iOS逆向之深入解析Theos开发插件如何使用

一、Logos 语法

• Logos 作为 Theos 开发组件的一部分，通过一组特殊的预处理指令，可以让编写函数钩子（hook）代码变得非常简单和清晰，Logos 是随着 Theos 发布的。
• %hook 指定需要 hook 的类名，以 %end 结尾。
• %log 用来打印 log，将信息输入到 syslog 中，如 %log((NSString *)@“ZeluLi”)。
• %orig 执行被 hook 函数的原始代码，类似于 super.method 功能。
• %group 该指令用于 %hook 的分组，%group 后边跟的是组名，%group 也是必须以 %end 结尾，其中可以包含多个 %hook。
• %init 该指令用来初始化某个 %group，一个 group 只有被初始化后才可生效，init 必须在 hook 中进行执行。
• %ctor tweak 的构造器，用来初始化，如果不显式定义，Theos 就会自动生成一个%ctor，并在其中调用 %init(_ungrouped)，如：%ctor { %init(_ungrouped)}。
• %new 该指令用来给现有的 class 添加一个新的函数，与 Runtime 中的 class_addMethod 相同。
• %c 该指令用来获取一个类的名称，相当于 objc_getClass。

二、工程目录下文件

• 新建工程的命令：$THEOS/bin/nic.pl：

devzkndeMacBook-Pro:~ devzkn$ $THEOS/bin/nic.pl
NIC 2.0 - New Instance Creator
------------------------------
  [1.] iphone/activator_event
  [2.] iphone/application_modern
  [3.] iphone/cydget
  [4.] iphone/flipswitch_switch
  [5.] iphone/framework
  [6.] iphone/ios7_notification_center_widget
  [7.] iphone/library
  [8.] iphone/notification_center_widget
  [9.] iphone/preference_bundle_modern
  [10.] iphone/tool
  [11.] iphone/tweak
  [12.] iphone/xpc_service
Choose a Template (required): 11
Project Name (required): testTweakDemo
Package Name [com.yourcompany.testtweakdemo]: 
Author/Maintainer Name [devzkn]: 
[iphone/tweak] MobileSubstrate Bundle filter [com.apple.springboard]: com.apple.UIKit
[iphone/tweak] List of applications to terminate upon installation (space-separated, '-' for none) [SpringBoard]: 
Instantiating iphone/tweak in testtweakdemo/...
Done.

• 说明：
• • 参数 Package Name：deb包的名字；
• • 参数 Bundle filter：tweak 的目标 app 的 bundle identifier，比如 wechat 的 bundle Id :com.tentcent.xin；
• • iOS 系统的桌面应用的 bundle Id：com.apple.springboard tweak 注入到所有的 app，那么 Bundle filter 应该为 com.apple.UIKit。
• 新建一个工程之后，会生成四个文件：control、plist、Makefile、Tweak.xm，这几个文件分别有什么用？

$ ls -lrt
total 32
-rw-r--r--  1 devzkn  staff    51 Aug 10 17:07 testTweakDemo.plist
-rw-r--r--  1 devzkn  staff   223 Aug 10 17:07 control
-rw-r--r--  1 devzkn  staff  1045 Aug 10 17:07 Tweak.xm
-rw-r--r--  1 devzkn  staff   189 Aug 10 17:07 Makefile

① control 文件

• control 文件存储项目有关的信息：名称、版本、开发者：

Package: com.yourcompany.testtweakdemo
Name: testTweakDemo
Depends: mobilesubstrate
Version: 0.0.1
Architecture: iphoneos-arm
Description: An awesome MobileSubstrate tweak!
Maintainer: devzkn
Author: devzkn
Section: Tweaks

② plist文件

• plist 文件的作用：设置目标 app 的 bundle Id，如果 tweak 要注入多个 APP，就在 Bundles 数组中添加其 bundle Id：

devzkndeMacBook-Pro:testtweakdemo devzkn$ more  testTweakDemo.plist
{
      Filter = {
      Bundles = ( "com.apple.UIKit" ); }; }

③ Makefile 文件

• Makefile 文件设置需要用到的文件、框架、库：

$ more Makefile
include $(THEOS)/makefiles/common.mk

TWEAK_NAME = testTweakDemo
testTweakDemo_FILES = Tweak.xm

include $(THEOS_MAKE_PATH)/tweak.mk

after-install::
        install.exec "killall -9 SpringBoard"
devzkndeMacBook-Pro:testtweakdemo devzkn$

• testTweakDemo_FILES 设置工程需要引用的文件，多个文件之间以空格分隔。格式：工程名FILES = 要编译的文件名：

testTweakDemo_FILES = Tweak.xm MyClass1.m MyClass2.m

• include $(THEOS)/makefiles/common.mk，很多关键的变量都在 common.mk 中。
• 工程名字_FRAMEWORKS : 设置工程需要引用的第三方库，多个库之间以空格分隔：

工程名字_FRAMEWORKS : 设置工程需要引用的第三方库，多个库之间以空格分隔：

• after-install：在 tweak 安装之后，执行的一些辅助任务，比如杀掉目标进程，好让 CydiaSubstrate 在进程重启的过程加载对应的 dylib。

