OPlayer Lite 最新去广告

OPlayer Lite 最新去广告

问问题： http://bbs.iosre.com/forum.php?mod=viewthread&tid=707&page=1&extra=#pid3881

lldb 命令 ： http://objccn.io/issue-19-2/

列举目录：~~~~~~~~~~~~~
cy#

[[NSFileManager defaultManager] URLsForDirectory:NSDocumentDirectory inDomains:NSUserDomainMask][0]

#"file:///var/mobile/Containers/Data/Application/235BFE91-3A0F-4728-9AEB-CCB321D30E92/Documents/"


Panda-iphone:/var/mobile/Containers/Data/Application/235BFE91-3A0F-4728-9AEB-CCB321D30E92/Documents root#
脱壳~~~~~~~~~~~~~~~~~~~~~~~~~~
DYLD_INSERT_LIBRARIES=dumpdecrypted7.dylib /var/mobile/Containers/Bundle/Application/EA468FAA-CC33-4BF7-B6B1-4F933CA4D7A2/OPlayer\ Lite.app/OPlayer\ Lite

\mach-o decryption dumper
DISCLAIMER: This tool is only meant for security research purposes, not for application crackers.

[+] detected 32bit ARM binary in memory.
[+] offset to cryptid found: @0x4abc(from 0x4000) = abc
[+] Found encrypted data at address 00004000 of length 23592960 bytes - type 1.
[+] Opening /private/var/mobile/Containers/Bundle/Application/EA468FAA-CC33-4BF7-B6B1-4F933CA4D7A2/OPlayer Lite.app/OPlayer Lite for reading.
[+] Reading header
[+] Detecting header type
[+] Executable is a plain MACH-O image
[+] Opening OPlayer Lite.decrypted for writing.
[+] Copying the not encrypted start of the file
[+] Dumping the decrypted data into the file
[+] Copying the not encrypted remainder of the file
[+] Setting the LC_ENCRYPTION_INFO→cryptid to 0 at offset abc
[+] Closing original file
[+] Closing dump file

class-dump -H -I xxx -o xxx.h

搜索广告类 ADBannerView
PlayViewController.h

#import "ADBannerViewDelegate.h"
#import "GADBannerViewDelegate.h"

@class ADBannerView, AVAssetReader, AVPlayer, AVPlayerDemoPlaybackView,
AVPlayerItem, FloatingView, GADBannerView, HTTPServer, InfoViewController,
MPVolumeView, NSDictionary, NSMutableArray, NSString, NSTimer, NSURL,
OSMusicMetaInfo, OSPlayerHelper, PlaySeekView, PlayerView, RoundedRectView,
SubtitleLabel, UIActivityIndicatorView, UIButton, UIImage, UIImageView, UILabel,
UINavigationController, UIView, WBEngine;

__attribute__((visibility("hidden")))
@interface PlayViewController : UIViewController 
{
    ADBannerView *iAdView;
    GADBannerView *gAdView;
    ····
}
    @property(retain, nonatomic) ADBannerView *iAdView; // @synthesize iAdView;

查看某个类的 属性在哪里~~~~~
cy# [[UIWindow keyWindow] recursiveDescription] 也可以直接 reveal 查看


检测 dylib 版本信息~~~~
1）➜ DynamicLibraries lipo -info OPlayer.dylib
Non-fat file: OPlayer.dylib is architecture: arm64


2）➜ DynamicLibraries file OPlayer.dylib
OPlayer.dylib: Mach-O 64-bit dynamically linked shared library

