逆向破解_iOS_学习笔记_1

【自编号:28】【Cydia上最知名的共享源——xsellize能够快速破解几乎所有收费软件】【2015-03-21 22:19:41 by beyond】



【自编号:29】【2013-3第一款电话录音软件Audio Recorder】【2015-03-21 22:21:36 by beyond】



【自编号:30】【监测工具：Reveal、tcpdump、libNotifyWatch、PonyDebug、青花瓷】【2015-03-21 22:25:30 by beyond】



【自编号:31】【开发工具：Theos，能编译生成tweak插件】【2015-03-21 22:27:45 by beyond】



【自编号:32】【反编译器：IDA支持多平台、多CPU架构，可以输出函数列表和汇编代码】【2015-03-21 22:31:02 by beyond】



【自编号:33】【调试器：要在iOS设备上运行基于命令行的GDB(GNU Debug)，LLDB类似】【2015-03-21 22:34:26 by beyond】



【自编号:34】【常规APP目录是：/var/mobile/Application】【2015-03-21 22:38:29 by beyond】



【自编号:35】【越狱后可通过iFunBox、iExplorer、iFile访问全部系统文件】【2015-03-21 22:43:14 by beyond】



【自编号:36】【文件系统层次标准：Filesystem Hierarchy Standard】【2015-03-21 22:46:17 by beyond】



【自编号:37】【/bin：用户级二进制文件，如ls、ps】【2015-03-21 22:48:13 by beyond】



【自编号:38】【/sbin:】【2015-03-21 22:49:59 by beyond】



【自编号:39】【/sbin：系统级二进制文件，如netstat、reboot】【2015-03-21 22:51:52 by beyond】



【自编号:40】【/etc：系统脚本、配置文件，如passwd、hosts。在手机中，是一个符号链接，实际指向/private/etc】【2015-03-21 22:55:13 by beyond】



【自编号:41】【/dev：BSD设备文件。一个文件代表系统的一个块设备货或字符设备。块设备比如硬盘。是块为单位传输数据。字符设备比如调制解调器。是以字符为单位传输数据。】【2015-03-21 23:01:03 by beyond】



【自编号:42】【/private：下面有两个目录，分别是etc和 var】【2015-03-21 23:04:25 by beyond】



【自编号:43】【/tmp：是一个符号链接。实际指向：/private/tmp】【2015-03-21 23:06:08 by beyond】



【自编号:44】【/usr：包含大多数用户工具和程序。】【2015-03-21 23:08:02 by beyond】



【自编号:45】【/usr/bin：包含那些/bin和/sbin未出现的基础功能。如：nm，killall】【2015-03-21 23:09:50 by beyond】



【自编号:46】【/usr/include:包含所有标准C头文件。】【2015-03-21 23:11:01 by beyond】



【自编号:47】【/usr/lib：存放库文件】【2015-03-21 23:12:04 by beyond】



【自编号:48】【/var：存放一些经常更改的文件。比如日志，用户数据、临时文件。】【2015-03-21 23:13:41 by beyond】



【自编号:49】【/var/mobile/Applications：存放所有从appstore上面下载的应用。需要重点关注。】【2015-03-21 23:15:13 by beyond】



【自编号:50】【/Applications：符号链接。实际指向/var/stash/Applications，重点关注。存放所有系统app和来自Cydia的app】【2015-03-21 23:18:48 by beyond】



【自编号:51】【/Library：存放系统app数据。最重要的是目录/Library/MobileSubstrate。它存放了所有基于MobileSubstrate的插件。】【2015-03-21 23:22:43 by beyond】



【自编号:52】【MobileSubstrate是一个提供hook功能的基础平台，运行这个平台上的插件通常被称为tweak】【2015-03-21 23:28:08 by beyond】



【自编号:53】【/Library/MobileSubstrate目录下通常有三类文件。后缀名为dylib的文件，其实就是tweak插件。后缀名是plist的文件，用于配合dylib使用指定注入目标。后缀名是disabled被SBSettings禁用的tweak插件。只是后缀名改成disabled，不让MobileSubstrate加载而已】【2015-03-21 23:37:59 by beyond】



【自编号:68】【新版第2章电子版】

主要介绍iOS系统结构

【查看原文】 【2015-03-23 15:02:33 by beyond】



【自编号:69】【新版第3章电子版】

主要介绍各种工具使用

【查看原文】 【2015-03-23 15:05:43 by beyond】



【自编号:130】【/System:最重要目录,包含大量的系统组件】【2015-03-23 21:29:22 by beyond】



【自编号:131】【/System/Library/Frameworks和/System/Library/PrivateFrameworks,存放所有的Framework,包括公开的和未公开的】【2015-03-23 21:30:50 by beyond】



