iOS逆向1015-微信抢红包案例（三）抢红包方法_用伪代码还原

1015-微信抢红包案例（三）抢红包方法_用伪代码还原

还原此类：WCRedEnvelopesReceiveControlLogic


@interface NMMUINavigationViewController
@end
    @interface NewMainFrameViewController   // 
    @interface BaseMsgContentViewController // 消息
    @interface ContactsContentViewController    // 通讯录
    @interface FindFriendEntryViewController    // 发现
    @interface MoreViewController           // 更多

@interface NewMainFrameRightTopMenuBtn
@end

@interface MMBarButton
@end

@interface BaseMsgContentViewController : MMObject
- (_Bool)onLoadDownMoreMessage;
- (void)AddLocationMessageWithLocation:(id)arg1;
- (void)OnModMsg:(id)arg1 MsgWrap:(id)arg2;
- (void)AddMsg:(id)arg1 MsgWrap:(id)arg2;
hook以下方法
- (void)OnAddMsg:(id)arg1 MsgWrap:(id)arg2;
- (void)DidAddMsg:(id)arg1;
@end

@interface CMessageMgr  //消息的中转站
hook以下方法
- (void)MainThreadNotifyToExt:(id)arg1;
@end


@interface WCRedEnvelopesReceiveHomeView : MMUIView
- (void)OnOpenRedEnvelopes;
 //分析源码，静态分析，通过IDA。汇编 
    - 真正的抢红包方法
@end





//-------------------------  开始：WeChatHeader.h -------------------------
//  001--WeChatDemo11
//  Created by H on 2018/5/18.
//  Copyright © 2018年 H. All rights reserved.
//
#ifndef WeChatHeader_h
#define WeChatHeader_h
// See http://iphonedevwiki.net/index.php/Logos
#import 
#define HKDefaults [NSUserDefaults standardUserDefaults]
#define HKSWITCHKEY @"HKSWITCHKEY"
#define HKTIMEKEY @"HKTIMEKEY"

//关于界面
@interface MMTableViewInfo
- (long long)numberOfSectionsInTableView:(id)arg1;
@end

@interface WCRedEnvelopesReceiveHomeView{
    id m_delegate;
    NSDictionary *m_dicBaseInfo;
}
@end


@interface WCPayInfoItem :NSObject
@property(retain, nonatomic) NSString *m_c2cNativeUrl;
@end


@interface CMessageWrap :NSObject
@property(retain, nonatomic) WCPayInfoItem *m_oWCPayInfoItem;
@end


@interface WCRedEnvelopesControlData :NSObject
@property(retain, nonatomic) CMessageWrap *m_oSelectedMessageWrap;
@property(retain, nonatomic) NSDictionary *m_structDicRedEnvelopesBaseInfo;
@end


@interface WCRedEnvelopesControlLogic{
    WCRedEnvelopesControlData *m_data;
}
@end


@interface WCRedEnvelopesReceiveControlLogic:WCRedEnvelopesControlLogic
@end


@interface WCBizUtil: NSObject
+ (id)dictionaryWithDecodedComponets:(id)arg1 separator:(id)arg2;
@end
#endif /* WeChatHeader_h */
//------------------------- 结束：WeChatHeader.h -------------------------





//========================= 开始：_01__WeChatDemo11Dylib.xm =========================
@interface MMServiceCenter
+(id)defaultCenter;
-(id)getService:(Class)arg1;
@end

@interface MMMsgLogicManager
-(id)GetCurrentLogicController;
@end


@interface WeixinContentLogicController
-(id)m_contact;
@end


@interface WCRedEnvelopesLogicMgr
-(void)OpenRedEnvelopesRequest:(id)dic;
@end


@interface CContactMgr
-(id)getSelfContact;
@end

@interface CBaseContact
@property(retain, nonatomic) NSString *m_nsHeadImgUrl;
@property(retain, nonatomic) NSString *m_nsUsrName;
@end


@interface CContact :CBaseContact
-(id)getContactDisplayName;

@end

@interface WCPayLogicMgr
- (void)setRealnameReportScene:(unsigned int)arg1;
- (void)checkHongbaoOpenLicense:(id)arg1 acceptCallback:(void(^)())arg2 denyCallback:(void(^)())arg3;
@end
//========================= 结束：_01__WeChatDemo11Dylib.xm =========================




/***************************************************************************
@interface WeiXinContentLogicController: BaseMsgContentViewController
@end


@interface BaseMsgContentLogicController : MMObject 
{
    BaseMsgContentViewController *m_viewController;
    CBaseContact *m_contact;

    CContactVerifyLogic *m_contactVerifyLogic;
}
@end
**************************************************************************/

%hook
- (void)OpenRedEnvelopesRequest:(id)arg1 {
    NSLOg(@"%@",arg1)
    %orgi;
}
%end

WCRedEnvelopesControlData  *m_data = self.m_data；
CMessageWrap   *msgWrap         = [m_data m_oSelectedMessageWrap];
WCPayInfoItem  *item                 = [msgWrap m_oWCPayInfoItem];
NSString       *url             = [item m_c2cNativeUrl];

//合并方法：拿到红包的url
NSString *url = [[[self.m_data m_oSelectedMessageWrap] 
                                m_o WCPayInfoItem]
                                m_c2cNativeUrl];



//--------------------逻辑分析  --------
// 微信应该有一个专门管理消息的对象!
// 这个方法到底 是谁调用来的!! 看函数调用栈!!


