本人从cydia上下载安装了一个软件,然后用MachOView分析了其可执行文件,发现有__RESTRICT/__restrict
这个标志,然后参考这个帖子用insert_dylib工具修改让其可执行文件加入load我自己编写的tweak插件ww.dylib 并且把其签名也给干掉了,最后再用dpkg重新打包安装到手机上,发现总是闪退,我的tweak编写如下:
%hook NSArray
- (id)objectAtIndex:(NSUInteger)index {
NSLog((@"--------------%s [Line %d] "), __PRETTY_FUNCTION__, __LINE__);
%orig;
}
%end
%hook AppDelegate
- (BOOL)application:(id)arg1 didFinishLaunchingWithOptions:(id)arg2 {
NSLog(@"0000000000000000------");
%orig;
}
%end
然后错误日志如下:
Oct 28 14:38:46 iPod-touch locationd[197] <Notice>: Gesture EnabledForTopCLient: 0, EnabledInDaemonSettings: 0
Oct 28 14:38:46 iPod-touch WXAssistant[1925] <Error>: assertion failed: 12F69: libxpc.dylib + 51923 [89A85F22-6D73-33D8-9D7A-FCF58D58C58E]: 0x7d
Oct 28 14:38:46 iPod-touch Unknown[1925] <Error>:
Oct 28 14:38:46 iPod-touch WXAssistant[1925] <Warning>: 0000000000000000------
Oct 28 14:38:46 iPod-touch WXAssistant[1925] <Warning>: (
)
Oct 28 14:38:46 iPod-touch WXAssistant[1925] <Error>: *** Terminating app due to uncaught exception 'NSRangeException', reason: '*** -[__NSArrayM objectAtIndex:]: index 2 beyond bounds for empty array'
*** First throw call stack:
(0x2bcf9137 0x39c55c77 0x2bc0afc7 0x622e9 0x61a61 0x3a1bfc6f 0x3a1ce08f 0x6192b 0x5d167 0x2f39eed5 0x2f59548b 0x2f597b2f 0x2f5a2809 0x2f5962e7 0x32792ec1 0x2bcbf255 0x2bcbe519 0x2bcbd073 0x2bc089a1 0x2bc087b3 0x2f398ab7 0x2f393695 0x7dfbb 0x3a1fdaaf)
Oct 28 14:38:46 iPod-touch ReportCrash[1927] <Notice>: MS:Notice: Injecting: (null) [ReportCrash] (1144.17)
Oct 28 14:38:46 iPod-touch ReportCrash[1927] <Notice>: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/ww.dylib
Oct 28 14:38:46 iPod-touch ReportCrash[1927] <Warning>: MS:Warning: nil class argument for selector application:didFinishLaunchingWithOptions:
Oct 28 14:38:47 iPod-touch ReportCrash[1927] <Notice>: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/wxhelperyunlswitch.dylib
Oct 28 14:38:47 iPod-touch ReportCrash[1927] <Warning>: MS:Warning: nil class argument for selector applicationDidBecomeActive:
Oct 28 14:38:47 iPod-touch ReportCrash[1927] <Warning>: MS:Warning: nil class argument for selector viewDidAppear:
Oct 28 14:38:47 iPod-touch ReportCrash[1927] <Warning>: MS:Warning: nil class argument for selector viewDidAppear:
Oct 28 14:38:47 iPod-touch ReportCrash[1927] <Warning>: MS:Warning: nil class argument for selector viewDidAppear:
Oct 28 14:38:47 iPod-touch ReportCrash[1927] <Warning>: MS:Warning: nil class argument for selector viewDidAppear:
Oct 28 14:38:47 iPod-touch ReportCrash[1927] <Warning>: MS:Warning: nil class argument for selector viewDidAppear:
didFinishLaunchingWithOptions中的那条log都打印出来了,但针对于NSArray的objectAtIndex却始终没有被执行到,因为这里日志总报数组超界,很莫名其妙
作用的plist文件如下:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Filter</key>
<dict>
<key>Mode</key>
<string>Any</string>
<key>Bundles</key>
<array>
<string>com.whe.vsharesinecis11</string>
<string>com.yunlian.wxassistant</string>
</array>
<key>Classes</key>
<array>
<string>NSArray</string>
</array>
</dict>
</dict>
</plist>
望大神指教!!!!!!!!!