【自编号:132】【/System/Library/CoreServices,里面有一个SpringBoard.app,它就是iOS中的桌面】【2015-03-23 21:31:46 by beyond】



【自编号:133】【/System/Library/PreferenceBundles:里面的各个bundle对应“设置”里面的各个功能，它是入门阶段的练手目标】【2015-03-23 21:33:12 by beyond】



【自编号:134】【/User目录,链接到/var/mobile目录】【2015-03-23 21:33:51 by beyond】



【自编号:135】【/var/mobile/Media/DCIM: 照片】【2015-03-23 21:34:23 by beyond】



【自编号:136】【/var/mobile/Library/SMS:短信】【2015-03-23 21:34:56 by beyond】



【自编号:137】【/var/mobile/Library/Mail: 邮件】【2015-03-23 21:35:10 by beyond】



【自编号:138】【/var/wireless/Library/CallHistory: 通话记录】【2015-03-23 21:36:01 by beyond】



【自编号:139】【/var/mobile/Applications: 里面放的是所有的App Store下载的App】【2015-03-23 21:36:43 by beyond】



【自编号:140】【iOS的程序类型有3类:Application、Dynamic Library和Daemon（di:mən守护进程、后台驻留程序）】【2015-03-23 21:40:25 by beyond】



【自编号:141】【daemon类似于Windows中的Service,iOS中的Daemon由1个可执行文件+1个Plist文件组成,其中plist文件中记录了Daemon的基本信息】【2015-03-23 21:43:47 by beyond】



【自编号:142】【iOS根进程:/sbin/launchd,它在开机时或接收命令时,检查/System/Library/LaunchDaemons目录和/Library/Daemons目录中所有Plist,然后启动对应的Deamon】【2015-03-23 21:45:44 by beyond】



【自编号:143】【常见Daemon: imagent守护着iMessage,mediaserverd守护着音频视频(如电话录音),syslogd守护着系统日志】【2015-03-23 21:48:44 by beyond】



【自编号:144】【Static Library,当一个app启动时,系统会把app和用到的static library一次加载进内存】【2015-03-23 21:50:30 by beyond】



【自编号:145】【Dynamic Library,本身不是一个可执行程序,依赖app存在,类似Dll动态链接库文件,只在用到时,才由Dynamic Loader(位于/usr/lib/dyld)加载进内存.所有的tweak都是以Dynamic Library形式工作(寄生到原生app中),因此特别注意:Dynamic Library的权限和内存空间由其寄生的宿主app决定的.例如:app store中app的写权限:/var/mobile/Applications/AppUID/Documents】【2015-03-23 21:57:33 by beyond】



【自编号:146】【Sandbox沙盒,将权限限制在了app的bundle内部,因此,当tweak无法写入文件,或者,objc_getClass获取不到类时,应检查是不是Sandbox限制了权限导致】【2015-03-23 22:01:10 by beyond】



【自编号:147】【Bundle,类似一个文件夹,压缩包,App、Frameword、PreferenceBundle都是一个Bundle包的形式存在。Bundle里面包含一个程序的所有的资源（音频图片字串可执行文件等）】【2015-03-23 22:03:28 by beyond】



【自编号:148】【3大类App: 第1个是常规app store下载的app,第2个是:WeeApp,它是一个依附于Notification Center存在的App,第3个是:PreferenceBundle,它是依附于Settings系统设置的App】【2015-03-23 22:05:40 by beyond】



【自编号:149】【Framework的Bundle里是一个动态链接库,它不是可执行程序,虽然Framework结构和App类似.但Framework更加底层,提供接口给不同App调用】【2015-03-23 22:07:26 by beyond】



【自编号:150】【App第1个重要关注对象是:Info.plist,里面可以找到bundle identifier、可执行的文件名（Executable file）,先用MobileSubstrate对App进行hook的第一步就是指定Bundle identifier】【2015-03-23 22:10:31 by beyond】



【自编号:151】【App第2个重要关注对象是:可执行文件(Executable file),class_dump、IDA、GDB都会对它进行逆向分析】【2015-03-23 22:11:51 by beyond】



