iOS9 class dump header

获取系统私有API，网上有很多资料总结了一下就三种方式：

• 使用class-dump可以提取系统私有API列表
• 使用class-dump+DumpFrameworks.pl，这个可以一次性提取所有系统Framework与PrivateFrameworks的API列表
• 直接使用已经提取好的API列表github地址

DumpFrameworks.pl代码如下：

#!/usr/bin/perl
#
# 24 November 2008
# Framework Dumping utility; requires class-dump
#

use strict;

use Cwd;
use File::Path;

my $HOME = (getpwuid($<))[7] || $ENV{'HOME'} 
  or die "Could not find your home directory!";

# This command must be in your path.
# http://www.codethecode.com/projects/class-dump/
my $CLASS_DUMP = 'class-dump'; 

# Public Frameworks /xcode4/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS4.3.sdk////Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS4.2.sdk/System/Library
# /Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator4.2.sdk/System/Library/Frameworks /xcode4/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator5.0.sdk/System/Library
dump_frameworks('/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator9.2.sdk/System/Library/Frameworks',
                'Frameworks');

# Private Frameworks
dump_frameworks('/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator9.2.sdk/System/Library/PrivateFrameworks',
                'PrivateFrameworks');

sub dump_frameworks {
  my($dir, $subdir) = @_;

  opendir(my $dirh, $dir) or die "Could not opendir($dir) - $!";

  # Iterate through each framework found in the directory
  foreach my $file (grep { /\.framework$/ } readdir($dirh))
  {
    # Extract the framework name
    (my $fname = $file) =~ s/\.framework$//;
    print "Framework: $fname\n";

    my $headers_dir = "$HOME/Headers/$subdir/$fname";

    # Create the folder to store the headers
    mkpath($headers_dir);

    # Perform the class-dump
    my $cwd = cwd();
    chdir($headers_dir) or die "Could not chdir($headers_dir) - $!";

    system($CLASS_DUMP, '-H', "$dir/$file");

   if($? == -1)
    {
      die "Could not execute $CLASS_DUMP - $!\n";
    }
#
# elsif($? & 127)
# {
# printf("$CLASS_DUMP died with signal %d, %s coredump\n",
# ($? & 127), ($? & 128) ? 'with' : 'without');
# exit;
# }
# 
# elsif(my $ret = $? >> 8)
# {
# die "The command '$CLASS_DUMP -H $dir/$file' failed, returning $ret\n";
# }
#*/ 
    chdir($cwd) or die "Could not chdir($cwd) - $!";
  }
}

注意使用DumpFrameworks.pl时要更改系统库的路径为你自己的路径。

但是从class-dump官网下载的最新版本class-dump-3.5.dmg却不能获取iOS9以后版本的API列表。报错信息：

Warning: This file does not contain any Objective-C runtime information.

具体原因Google了一下：

class-dump依赖于__DATA段下的几个sect里的数据。
iOS9 dyld解包的生成macho不在标准__DATA段，导致某些classdump无法识别

原答案地址

然后我从github上获取class-dump开源代码重新编译class-dump的可执行文件，并把这个可执行文件导出重新dump成功获取iOS9以后的系统私有API。具体方法如下：

1.打开class-dump并在TARGETS选中class-dump可执行文件

2.Xcode->Perferences->Locations

3.Advanced->Custom

不要更改任何路径选择后编译该项目。

编译成功后在~Library/Developer/Xcode/DerivedData/Build/Products可以找到这个可执行文件然后用这文件获取系统私有API。