④ Tweak.xm

• 用于编写注入的代码，其中的 %hook,%orig,%log 符合是 theos 对 cydia Substrate 提供的函数的宏封装：

IMP MSHookMessage(Class class, SEL selector, IMP replacement, const char* prefix); // prefix should be NULL.
void MSHookMessageEx(Class class, SEL selector, IMP replacement, IMP *result);
void MSHookFunction(void* function, void* replacement, void** p_original);

• Tweak.xm 的文件名后缀 x 代表的含义：
• • Tweak.xm 的文件名后缀 x 代表支持 Logos 语法， 如果只有一个 x 代表源文件支持 Logos 和 C 语法；如果是 xm，说明源文件支持 Logos 和 C/C++ 语法；
• • 其中的 %hook,%orig,%log 等都是 Logos 语法支持的内容。

$ more  Tweak.xm
/* How to Hook with Logos
Hooks are written with syntax similar to that of an Objective-C @implementation.
You don't need to #include , it will be done automatically, as will
the generation of a class list and an automatic constructor.

%hook ClassName

// Hooking a class method
+ (id)sharedInstance {
        return %orig;
}

// Hooking an instance method with an argument.
- (void)messageName:(int)argument {
        %log; // Write a message about this call, including its class, name and arguments, to the system log.

        %orig; // Call through to the original function with its original arguments.
        %orig(nil); // Call through to the original function with a custom argument.

        // If you use %orig(), you MUST supply all arguments (except for self and _cmd, the automatically generated ones.)
}

// Hooking an instance method with no arguments.
- (id)noArguments {
        %log;
        id awesome = %orig;
        [awesome doSomethingElse];

        return awesome;
}

// Always make sure you clean up after yourself; Not doing so could have grave consequences!
%end
*/

⑤ 编译和安装deb

• 使用命令 make package 编译，其中 packages 文件夹下保留的是每一次编译成功产生的 deb 安装包文件。theos 编译之后，会生成一个 deb 包，deb 安装到手机上面，有多种方式：
• • 通过 iFile 进行安装：使用 iTools 等工具将这个 deb 包拷贝到手机中，利用 iFile 浏览进行安装；
• • 通过 SSH 进行安装：
• • • 需要使用到 openssh 服务，确保手机上已经安装了该服务(cydia 中搜索安装 OpenSSH)，这种安装方式需要在 Makefile 文件的首行添加手机设备的 IP 地址 THEOS_DEVICE_IP = 10.200.201.22 (手机本地 IP)；
• • • 安装的时确保证 iOS 设备和 Mac 在同一局域网的同一网段中，打开终端，先 cd 到工程的目录下，然后输入编译安装命令 make package install；
• • 通过 cydia 源进行安装。

⑥ 免输密码进行 SSH

• 使用 make package install 命令可以一次性完成编译、打包、安装，这个过程中可能需要两次输入 ssh 的 root 密码(一次是签名打包，一次是安装)。
• 创建 rsa文件 : ssh-keygen -t rsa -b 2048 按提示输入存放 keygen 存放的目录和文件名。
• 配置 ssh config：

# Private 192.168.2.125
Host iPhone
HostName  192.168.2.125
User root 
IdentityFile ~/.ssh/id_rsa_Theos125

• 添加对应的公钥到对应的远程服务器 :ssh-copy-i d千万不要把私钥泄漏，只是把公钥（*.pub 文件）复制给远程服务器，ssh-copy-id root@：

ssh-copy-id 指定认证文件$ ssh-copy-id -i id_rsa_Theos125 root@192.168.2.131

$ ssh-copy-id root@192.168.2.212
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/Users/devzkn/.ssh/id_rsa_Theos.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.2.212's password: 

Number of key(s) added:        1

Now try logging into the machine, with:   "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.

三、常见问题

① 压缩方式不被支持

• 原因是 dpkg 有两个不同的版本，最新版本不支持 lzma：

$ make package
> Making all for tweak testTweakDemo…
==> Preprocessing Tweak.xm…
==> Compiling Tweak.xm (armv7)…
==> Linking tweak testTweakDemo (armv7)…
clang: warning: libstdc++ is deprecated; move to libc++ with a minimum deployment target of iOS 7 [-Wdeprecated]
==> Preprocessing Tweak.xm…
==> Compiling Tweak.xm (arm64)…
==> Linking tweak testTweakDemo (arm64)…
clang: warning: libstdc++ is deprecated; move to libc++ with a minimum deployment target of iOS 7 [-Wdeprecated]
==> Merging tweak testTweakDemo…
==> Signing testTweakDemo…
> Making stage for tweak testTweakDemo…
dpkg-deb: error: obsolete compression type 'lzma'; use xz instead

Type dpkg-deb --help for help about manipulating *.deb files;
Type dpkg --help for help about installing and deinstalling packages.
make: *** [internal-package] Error 2