【自编号:152】【App第3个重要关注对象是:Resources资源文件，包括图片图标声音配置文件nib文件，尤其是本地化字符串(.strings)是定位逆向目标的重要线索】【2015-03-23 22:13:22 by beyond】



【自编号:153】【/Applications：符号链接。实际指向/var/stash/Applications，重点关注。存放所有系统app和来自Cydia的app。它的用户是root,用户组是admin，其安装包格式：deb；而从app store下载的ipa 存放在/var/mobile/Applications】【2015-03-23 22:16:49 by beyond】



【自编号:154】【Mac工具集主要用到：class_dump、Theos】【2015-03-23 22:18:41 by beyond】



【自编号:155】【Mac工具集主要用到：class_dump、Theos、Reveal、IDA】【2015-03-23 22:19:13 by beyond】



【自编号:157】【class-dump篇：补充一下，从app store下载的app加了壳，以前使用appCrackr，但已经弃用，使用dumpdecrypted砸壳】 【进入网址】 【2015-03-23 22:41:16 by beyond】



【自编号:166】【ARM（CM3）的汇编指令收藏】 【进入网址】 【2015-03-24 16:45:01 by beyond】



【自编号:167】【ARM汇编指令】 【进入网址】 【2015-03-24 16:46:25 by beyond】



【自编号:173】【class-dump篇_1】

下载http://stevenygard.com/projects/class-dump/,
复制到/usr/bin；
执行sudo chmod 777 /usr/bin/class-dump；
运行class-dump；
进入app目录 cd /Users/juns/SGCode/TESTIDA.app；
使用plutil命令查看Info.plist，如下：plutil -p Info.plist；
可以在命令行中看到： "CFBundleExecutable" => "TESTIDA"；
继续使用命令导出头文件到指定文件夹：class-dump -S -s -H TESTIDA -o /Users/juns/SGCode/heads/app1

【2015-03-24 19:50:03 by beyond】



【自编号:174】【Theos篇_1】

1、指定XCode：sudo xcode-select -s /Applications/Xcode2.app/Contents/Developer 
2、配置环境变量：export THEOS=/opt/theos 
3、下载Theos：sudo git clone git://github.com/DHowett/theos.git $THEOS 
4、配置ldid：joedj.net/ldid下载后，放在/opt/theos/bin目录下，
赋予权限：sudo chmod 777 /opt/theos/bin/ldid 
5、配置CydiaSubstrate 执行：sudo /opt/theos/bin/bootstrap.sh substrate，
此时遇到Theos的Bug，它无法自动生成一个有效的libsubstrate.dylib文件，需在Cydia中搜索并安装CydiaSubstrate，
然后用iFunBox或scp方式将iOS中的/Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate拷贝到电脑中，
将其重命名为libsubstrate后，放到/opt/theos/lib/libsubstrate.dylib进行替换，
6：配置dpkg-deb工具，
从https://raw.githubusercontent.com/DHowett/dm.pl/master/dm.pl下载或拷贝并重命名为dpkg-deb后，
放到/opt/theos/bin目录下，赋予权限；
7、从http://github.com/DHowett/theos-nic-templates/archive/master.zip下载其他NIC模板，
解压放到/opt/theos/templates/iphone下面

【2015-03-24 19:52:30 by beyond】



【自编号:175】【hook类方法】

@interface QZUserEngine:NSObject 
- (id)sid; 
+ (id)instance; 
@end

 %hook QQChatViewController 
- (void)viewDidAppear:(BOOL)animated
{    %orig; 
    // hook类方法 
    QZUserEngine *engine = [%c(QZUserEngine) instance]; 
} 
%end

【2015-03-24 19:54:29 by beyond】



【自编号:177】【class-dump用法】

class-dump用法 [options]
选项可以是
-H  在当前目录生成头文件，或者在用-o选项指定的目录生成
-o 
  为-H选项指定输出目录
-a   显示实例变量偏移
-A   显示实现地址
–arch  选择一个指定的架构，如ppc, ppc7400, ppc64, i386, x86_64
-C   只显示同正则表达式匹配的类
-f     在方法名中查找字符串
-I    对类，目录，协议 按照继承关系(inheritance)进行排序(覆盖-s选项)
-r  递归扩展framework，并修复VM共享库
-s  按名称对classes和categories进行排序
-S  按名称对方法(method)进行排序
–list-arches  类出文件中的arches,然后退出
–sdk-root  指定 SDK root 路径（完全路径，或者 4.1等)