3）snakeninnys-MacBook:~ snakeninny$ otool -h /Users/snakeninny/Code/SMSNinja（bigboss）/SMSNinjaNow/layout/Library/MobileSubstrate/DynamicLibraries/libsmsninja.dylib 
/Users/snakeninny/Code/SMSNinja（bigboss）/SMSNinjaNow/layout/Library/MobileSubstrate/DynamicLibraries/libsmsninja.dylib (architecture armv7):
Mach header
      magic cputype cpusubtype  caps    filetype ncmds sizeofcmds      flags
 0xfeedface      12          9  0x00          6    27       3336 0x00100085
/Users/snakeninny/Code/SMSNinja（bigboss）/SMSNinjaNow/layout/Library/MobileSubstrate/DynamicLibraries/libsmsninja.dylib (architecture arm64):
Mach header
      magic cputype cpusubtype  caps    filetype ncmds sizeofcmds      flags
 0xfeedfacf 16777228          0  0x00          6    29       3920 0x00100085

armv7和armv7s的指令长度都是32位，可以混用，但arm64指令长度是64位，不能与32位指令混用
➜ DynamicLibraries otool -h OPlayer.dylib
OPlayer.dylib:
Mach header
 magic cputype cpusubtype caps filetype ncmds sizeofcmds flags
0xfeedfacf 16777228 0 0x00 6 23 2296 0x00100085
如果有64位的版本，magic应该是0xfeedfacf
不是64位就是 0xfeedface

描述arm7/7s/64 的关系
Jan 12 18:20:15 Panda-iphone OPlayer Lite[5050]: MS:Error: dlopen(/Library/MobileSubstrate/DynamicLibraries/OPlayer.dylib, 9): no suitable image found. Did find:
/Library/MobileSubstrate/DynamicLibraries/OPlayer.dylib: mach-o, but wrong architecture

这一句的意思就是你的dylib指令集不对。这应该是因为OPlayer Lite的指令集是armv7/7s，而你的dyllib是arm64，指令集不能混用造成的。你把ARCHS里多加一个armv7，然后重新试试，应该就可以了

刚开始 是测试 ADBannerView 的iAdView 对象在哪里

#import 

@interface PlayViewController : UIViewController
@property(retain, nonatomic) ADBannerView *iAdView; // @synthesize iAdView;
@end


%hook ADBannerView
- (void)bannerViewDidLoadAd:(ADBannerView *)arg1
{
    %orig;
    NSLog(@"123321bannerViewDidLoadAd_arg1:%@",arg1);//has not to execute
}
%end

%hook PlayViewController
- (void)viewDidLoad
{
    %orig;
    NSLog(@"123321viewDidLoadAdView:%@",self.iAdView);

    id gAdView = MSHookIvar(self,"gAdView");//检测存在
    NSLog(@"123321viewDidLoadgAdView:%@",gAdView);
}
%end
·········································
{ Filter = { Bundles = ( "com.olimsoft.oplayer.lite" ); }; }
·········································
THEOS_DEVICE_IP = 127.0.0.1
THEOS_DEVICE_PORT = 2222
ARCHS = armv7
TARGET = iPhone:8.1

include theos/makefiles/common.mk

TWEAK_NAME = OPlayer
OPlayer_FILES = Tweak.xm
OPlayer_FRAMEWORKS = UIKit iAd

include $(THEOS_MAKE_PATH)/tweak.mk

after-install::
    install.exec "killall -9 OPlayer\ Lite"
·········································
Panda-iphone:~ root# grep 123321 /var/log/syslog
Jan 20 00:00:59 Panda-iphone OPlayer Lite[691]: 123321viewDidLoadAdView:(null)
Jan 20 00:00:59 Panda-iphone OPlayer Lite[691]: 123321viewDidLoadgAdView:(null)

换函数 HOOK planAds ~~~~~~~~~~~~~~~ 可以IDA 去搜索

#import 

@interface PlayViewController : UIViewController
@property(retain, nonatomic) ADBannerView *iAdView; // @synthesize iAdView;
@end

