000018b020594 __CPIsInternalDevice_block_invoke + 16
3 libdispatch.dylib 0x0000000196c99950 _dispatch_client_callout + 12
4 libdispatch.dylib 0x0000000196c9a828 dispatch_once_f + 92
5 AppSupport 0x000000018b02057c CPIsInternalDevice + 60
6 UIKit 0x0000000189b58750 ___UIApplicationUsesAlternateUI_block_invoke + 12
7 libdispatch.dylib 0x0000000196c99950 _dispatch_client_callout + 12
8 libdispatch.dylib 0x0000000196c9a828 dispatch_once_f + 92
9 UIKit 0x0000000189923750 UIApplicationInitialize + 1872
10 UIKit 0x0000000189922b1c UIApplicationMain + 320
没有.
只发现在64位上面会这样, 32位没问题.
artkai
(artkai)
5
我也遇到同样的问题了,同求~!好像不是64位的问题,是8.3系统的问题,我在8.1系统上是成功的
你直接hook函数是有问题的,换一种方法就可以了。。。
gjzw
(gjzw)
10
我这边倒可以 hook没问题,你的是不是注入方式有问题
应该是64位的问题,我看了一下64位的privateframework,是存在MGCopyAnswer的
请问有人解决了吗?
我也遇到了这个问题,根据报错堆栈,又hook了MGGetBoolAnswer
之后不会再报这个错误,但是有其他的崩溃