【2015-03-25 10:09:58 by beyond】



【自编号:178】【用dumpdecrypted给app砸壳】

</pre><a target=_blank href="http://bbs.iosre.com/t/dumpdecrypted-app/22" target="_blank">【进入网址】</a> 【2015-03-25 10:18:34 by beyond】<hr />【自编号:187】【app目录】<pre name="code" class="objc">error: failed to launch '/private/var/mobile/Containers/Bundle/Application/B4D6EABF-3458-435D-A3E7-17D5F33457D3/Beyond.app' -- process launch failed: Locked

【2015-03-25 21:18:06 by beyond】



【自编号:194】【获取类】

NSClassFromString这个和objc_getClass的区别在于参数，前者的参数是NSString，后者是char *

【2015-03-26 14:20:50 by beyond】



【自编号:228】【p175第二版问题1】

既然没有实现该方法，就到父类里面看看，发现
UIBButtonItem实现了_sendAction: withEvent方法，
那么把UIKit的二进制文件拖到IDA中？？？？？？？

【2015-04-06 13:30:37 by beyond】



【自编号:229】【P177_cbz指令】

cbz r0,label
如果r0为0就跳到label

类似还有cbnz r0,label

【2015-04-06 14:12:13 by beyond】



【自编号:230】【strd.w r10，r11，［sp］】

从右往左压栈,r11先入栈，高地址
类似情况还有函数调用，
p（，，，，，，，），前四个参数r0~r3中，
其余参数从右往左依次入栈，返回值存r0中

【2015-04-06 14:49:34 by beyond】



【自编号:231】【p181 no object-c description avaliable】

结合action定义，猜测类型是 SEL ，
使用p （char *）$r2  打印

【2015-04-06 15:01:53 by beyond】



【自编号:245】【block逆向】 【查看原文】 【2015-04-07 09:50:50 by beyond】



【自编号:252】【微博抽奖插件】 【查看原文】 【2015-04-08 15:42:30 by beyond】



【自编号:259】【lldb敲help】

(lldb) help
Debugger commands:

  apropos           -- Find a list of debugger commands related to a particular
                       word/subject.
  breakpoint        -- A set of commands for operating on breakpoints. Also see
                       _regexp-break.
  command           -- A set of commands for managing or customizing the
                       debugger commands.
  disassemble       -- Disassemble bytes in the current function, or elsewhere
                       in the executable program as specified by the user.
  expression        -- Evaluate a C/ObjC/C++ expression in the current program
                       context, using user defined variables and variables
                       currently in scope.
  frame             -- A set of commands for operating on the current thread's
                       frames.
  gdb-remote        -- Connect to a remote GDB server.  If no hostname is
                       provided, localhost is assumed.
  gui               -- Switch into the curses based GUI mode.
  help              -- Show a list of all debugger commands, or give details
                       about specific commands.
  kdp-remote        -- Connect to a remote KDP server.  udp port 41139 is the
                       default port number.
  log               -- A set of commands for operating on logs.
  memory            -- A set of commands for operating on memory.
  platform          -- A set of commands to manage and create platforms.
  plugin            -- A set of commands for managing or customizing plugin
                       commands.
  process           -- A set of commands for operating on a process.
  quit              -- Quit out of the LLDB debugger.
  register          -- A set of commands to access thread registers.
  script            -- Pass an expression to the script interpreter for
                       evaluation and return the results. Drop into the
                       interactive interpreter if no expression is given.
  settings          -- A set of commands for manipulating internal settable
                       debugger variables.
  source            -- A set of commands for accessing source file information
  target            -- A set of commands for operating on debugger targets.
  thread            -- A set of commands for operating on one or more threads
                       within a running process.
  type              -- A set of commands for operating on the type system
  version           -- Show version of LLDB debugger.
  watchpoint        -- A set of commands for operating on watchpoints.