%hook WCRedEnvelopesReceiveHomeView
- (void)OnOpenRedEnvelopes{
    %orig;
//    //拿到成员变量
//    NSDictionary * dict = c
//    //打印字典
//    NSArray * arr = [dict allKeys];
//    for(int i = 0;i < arr.count ;i++){
//        NSLog(@"%@:%@",arr[i],[dict objectForKey:arr[i]]);
//    }
//    //拿到代理
//    WeChatdelegate * delegate = MSHookIvar(self,"m_delegate");
//
//    [delegate WCRedEnvelopesReceiveHomeViewOpenRedEnvelopes];
//    NSLog(@"delegateClass: %@",[delegate class]);
}
%end


%hook CMessageMgr
- (void)onNewSyncAddMessage:(id)arg1{
    NSLog(@"%@\n%@",arg1,[arg1 class]);
    //通过分析,找到红包的消息类型是49!
    //if type == 49 {开抢!!!! }
    %orig;
}
%end


%hook WCRedEnvelopesReceiveControlLogic
-(void)WCRedEnvelopesReceiveHomeViewOpenRedEnvelopes{
    //伪代码
    WCRedEnvelopesControlData * m_data = MSHookIvar(self,"m_data");
    CMessageWrap  * msgWrap         = [m_data  m_oSelectedMessageWrap];
    WCPayInfoItem * payInfoItem     = [msgWrap m_oWCPayInfoItem];
    NSString * c2cNativeUrl         = [payInfoItem m_c2cNativeUrl];
    NSUInteger len = [@"wxpay://c2cbizmessagehandler/hongbao/receivehongbao?" length];
    NSString * c2cNativeUrl2 = [c2cNativeUrl substringFromIndex:len];
    NSDictionary * url_dic   = [%c(WCBizUtil) dictionaryWithDecodedComponets:c2cNativeUrl2 separator:@"&"];
   
    NSMutableDictionary * mutalbe_dic = [%c(NSMutableDictionary) dictionary];
    [mutalbe_dic setObject:@"1" forKey:@"msgType"];
    [mutalbe_dic setObject:url_dic[@"sendid"] forKey:@"sendId"];
    [mutalbe_dic setObject:url_dic[@"channelid"] forKey:@"channelId"];
   
    MMServiceCenter * mmserCent = [%c(MMServiceCenter) defaultCenter];
    Class ccmgr = [%c(CContactMgr) class];
    CContactMgr * contactMgr = [mmserCent getService:ccmgr];
    CContact * selfContact = [contactMgr getSelfContact];
    // displayName --> NSTaggePointString
    id displayName = [selfContact getContactDisplayName];
    NSLog(@"---displayName= %@",[displayName class]);
    [mutalbe_dic setObject:displayName forKey:@"nickName"];
    [mutalbe_dic setObject:[selfContact m_nsHeadImgUrl] forKey:@"headImg"];
    if (msgWrap)
    {
        NSString * nativeUrl =  c2cNativeUrl;
        [mutalbe_dic setObject:nativeUrl forKey:@"nativeUrl"];
    }
    MMMsgLogicManager * redEvenlopsLogicMgr = [[%c(MMServiceCenter) defaultCenter] getService:[%c(MMMsgLogicManager) class]];
    WeixinContentLogicController * currentLogicContoller  = [redEvenlopsLogicMgr GetCurrentLogicController];
    if ( currentLogicContoller )
    {
        CBaseContact * m_contact = [currentLogicContoller m_contact];
        if ( m_contact ){
            CBaseContact * contact = [currentLogicContoller m_contact];
            NSString * nsUsrName = [contact m_nsUsrName];
            if ( nsUsrName ){
                [mutalbe_dic setObject:nsUsrName forKey:@"sessionUserName"];
            }
        }
    }
    
    NSDictionary * m_dicBaseInfo = [m_data m_structDicRedEnvelopesBaseInfo];
    NSString * timingIdentifier = m_dicBaseInfo[@"timingIdentifier"];
    if ([timingIdentifier length]){
        [mutalbe_dic setObject:timingIdentifier forKey:@"timingIdentifier"];
    }

    WCPayLogicMgr * payLogic = [[%c(MMServiceCenter) defaultCenter] getService:[%c(WCPayLogicMgr) class]];
    [payLogic setRealnameReportScene:(unsigned int)1003];
    id subScript = [m_dicBaseInfo objectForKeyedSubscript:@"agree_duty"];

    [payLogic checkHongbaoOpenLicense:subScript acceptCallback:^(){
        WCRedEnvelopesLogicMgr * redEvenlopsLogicMgr  = [[%c(MMServiceCenter) defaultCenter] getService:[%c(WCRedEnvelopesLogicMgr) class]];

        [redEvenlopsLogicMgr OpenRedEnvelopesRequest:mutalbe_dic];
        
    } denyCallback:^(){
       
    }];
    
}

%end

2.1、File --> Script file (Alt + F7) --> 显示部分为代码类与方法

image.png

2.2、全选，复制到 Sublime Text 中查看，并 推算出伪代码

image.png

3、恢复block 符号表

通过开源项目：restore-symbol 恢复

3.1 使用ida 通过 ida_search_block.py 脚本 生成 block_symbol.json 文件，放入 restore-symbol2 项目中

3.2、 终端使用，goshell 直接进入文件 恢复 符号表

$ ./restore-symbol WeChat -o WeChat_block -j block_symbol.json

WeChat： 140.6 M
WeChat_arm64：75.3 M
WeChatMachO： 84.5 M //恢复后 变大了
WeChat_block： 94M

3.3、 WeChat_block 改名为 WeChat --> 再放入WeChat.ipa 包内

（ WeChat.ipa 包内：先删掉原来的 WeChat，即替换 ）

3.4、 重新用ida 解析，搜索查看 WCRedEnvelopesReceiveControlLogic

image.png

image.png