逆向工程

open ~/.bash_profile
export THEOS=/opt/theos
source ~/.bash_profile

cd opt/
sudo git clone --recursive https://github.com/theos/theos.git $THEOS
sudo curl https://ghostbin.com/ghost.sh -o $THEOS/bin/ghost
sudo chmod +x $THEOS/bin/ghost

open ~/.bash_profile

export PATH=/opt/theos/bin/:$PATH
export THEOS=/opt/theos

source ~/.bash_profile

localhost:theostest apple$ nic.pl
NIC 2.0 - New Instance Creator
------------------------------
  [1.] iphone/activator_event
  [2.] iphone/application_modern
  [3.] iphone/cydget
  [4.] iphone/flipswitch_switch
  [5.] iphone/framework
  [6.] iphone/ios7_notification_center_widget
  [7.] iphone/library
  [8.] iphone/notification_center_widget
  [9.] iphone/preference_bundle_modern
  [10.] iphone/tool
  [11.] iphone/tweak
  [12.] iphone/xpc_service
Choose a Template (required): 11
Project Name (required): TheosT
Package Name [com.yourcompany.theost]: com.offcn.TheosT
Author/Maintainer Name [王史超]: 
[iphone/tweak] MobileSubstrate Bundle filter [com.apple.springboard]: 
[iphone/tweak] List of applications to terminate upon installation (space-separated, '-' for none) [SpringBoard]: 
Instantiating iphone/tweak in theost/...
Done.

localhost:theost apple$ ls
Makefile	TheosT.plist	Tweak.xm	control

include $(THEOS)/makefiles/common.mk

TWEAK_NAME = TheosT
TheosT_FILES = Tweak.xm

include $(THEOS_MAKE_PATH)/tweak.mk

after-install::
	install.exec "killall -9 SpringBoard"

after-install::
        install.exec "killall -9 SpringBoard"

ARCHS = armv7 armv7s arm64 //指定对应的处理器架构
TARGET = iphone:latest:8.0 //指定版本
testreproject_FRAMEWORKS = UIKit CoreAudio //导入framework
testreproject_PRIVATE_FRAMEWORKS = AppSupport ChatKit //导入私有库
testreproject_LDFLAGS = -lz -lsqlite3.0 -dylib1.o // 链接libsqlite3.0.dylib, libz.dylib和dylib1.o.
Theos采用GNU Linker来链接Mack-O对象, 包括.dylib, .a和.o.
-lx代表链接libx.a或libx.dylib, 即给”x“加上”lib“的前缀, 以及".a"或".dylib"的后缀, 如果x是"y.o"的形式, 则直接链接y.o, 不加任何前缀或后缀.

/* How to Hook with Logos
Hooks are written with syntax similar to that of an Objective-C @implementation.
You don't need to #include <substrate.h>, it will be done automatically, as will
the generation of a class list and an automatic constructor.

%hook ClassName

// Hooking a class method
+ (id)sharedInstance {
        return %orig;
}

// Hooking an instance method with an argument.
- (void)messageName:(int)argument {
        %log; // Write a message about this call, including its class, name and arguments, to the system log.

        %orig; // Call through to the original function with its original arguments.
        %orig(nil); // Call through to the original function with a custom argument.

        // If you use %orig(), you MUST supply all arguments (except for self and _cmd, the automatically generated ones.)
}

// Hooking an instance method with no arguments.
- (id)noArguments {
        %log;
        id awesome = %orig;
        [awesome doSomethingElse];

        return awesome;
}

// Always make sure you clean up after yourself; Not doing so could have grave consequences!
%end
*/

Package: com.yourcompany.testreproject
Name: testreproject
Depends: mobilesubstrate
Version: 0.0.1
Architecture: iphoneos-arm
Description: An awesome MobileSubstrate tweak!
Maintainer: wangyu
Author: wangyu
Section: Tweaks

==> Error:/Applications/Xcode.app/Contents/Developer/usr/bin/make install requires that you set THEOS_DEVICE_IP in your environment.
==> Notice:It is also recommended that you have public-key authentication set up for root over SSH, or you will be entering your password a lot.
make: *** [internal-install] Error 1

localhost:leci apple$ /opt/theos/bin/logify.pl LCActivityController.h
%hook LCActivityController
+ (id)sharedInstance { %log; id r = %orig; HBLogDebug(@" = %@", r); return r; }
- (void)checkActivitysWithUid:(id)arg1 orderID:(id)arg2 orderState:(id)arg3 block:(CDUnknownBlockType)arg4 { %log; %orig; }
%end

// 需要Hook的类
@class ClassToHook;

// 加载类
CHDeclareClass(ClassToHook); // declare class

CHOptimizedMethod(0, self, void, ClassToHook, messageName) // hook method (with no arguments and no return value)
{
	// write code here ...
	