Current command abbreviations (type 'help command alias' for more info):

  add-dsym  -- ('target symbols add')  Add a debug symbol file to one of the
               target's current modules by specifying a path to a debug symbols
               file, or using the options to specify a module to download
               symbols for.
  attach    -- ('_regexp-attach')  Attach to a process id if in decimal,
               otherwise treat the argument as a process name to attach to.
  b         -- ('_regexp-break')  Set a breakpoint using a regular expression
               to specify the location, where  is in decimal and
               
 is in hex.
  bt        -- ('_regexp-bt')  Show a backtrace.  An optional argument is
               accepted; if that argument is a number, it specifies the number
               of frames to display.  If that argument is 'all', full
               backtraces of all threads are displayed.
  c         -- ('process continue')  Continue execution of all threads in the
               current process.
  call      -- ('expression --')  Evaluate a C/ObjC/C++ expression in the
               current program context, using user defined variables and
               variables currently in scope.
  continue  -- ('process continue')  Continue execution of all threads in the
               current process.
  detach    -- ('process detach')  Detach from the current process being
               debugged.
  di        -- ('disassembl

【2015-04-09 17:09:48 by beyond】



【自编号:260】【lldb敲help_2】

di        -- ('disassemble')  Disassemble bytes in the current function, or
               elsewhere in the executable program as specified by the user.
  dis       -- ('disassemble')  Disassemble bytes in the current function, or
               elsewhere in the executable program as specified by the user.
  display   -- ('_regexp-display')  Add an expression evaluation stop-hook.
  down      -- ('_regexp-down')  Go down "n" frames in the stack (1 frame by
               default).
  env       -- ('_regexp-env')  Implements a shortcut to viewing and setting
               environment variables.
  exit      -- ('quit')  Quit out of the LLDB debugger.
  f         -- ('frame select')  Select a frame by index from within the
               current thread and make it the current frame.
  file      -- ('target create')  Create a target using the argument as the
               main executable.
  finish    -- ('thread step-out')  Finish executing the function of the
               currently selected frame and return to its call site in
               specified thread (current thread, if none specified).
  image     -- ('target modules')  A set of commands for accessing information
               for one or more target modules.
  j         -- ('_regexp-jump')  Sets the program counter to a new address.
  jump      -- ('_regexp-jump')  Sets the program counter to a new address.
  kill      -- ('process kill')  Terminate the current process being debugged.
  l         -- ('_regexp-list')  Implements the GDB 'list' command in all of
               its forms except FILE:FUNCTION and maps them to the appropriate
               'source list' commands.
  list      -- ('_regexp-list')  Implements the GDB 'list' command in all of
               its forms except FILE:FUNCTION and maps them to the appropriate
               'source list' commands.
  n         -- ('thread step-over')  Source level single step in specified
               thread (current thread, if none specified), stepping over
               calls.
  next      -- ('thread step-over')  Source level single step in specified
               thread (current thread, if none specified), stepping over
               calls.
  nexti     -- ('thread step-inst-over')  Single step one instruction in
               specified thread (current thread, if none specified), stepping
               over calls.
  ni        -- ('thread step-inst-over')  Single step one instruction in
               specified thread (current thread, if none specified), stepping
               over calls.
  p         -- ('expression --')  Evaluate a C/ObjC/C++ expression in the
               current program context, using user defined variables and
               variables currently in scope.
  po        -- ('expression -O  -- ')  Evaluate a C/ObjC/C++ expression in the
               current program context, using user defined variables and
               variables currently in scope.
  print     -- ('expression --')  Evaluate a C/ObjC/C++ expression in the
               current program context, using user defined variables and
               variables currently in scope.
  q         -- ('quit')  Quit out of the LLDB debugger.
  r         -- ('process launch -c /bin/sh --')  Launch the executable in the
               debugger.
  rbreak    -- ('breakpoint set -r %1')  Sets a breakpoint or set of
               breakpoints in the executable.
  repl      -- ('expression -r  -- ')  Evaluate a C/ObjC/C++ expression in the
               current program context, using user defined variables and
               variables currently in scope.
  run       -- ('process launch -c /bin/sh --')  Launch the executable in the
               debugger.
  s         -- ('thread step-in')  Source level single step in specified thread
               (current thread, if none specified).
  si        -- ('thread step-inst')  Single step one instruction in specified
               thread (current thread, if none specified).
  step      -- ('thread step-in')  Source level single step in specified thread
               (current thread,

【2015-04-09 17:11:23 by beyond】



【自编号:262】【旋转相关】

1.每次旋转都会调用 appdelegate
- (NSUInteger)application:(UIApplication *)application supportedInterfaceOrientationsForWindow:(UIWindow *)window
{
    // 全局的设置：允许竖屏+横屏
    NSUserDefaults *userDefault = [NSUserDefaults standardUserDefaults];
    BOOL isAllowLandscape = [userDefault boolForKey:@"userDefault_isAllowLandscape"];
    if (isAllowLandscape) {
        return UIInterfaceOrientationMaskPortrait|UIInterfaceOrientationMaskLandscape;
    } else {
        return UIInterfaceOrientationMaskPortrait;
    }