@interface GADBannerView : UIView
@end
%hook PlayViewController
- (void)viewDidLoad
{
    %orig;
    NSLog(@"123321viewDidLoadAdView:%@",self.iAdView);//检测存在 to be null

    id gAdView = MSHookIvar(self,"gAdView");//检测存在 to be null
    NSLog(@"123321viewDidLoadgAdView:%@",gAdView);
}
- (void)planAds
{
        %orig;
    NSLog(@"123321planAds_iAdView:%@",self.iAdView);//

    id gAdView = MSHookIvar(self,"gAdView");//
    NSLog(@"123321planAds_gAdView:%@",gAdView);
}
%end
·········································
Jan 20 00:24:27 Panda-iphone OPlayer Lite[980]: 123321viewDidLoadAdView:(null)
Jan 20 00:24:27 Panda-iphone OPlayer Lite[980]: 123321viewDidLoadgAdView:(null)
Jan 20 00:24:27 Panda-iphone OPlayer Lite[980]: 123321planAds_iAdView:(null)
Jan 20 00:24:27 Panda-iphone OPlayer Lite[980]: 123321planAds_gAdView:>

隐藏函数：

#import 

@interface PlayViewController : UIViewController
@property(retain, nonatomic) ADBannerView *iAdView; // @synthesize iAdView;
@property(retain, nonatomic) UIView *localAdView; // @synthesize localAdView;
@end

@interface GADBannerView : UIView
@end


%hook PlayViewController
- (void)viewDidLoad
{
    %orig;
    NSLog(@"123321viewDidLoad_iAdView:%@",self.iAdView);//检测存在 to be null

    NSLog(@"123321viewDidLoad_localAdView:%@",self.localAdView);//检测存在 to be null

    id gAdView = MSHookIvar(self,"gAdView");//检测存在 to be null
    NSLog(@"123321viewDidLoad_gAdView:%@",gAdView);
}
- (void)planAds
{
        %orig;
        NSLog(@"123321planAds_iAdView:%@",self.iAdView);//检测存在 to be null

 NSLog(@"123321planAds_localAdView:%@",self.localAdView);//检测存在 not to be null
self.localAdView.hidden =YES;
    GADBannerView * gAdView = MSHookIvar(self,"gAdView");//检测存在 not be null
    NSLog(@"123321planAds_gAdView:%@",gAdView);
    gAdView.hidden = YES;
}
%end
·········································
Jan 20 00:38:16 Panda-iphone OPlayer Lite[1402]: 123321viewDidLoad_iAdView:(null)
Jan 20 00:38:16 Panda-iphone OPlayer Lite[1402]: 123321viewDidLoad_localAdView:(null)
Jan 20 00:38:16 Panda-iphone OPlayer Lite[1402]: 123321viewDidLoad_gAdView:(null)
Jan 20 00:38:16 Panda-iphone OPlayer Lite[1402]: 123321planAds_iAdView:(null)
Jan 20 00:38:16 Panda-iphone OPlayer Lite[1402]: 123321planAds_localAdView:>
Jan 20 00:38:16 Panda-iphone OPlayer Lite[1402]: 123321planAds_gAdView:>

看看 是谁 调用的gAdView setDelegate:self 也就是 [GADBannerView delegate]
IDA 找到 下断 走过函数看看~~~~