	CHSuper(0, ClassToHook, messageName); // call old (original) method
}

// 需要Hook的方法
// 2： 代表有几个参数
// self： 当前类
// BOOL： 返回值
// ClassToHook： Hook对象
// arg1，NSString*, value1：参数1，参数1类型，参数值
// arg2，BOOL, value2：参数2，参数2类型，参数值

CHOptimizedMethod(2, self, BOOL, ClassToHook, arg1, NSString*, value1, arg2, BOOL, value2) // hook method (with 2 arguments and a return value)
{
	// write code here ...

	return CHSuper(2, ClassToHook, arg1, value1, arg2, value2); // call old (original) method and return its return value
}

static void WillEnterForeground(CFNotificationCenterRef center, void *observer, CFStringRef name, const void *object, CFDictionaryRef userInfo)
{
	// not required; for example only
}

static void ExternallyPostedNotification(CFNotificationCenterRef center, void *observer, CFStringRef name, const void *object, CFDictionaryRef userInfo)
{
	// not required; for example only
}

// 初始化

CHConstructor // code block that runs immediately upon load
{
	@autoreleasepool
	{
		// listen for local notification (not required; for example only)
		CFNotificationCenterRef center = CFNotificationCenterGetLocalCenter();
		CFNotificationCenterAddObserver(center, NULL, WillEnterForeground, CFSTR("UIApplicationWillEnterForegroundNotification"), NULL, CFNotificationSuspensionBehaviorCoalesce);
		
		// listen for system-side notification (not required; for example only)
		// this would be posted using: notify_post("com.offcn.CRMHook.eventname");
		CFNotificationCenterRef darwin = CFNotificationCenterGetDarwinNotifyCenter();
		CFNotificationCenterAddObserver(darwin, NULL, ExternallyPostedNotification, CFSTR("com.offcn.CRMHook.eventname"), NULL, CFNotificationSuspensionBehaviorCoalesce);
		
		// 及时加载
		// CHLoadClass(ClassToHook); // load class (that is "available now")
		// 稍后加载
		// CHLoadLateClass(ClassToHook);  // load class (that will be "available later")
		
		// 注册
		CHHook(0, ClassToHook, messageName); // register hook
		CHHook(2, ClassToHook, arg1, arg2); // register hook
	}
}

@class LCStartViewController;

CHDeclareClass(LCStartViewController); // declare class

CHOptimizedMethod(1, self, void, LCStartViewController, phoneLoginAction, id, value1) // hook method (with 2 arguments and a return value)
{
    // write code here ...
    
    NSLog(@"LCStartViewController hook");
    return CHSuper(1, LCStartViewController, phoneLoginAction, value1); // call old (original) method and return its return value
}

static void WillEnterForeground(CFNotificationCenterRef center, void *observer, CFStringRef name, const void *object, CFDictionaryRef userInfo)
{
    NSLog(@"进入前台");
    // not required; for example only
}

static void ExternallyPostedNotification(CFNotificationCenterRef center, void *observer, CFStringRef name, const void *object, CFDictionaryRef userInfo)
{
    // not required; for example only
}

CHConstructor // code block that runs immediately upon load
{
    @autoreleasepool
    {
        // listen for local notification (not required; for example only)
        CFNotificationCenterRef center = CFNotificationCenterGetLocalCenter();
        CFNotificationCenterAddObserver(center, NULL, WillEnterForeground, CFSTR("UIApplicationWillEnterForegroundNotification"), NULL, CFNotificationSuspensionBehaviorCoalesce);
        
        // listen for system-side notification (not required; for example only)
        // this would be posted using: notify_post("com.offcn.CRMHook.eventname");
        CFNotificationCenterRef darwin = CFNotificationCenterGetDarwinNotifyCenter();
        CFNotificationCenterAddObserver(darwin, NULL, ExternallyPostedNotification, CFSTR("com.offcn.CRMHook.eventname"), NULL, CFNotificationSuspensionBehaviorCoalesce);
        
         CHLoadLateClass(LCStartViewController);  // load class (that will be "available later")
        
        CHHook(1, LCStartViewController, phoneLoginAction); // register hook
    }
}