• 解决方案：修改 lzma 为 xz：

$ find /opt/theos -type f -name "*.mk" | xargs grep "lzma"
/opt/theos/makefiles/package/deb.mk:_THEOS_PLATFORM_DPKG_DEB_COMPRESSION ?= lzma

• 修改 /opt/theos/makefiles/package/deb.mk 第六行为_THEOS_PLATFORM_DPKG_DEB_COMPRESSION ?= xz。
• 另外一个办法是直接使用旧版本，命令如下：

Debian 'dpkg' package management program version 1.18.24 (darwin-amd64)

brew switch dpkg 1.18.10
brew link dpkg
brew pin dpkg 1.18.10

• 验证是否修复：

$ make package
> Making all for tweak testTweakDemo…
make[2]: Nothing to be done for `internal-library-compile'.
> Making stage for tweak testTweakDemo…
dpkg-deb: building package 'com.yourcompany.testtweakdemo' in './packages/com.yourcompany.testtweakdemo_0.0.1-2+debug_iphoneos-arm.deb'.

• 另如果只修改为 XZ 的话，届时安装的时候仍会报错：

root@192.168.2.212's password: 
Selecting previously unselected package com.yourcompany.testtweakdemo.
(Reading database ... 1848 files and directories currently installed.)
Preparing to unpack /tmp/_theos_install.deb ...
Unpacking com.yourcompany.testtweakdemo (0.0.1-8+debug) ...
dpkg-deb (subprocess): unable to execute decompressing archive member (xz): No such file or directory
dpkg-deb (subprocess): subprocess decompressing archive member returned error exit status 2
dpkg-deb: error: subprocess <decompress> returned error exit status 2
dpkg: error processing archive /tmp/_theos_install.deb (--install):
 subprocess dpkg-deb --fsys-tarfile returned error exit status 2
Errors were encountered while processing:
 /tmp/_theos_install.deb
make: *** [internal-install] Error 1

• 如果在出现上面错误时是将 lzma->xz 的话，后面可能会出现此错误，解决方法是将 lzma->gzip 即可：

_THEOS_PLATFORM_DPKG_DEB_COMPRESSION ?=gzip

• 验证是否成功：

$ make package install
> Making all for tweak testTweakDemo…
make[2]: Nothing to be done for `internal-library-compile'.
> Making stage for tweak testTweakDemo…
dpkg-deb: building package 'com.yourcompany.testtweakdemo' in './packages/com.yourcompany.testtweakdemo_0.0.1-9+debug_iphoneos-arm.deb'.
==> Installing…
root@192.168.2.212's password: 
(Reading database ... 1848 files and directories currently installed.)
Preparing to unpack /tmp/_theos_install.deb ...
Unpacking com.yourcompany.testtweakdemo (0.0.1-9+debug) ...
Setting up com.yourcompany.testtweakdemo (0.0.1-9+debug) ...
install.exec "killall -9 SpringBoard"
root@192.168.2.212's password: 

② THEOS_DEVICE_IP 设置错误

$ make package install
> Making all for tweak testTweakDemo…
make[2]: Nothing to be done for `internal-library-compile'.
> Making stage for tweak testTweakDemo…
dpkg-deb: building package 'com.yourcompany.testtweakdemo' in './packages/com.yourcompany.testtweakdemo_0.0.1-3+debug_iphoneos-arm.deb'.
==> Error: /Applications/Xcode.app/Contents/Developer/usr/bin/make install requires that you set THEOS_DEVICE_IP in your environment.
==> Notice: It is also recommended that you have public-key authentication set up for root over SSH, or you will be entering your password a lot.

• 解决：THEOS_DEVICE_IP = 10.200.201.22 (手机本地 IP)，首先得保证 iOS 设备和 Mac 在同一局域网的同一网段中，打开终端，输入 ssh [email protected] 输入 iOS 设备密码，默认 alpine：

$ ping 192.168.2.212
PING 192.168.2.212 (192.168.2.212): 56 data bytes
64 bytes from 192.168.2.212: icmp_seq=0 ttl=64 time=34.303 ms
64 bytes from 192.168.2.212: icmp_seq=1 ttl=64 time=28.949 ms
64 bytes from 192.168.2.212: icmp_seq=2 ttl=64 time=25.753 ms
64 bytes from 192.168.2.212: icmp_seq=3 ttl=64 time=5.306 ms
64 bytes from 192.168.2.212: icmp_seq=4 ttl=64 time=106.028 ms
64 bytes from 192.168.2.212: icmp_seq=5 ttl=64 time=84.643 ms
64 bytes from 192.168.2.212: icmp_seq=6 ttl=64 time=44.845 ms
^C
--- 192.168.2.212 ping statistics ---
7 packets transmitted, 7 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 5.306/47.118/106.028/32.913 ms
devzkndeMacBook-Pro:testtweakdemo devzkn$  ssh root@192.168.2.212
The authenticity of host '192.168.2.212 (192.168.2.212)' can't be established.
RSA key fingerprint is SHA256:/.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.2.212' (RSA) to the list of known hosts.
root@192.168.2.212's password: 
Permission denied, please try again.
root@192.168.2.212's password: 
iPhone:~ root#