__text:000F0AF0     ; void __cdecl -[GADBannerView setDelegate:](struct GADBannerView *self, SEL, id)
__text:000F0AF0     __GADBannerView_setDelegate__           ; DATA XREF: __objc_const:017A0048o
__text:000F0AF0
__text:000F0AF0     var_10          = -0x10
__text:000F0AF0
__text:000F0AF0 000                 STMFD           SP!, {R4-R7,LR}
__text:000F0AF4 014                 ADD             R7, SP, #0xC
__text:000F0AF8 014                 STR             R8, [SP,#0xC+var_10]!
__text:000F0AFC 018                 MOV             R5, #(:lower16:(selRef_slot - 0xF0B14))
__text:000F0B00 018                 MOV             R8, R0
__text:000F0B04 018                 MOVT            R5, #(:upper16:(selRef_slot - 0xF0B14))
__text:000F0B08 018                 MOV             R0, R2
__text:000F0B0C 018                 LDR             R5, [PC,R5] ; selRef_slot ; "slot"
__text:000F0B10 018                 BL              _objc_retain
__text:000F0B10
__text:000F0B14 018                 MOV             R6, R0
__text:000F0B18 018                 MOV             R0, R8
__text:000F0B1C 018                 MOV             R1, R5
__text:000F0B20 018                 BL              _objc_msgSend
__text:000F0B20
__text:000F0B24 018                 MOV             R7, R7
__text:000F0B28 018                 BL              _objc_retainAutoreleasedReturnValue
__text:000F0B28
__text:000F0B2C 018                 MOV             R1, #(:lower16:(selRef_delegateManager - 0xF0B40))
__text:000F0B30 018                 MOV             R5, R0
__text:000F0B34 018                 MOVT            R1, #(:upper16:(selRef_delegateManager - 0xF0B40))
__text:000F0B38 018                 LDR             R1, [PC,R1] ; selRef_delegateManager ; "delegateManager"
__text:000F0B3C 018                 BL              _objc_msgSend
__text:000F0B3C
__text:000F0B40 018                 MOV             R7, R7
__text:000F0B44 018                 BL              _objc_retainAutoreleasedReturnValue
__text:000F0B44
__text:000F0B48 018                 MOV             R1, #(:lower16:(selRef_setBannerDelegate_ - 0xF0B60))
__text:000F0B4C 018                 MOV             R2, R6
__text:000F0B50 018                 MOVT            R1, #(:upper16:(selRef_setBannerDelegate_ - 0xF0B60))
__text:000F0B54 018                 MOV             R4, R0
__text:000F0B58 018                 LDR             R1, [PC,R1] ; selRef_setBannerDelegate_ ; "setBannerDelegate:"
__text:000F0B5C 018                 BL              _objc_msgSend
__text:000F0B5C
__text:000F0B60 018                 MOV             R0, R6
__text:000F0B64 018                 BL              _objc_release
__text:000F0B64
__text:000F0B68 018                 MOV             R0, R4
__text:000F0B6C 018                 BL              _objc_release
__text:000F0B6C
__text:000F0B70 018                 MOV             R0, R5
__text:000F0B74 018                 BL              _objc_release
__text:000F0B74
__text:000F0B78 018                 MOV             R1, #(:lower16:(selRef_slot - 0xF0B8C))
__text:000F0B7C 018                 MOV             R0, R8
__text:000F0B80 018                 MOVT            R1, #(:upper16:(selRef_slot - 0xF0B8C))
__text:000F0B84 018                 LDR             R1, [PC,R1] ; selRef_slot ; "slot"
__text:000F0B88 018                 BL              _objc_msgSend
__text:000F0B88
__text:000F0B8C 018                 MOV             R7, R7
__text:000F0B90 018                 BL              _objc_retainAutoreleasedReturnValue
__text:000F0B90
__text:000F0B94 018                 MOV             R1, #(:lower16:(selRef_delegateManager - 0xF0BA8))
__text:000F0B98 018                 MOV             R4, R0
__text:000F0B9C 018                 MOVT            R1, #(:upper16:(selRef_delegateManager - 0xF0BA8))
__text:000F0BA0 018                 LDR             R1, [PC,R1] ; selRef_delegateManager ; "delegateManager"
__text:000F0BA4 018                 BL              _objc_msgSend
__text:000F0BA4
__text:000F0BA8 018                 MOV             R7, R7
__text:000F0BAC 018                 BL              _objc_retainAutoreleasedReturnValue
__text:000F0BAC
__text:000F0BB0 018                 MOV             R1, #(:lower16:(selRef_setAdView_ - 0xF0BC8))
__text:000F0BB4 018                 MOV             R2, R8
__text:000F0BB8 018                 MOVT            R1, #(:upper16:(selRef_setAdView_ - 0xF0BC8))
__text:000F0BBC 018                 MOV             R5, R0
__text:000F0BC0 018                 LDR             R1, [PC,R1] ; selRef_setAdView_ ; "setAdView:"
__text:000F0BC4 018                 BL              _objc_msgSend
__text:000F0BC4
__text:000F0BC8 018                 MOV             R0, R5
__text:000F0BCC 018                 BL              _objc_release
__text:000F0BCC
__text:000F0BD0 018                 MOV             R0, R4
__text:000F0BD4 018                 LDR             R8, [SP+0x10+var_10],#4
__text:000F0BD8 014                 LDMFD           SP!, {R4-R7,LR}
__text:000F0BDC 000                 B               _objc_release
__text:000F0BDC
__text:000F0BDC     ; End of function -[GADBannerView setDelegate:]