}
2.NJNavigationController
// 支持横竖屏显示  1111
- (NSUInteger)supportedInterfaceOrientations
{
    return UIInterfaceOrientationPortrait;
}
// 支持设备自动旋转 2222
- (BOOL)shouldAutorotate
{
    return NO;
}
3.BaseViewController
// 支持横竖屏显示  3333
- (NSUInteger)supportedInterfaceOrientations
{
    return UIInterfaceOrientationPortrait;
}
// 支持设备自动旋转 4444
- (BOOL)shouldAutorotate
{
    return NO;
}
通过 进系统断点得知：br s -a
每次用户调整屏幕的时候，会发出一个通知
// 发出通知
    NSDictionary *dict = [NSDictionary dictionaryWithObject:@(1) forKey:@"UIDeviceOrientationRotateAnimatedUserInfoKey"];
    [[NSNotificationCenter defaultCenter]postNotificationName:@"UIDeviceOrientationDidChangeNotification" object:[UIDevice currentDevice] userInfo:dict];

【2015-04-10 14:13:28 by beyond】



【自编号:268】【br s -a】

lldb:   br s -a，其中s 是set的意思

【2015-04-16 10:50:33 by beyond】



【自编号:269】【image list -o -f】

 lldb: help image list 
     List current executable and dependent shared library images.

Syntax: target modules list []

Command Options Usage:
  target modules list [-ghou] [-a ] [-A[]] [-t[]] [-f[]] [-d[]] [-b[]] [-s[]] [-S[]] [-m[]] [-r[]] [-p[]]

       -A[] ( --arch=[] )
            Display the architecture when listing images.

       -S[] ( --symfile-unique=[] )
            Display the symbol file with optional width only if it is different
            from the executable object file.

       -a  ( --address  )
            Display the image at this address.

       -b[] ( --basename=[] )
            Display the basename with optional width for the image object file.

       -d[] ( --directory=[] )
            Display the directory with optional width for the image object
            file.

       -f[] ( --fullpath=[] )
            Display the fullpath to the image object file.

       -g ( --global )
            Display the modules from the global module list, not just the
            current target.

       -h ( --header )
            Display the image header address as a load address if debugging, a
            file address otherwise.

       -m[] ( --mod-time=[] )
            Display the modification time with optional width of the module.

       -o ( --offset )
            Display the image header address offset from the header file
            address (the slide amount).

       -p[] ( --pointer=[] )
            Display the module pointer.

       -r[] ( --ref-count=[] )
            Display the reference count if the module is still in the shared
            module cache.

       -s[] ( --symfile=[] )
            Display the fullpath to the image symbol file with optional width.

       -t[] ( --triple=[] )
            Display the triple when listing images.

       -u ( --uuid )
            Display the UUID when listing images.

'image' is an abbreviation for 'target modules'

【2015-04-16 11:27:39 by beyond】



【自编号:275】【打印SEL】

po $r2,提示 no objective-c description available
就用打印SEL
p (char *)$r2

【2015-04-17 16:59:40 by beyond】



【自编号:276】【x/10 $SP】

栈，开口向下，上面是高地址，下面是低地址
从右开始，参数入栈，先入的是高地址
x/10 $SP   从$sp开始，从低到高，打印连续的10个

【2015-04-17 17:03:26 by beyond】



【自编号:277】【register write r0 1】【2015-04-17 17:04:31 by beyond】



【自编号:307】【禁用所有断点】

br disable

disable -- Disable the specified breakpoint(s) without removing it/them. 
                 If no breakpoints are specified, disable them all.
    
enable  -- Enable the specified disabled breakpoint(s). If no breakpoints
                 are specified, enable all of them.

【2015-05-08 15:25:27 by beyond】



【自编号:368】【Mac OS X上逆向Dash v2.2.0】 【查看原文】 【2015-06-03 15:50:55 by beyond】



【自编号:594】【class-dump入手】

下载：http://download.csdn.net/download/map625/8191343
http://stevenygard.com/projects/class-dump/

拷贝到：/usr/local/bin

找到目标源：xxx.app  或者是库   /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator.sdk/System/Library/PrivateFrameworks

使用命令：class-dump  -H  /Users/pzh/iTunesStore.framework -o /Users/pzh

【2015-09-16 10:54:48 by beyond】