iOS 逆向hook微信

参考资料

分分钟让你在 微信运动 霸占榜首

一步一步实现iOS微信自动抢红包(非越狱)

给微信加 hook 尝试记录

所有需要的文件都已经生成，然后把embedded.mobileprovision 和修改后的WeChat二进制文件拷贝至WeChat.app中替换。cd 到wanggangdeMacBook-Pro:Payload 目录下,

参考图片wechat对应的目录

Snip20160703_26.png

签名成功
//1
codesign -f -s "iPhone Distribution: Wuhan Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" WeChat.app/libautoGetRedEnv.dylib
//2
codesign -f -s "iPhone Distribution: Wuhan Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" WeChat.app/Watch/WeChatWatchNative.app
//3
codesign -f -s "iPhone Distribution: Wuhan Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" WeChat.app/PlugIns/WeChatShareExtensionNew.appex
//4
codesign -f -s "iPhone Distribution: Wuhan Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" WeChat.app/Watch/WeChatWatchNative.app/PlugIns/WeChatWatchNativeExtension.appex


//签名失败
codesign -f -s "iPhone Distribution: Wuhan Master 
HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" --entitlements Entitlements.plist WeChat.app

an Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" --entitlements Entitlements.plist WeChat.app
Entitlements.plist: cannot read entitlement data

wanggangdeMacBook-Pro:Payload wanggang$ codesign -f -s "iPhone Distribution: Wuhan Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" --entitlements Entitlements.plist WeChat.app
Entitlements.plist: cannot read entitlement data

wanggangdeMacBook-Pro:Payload wanggang$ codesign -f -s "iPhone Distribution: Wuhan Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" WeChat.app/Watch/WeChatWatchNative.app/PlugIns/WeChatWatchNativeExtension.appex
WeChat.app/Watch/WeChatWatchNative.app/PlugIns/WeChatWatchNativeExtension.appex: replacing existing signature

wanggangdeMacBook-Pro:Payload wanggang$ codesign -f -s "iPhone Distribution: Wuhan Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" WeChat.app/Watch/WeChatWatchNative.app/PlugIns/WeChatWatchNativeExtension.appex
WeChat.app/Watch/WeChatWatchNative.app/PlugIns/WeChatWatchNativeExtension.appex: replacing existing signature



//
wanggangdeMacBook-Pro:Payload wanggang$ codesign -f -s "iPhone Distribution: Wuhan Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" WeChat.app/Watch/WeChatWatchNative.app/PlugIns/WeChatWatchNativeExtension.appex
WeChat.app/Watch/WeChatWatchNative.app/PlugIns/WeChatWatchNativeExtension.appex: replacing existing signature

//libautoGetRedEnv.dylib 签名成功
wanggangdeMacBook-Pro:Payload wanggang$ codesign -f -s "iPhone Distribution: Wuhan Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" WeChat.app/libautoGetRedEnv.dylib
WeChat.app/libautoGetRedEnv.dylib: replacing existing signature

//签名成功
wanggangdeMacBook-Pro:Payload wanggang$ codesign -f -s "iPhone Distribution: Wuhan Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" WeChat.app/Watch/WeChatWatchNative.app
WeChat.app/Watch/WeChatWatchNative.app: replacing existing signature

//appnex签名成功
wanggangdeMacBook-Pro:Payload wanggang$ codesign -f -s "iPhone Distribution: Wuhan Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" WeChat.app/PlugIns/WeChatShareExtensionNew.appex
WeChat.app/PlugIns/WeChatShareExtensionNew.appex: replacing existing signature

//签名成功
wanggangdeMacBook-Pro:Payload wanggang$ codesign -f -s "iPhone Distribution: Wuhan Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" WeChat.app/Watch/WeChatWatchNative.app/PlugIns/WeChatWatchNativeExtension.appex
WeChat.app/Watch/WeChatWatchNative.app/PlugIns/WeChatWatchNativeExtension.appex: replacing existing signature

//签名成功
wanggangdeMacBook-Pro:Payload wanggang$ codesign -f -s "iPhone Distribution: Wuhan Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" WeChat.app/Watch/WeChatWatchNative.app/PlugIns/WeChatWatchNativeExtension.appex
WeChat.app/Watch/WeChatWatchNative.app/PlugIns/WeChatWatchNativeExtension.appex: replacing existing signature



//实体添加失败
wanggangdeMacBook-Pro:Payload wanggang$ codesign -f -s "iPhone Distribution: Wuhan Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" --entitlements Entitlements.plist WeChat.app
Entitlements.plist: cannot read entitlement data
//** Entitlements.plist千万不要放到wechat.app中,和wechat.app同一级目录下面**

//实体签名成功
wanggangdeMacBook-Pro:Payload wanggang$ codesign -f -s "iPhone Distribution: Wuhan Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" --entitlements Entitlements.plist WeChat.app
WeChat.app: replacing existing signature
wanggangdeMacBook-Pro:Payload wanggang$ 

wanggangdeMacBook-Pro:Payload wanggang$ codesign -f -s "iPhone Distribution: Wuhan Master HealthCare Science And Technology Co. ,Ltd. (WKXVLUH7Q6)" --entitlements Entitlements.plist WeChat.app

//打包生成ipa

xcrun -sdk iphoneos PackageApplication -v WeChat.app  -o ~/WeChat.ipa

//签名结果
....
.....
  adding: Payload/WeChat.app/zh_TW.lproj/InfoPlist.strings  (in=955) (out=621) (deflated 35%)
  adding: Payload/WeChat.app/zh_TW.lproj/mm.strings     (in=323020) (out=148686) (deflated 54%)
  adding: Payload/WeChat.app/zh_TW.lproj/network_setting.html   (in=1819) (out=926) (deflated 49%)
total bytes=89940114, compressed=41865331 -> 53% savings
]
Results at '/Users/wanggang/WeChat.ipa' 
wanggangdeMacBook-Pro:Payload wanggang$ 

最后安装失败居然是AppSync 没有安装