Panda-iphone:~ root# debugserver *:1234 -a 1657

➜ panda lldb
(lldb) process connect connect://localhost:1234

error: unable to find section for section 35
error: unable to find section for section 35
error: unable to find section for section 34
error: unable to find section for section 33 等很久~~~~~但不影响调试


(lldb) image list -o -f
[ 0] 0x00000000 /private/var/mobile/Containers/Bundle/Application/EA468FAA-CC33-4BF7-B6B1-4F933CA4D7A2/OPlayer Lite.app/OPlayer Lite(0x0000000000004000)
[ 1] 0x02540000 /Library/MobileSubstrate/MobileSubstrate.dylib(0x0000000002540000)
[ 2] 0x0a788000 /usr/lib/libbz2.1.0.dylib(0x000000003916b000)
[ 3] 0x0a788000 /usr/lib/libSystem.B.dylib(0x0000000038f46000)


1） 在函数末尾 000F0BDC下断，

000F0BDC + 0x00000000 =000F0BDC
(lldb) ni
Process 2525 stopped
* thread #1: tid = 0x13f6c, 0x000f0bdc OPlayer Lite`� + 2795, queue = 'com.apple.main-thread', stop reason = instruction step over
    frame #0: 0x000f0bdc OPlayer Lite`� + 2795
OPlayer Lite`� + 2795:
-> 0xf0bdc:  b      0x1365bc4
   0xf0be0:  push   {r4, r5, r6, r7, lr}
   0xf0be4:  movw   r1, #0x4b8c
   0xf0be8:  add    r7, sp, #0xc
(lldb) finish
Process 2525 stopped
* thread #1: tid = 0x13f6c, 0x002bcde0 OPlayer Lite, queue = 'com.apple.main-thread', stop reason = step out
    frame #0: 0x002bcde0 OPlayer Lite
OPlayer Lite` + 246184:
-> 0x2bcde0:  movw   r0, #0x6fa2
   0x2bcde4:  movs   r2, #0x0
   0x2bcde6:  movt   r0, #0x154
   0x2bcdea:  add    r0, pc

执行finish 可以找到调用者
-[PlayViewController planAds]


2）在函数头部 查看 sp 查找 LR 保存的时返回地址
(lldb) x/1x -c 90 0x0253e974
0x0253e974: 0x43a00000 0x42480000 0x0dc4edb0 0x00000000
0x0253e984: 0x0dc465a0 0x0253e994 0x398a7621 0x3a1e7e60
0x0253e994: 0x0253e9bc 0x2bfd51c5 0x0dc4edb0 0x3a1e8900
0x0253e9a4: 0x00000288 0x3c2cf600 0x3c2cf880 0x0dc4edb0
0x0253e9b4: 0x00000001 0xf23b1250 0x0253e9f0 0x398b8d5f
0x0253e9c4: 0x00000001 0xf23b1250 0xf23b1250 0x028ec400
0x0253e9d4: 0x028ec400 0x0dc4edb0 0x0dc51250 0x00000004
0x0253e9e4: 0x08233f60 0x0825ce80 0x00000004 0x00000000
0x0253e9f4: 0x00000000 0x01810258 0x00000000 0x0180bfb4
0x0253ea04: 0x03010a00 0x2fd185ee 0x000001fc 0x0253eaa8
0x0253ea14: 0x002a7e51 0x43a00000 0x42480000 0x0253ea28
0x0253ea24: 0x2f575193 0x0253ea38 0x000002e4 0x0253eabc
0x0253ea34: 0x2fd2622b 0x0253ea4c 0x4cc6d004 0x00000000
0x0253ea44: 0x00000000 0x00000001 0x00000000 0x3a836a94
0x0253ea54: 0x3a83b3bc 0x2fd4513e 0x2f862a5d 0x0253ea74
0x0253ea64: 0x398a4f1b 0x00000001 0x00000001 0x0000009c
0x0253ea74: 0x0253ea84 0x3989dab3 0x00000001 0x00000001
0x0253ea84: 0x0253ea98 0x00000000 0x00000000 0x0000009c
0x0253ea94: 0x00000001 0x3a836a94 0x03010a00 0x00000001
0x0253eaa4: 0x00000400 0x0253eaf8 0x2f58f51b 0x0dc51250
0x0253eab4: 0x00000000 0x00000001 0x3c30905c 0xc2000000
0x0253eac4: 0x00000000 0x2f61f909 0x4cc6d004 0x08097c60
0x0253ead4: 0x0253ebbc 0x0828a2e0


[Image: https://quip.com/-/blob/d_fRgFtzXSlFrIQBAypiSw] http://clang.llvm.org/docs/AutomaticReferenceCounting.html#arc-runtime-objc-retainautoreleasedreturnvalue
说明

id objc_retainAutoreleasedReturnValue(id value);

Always returns value.

__text:000F1738 ; void __cdecl -[GADBannerView loadRequest:](struct GADBannerView *self, SEL, id)
__text:000F1738 __GADBannerView_loadRequest__ ; DATA XREF: __objc_const:017A0144o
__text:000F1738 000 STMFD SP!, {R4-R7,LR}


__text:000F1950 ; GADBannerView - (id)slot
__text:000F1950
__text:000F1950 ; id __cdecl -[GADBannerView slot](struct GADBannerView *self, SEL)
__text:000F1950 __GADBannerView_slot_ ; DATA XREF: __objc_const:017A0168o
__text:000F1950 000 MOV R1, #(_OBJC_IVAR_$_GADBannerView._slot - 0xF1960) ; GADSlot *_slot;
__text:000F1958 000 LDR R1, [PC,R1] ; GADSlot *_slot;
__text:000F195C 000 LDR R0, [R0,R1]
__text:000F1960 000 BX LR

#import 

@interface PlayViewController : UIViewController
@property(retain, nonatomic) ADBannerView *iAdView; // @synthesize iAdView;
@property(retain, nonatomic) UIView *localAdView; // @synthesize localAdView;
@end

@interface GADBannerView : UIView
@end

%hook GADBannerView
-(id)slot
{
    id param = %orig;
    NSLog(@"GADBannerView_slot:%@",param);
    /*
Jan 20 14:34:15 Panda-iphone OPlayer Lite[2704]: GADBannerView_slot:
Jan 20 14:34:15 Panda-iphone OPlayer Lite[2704]: GADBannerView_slot:
    */
    return param;
}
%end

[Image: https://quip.com/-/blob/Pm15Pp2LrSoo5N0zqTBAkg]@interface GADRequestPrivate : GADRequest
+ (id)requestPrivateWithRequest:(id)arg1;

GADSlot loadPrivateRequest:autoRefresh: param1:[GADRequestPrivate requestPrivateWithRequest] param2:0

[Image: https://quip.com/-/blob/AWae2mXCf6Cenv4BDipJuA]分析完毕~~~~~~~现在干掉它

#import 

@interface PlayViewController : UIViewController
@property(retain, nonatomic) ADBannerView *iAdView; // @synthesize iAdView;
@property(retain, nonatomic) UIView *localAdView; // @synthesize localAdView;
@end

@interface GADBannerView : UIView
@end

%hook PlayViewController 
- (void)planAds
{
    NSLog(@"viewDidLoad_localAdView :%@",self.localAdView);
    self.localAdView.hidden=YES;//干掉 localAdView
    return;//干掉planAds函数
}
%end

[Image: https://quip.com/-/blob/w81ux2D6ZUDKaNftAOMdzA]没有广告了~~~~~~~~~