一、Theos配置

Theos 是一個(gè)不需要使用Xcode就能管理，開(kāi)發(fā)和部署iOS軟件的跨平臺(tái)開(kāi)發(fā)工具。進(jìn)行越獄iOS開(kāi)發(fā)擴(kuò)展或者調(diào)整時(shí)，Theos是一件非常重要的工具，很多越獄開(kāi)發(fā)都使用了這個(gè)工具。
推薦配置在自己的家目錄，不要配置在/opt目錄。

Theos的安裝可以參考

1.1 ldid

ldid是專門(mén)用來(lái)簽名iOS可執(zhí)行文件的工具，用來(lái)代替Xcode的codesign。專門(mén)用于越獄插件的簽名。theos開(kāi)發(fā)插件依賴ldid。

1.2 nic.pl

?  ~ nic.pl
NIC 2.0 - New Instance Creator
------------------------------
  [1.] iphone/activator_event
  [2.] iphone/activator_listener
  [3.] iphone/application_modern
  [4.] iphone/application_swift
  [5.] iphone/cydget
  [6.] iphone/flipswitch_switch
  [7.] iphone/framework
  [8.] iphone/library
  [9.] iphone/notification_center_widget
  [10.] iphone/notification_center_widget-7up
  [11.] iphone/preference_bundle_modern
  [12.] iphone/theme
  [13.] iphone/tool
  [14.] iphone/tool_swift
  [15.] iphone/tweak
  [16.] iphone/tweak_with_simple_preferences
  [17.] iphone/xpc_service
Choose a Template (required):

nic.pl出現(xiàn)選擇模板則配置成功了。

二、動(dòng)態(tài)調(diào)試支付寶

2.1 動(dòng)態(tài)分析支付寶登錄密碼

2.1.1 分析登錄點(diǎn)擊邏輯

使用手機(jī)端cycript附加支付寶進(jìn)程

zaizai:~ root# cycript -p AlipayWallet
cy# HPCurrentVC()
#"<ALULoginContainerController: 0x10bd75560>"
cy# #0x10bd75560.view.recursiveDescription().toString()

搜索下輸入的密碼123456：

image.png

再搜索下登錄（由于編碼問(wèn)題，先在python環(huán)境中轉(zhuǎn)碼再搜索）：

>>> str = u"登錄"
>>> str
u'\u767b\u5f55'
>>>

image.png

查看AUButton 0x12098c9c0 的allTargets：

cy# #0x12098c9c0.allTargets
[NSSet setWithArray:@[#"<ALUAccuratePWDView: 0x121cad170; frame = (0 0; 375 667); layer = <CALayer: 0x2838424a0>>",#"<AUButton: 0x12098c9c0; baseClass = UIButton; frame = (16 367.5; 343 51); clipsToBounds = YES; opaque = NO; layer = <CALayer: 0x2839c89c0>>"]]]

一個(gè)是自己，一個(gè)是ALUAccuratePWDView 0x121cad170。也就是登錄按鈕點(diǎn)擊事件調(diào)用了ALUAccuratePWDView的方法。

查看AUButton 0x12098c9c0 的allControlEvents：

cy# #0x12098c9c0.allControlEvents
64

這里的64就是2⁶。

   UIControlEventTouchUpInside           = 1 <<  6,

查看AUButton 0x12098c9c0 調(diào)用的的ALUAccuratePWDView 0x121cad170對(duì)象的方法actionsForTarget: forControlEvent:：

cy# [#0x12098c9c0 actionsForTarget:#0x121cad170 forControlEvent:64]
@["onNext"]

這樣就獲取到了登錄按鈕(AUButton)點(diǎn)擊調(diào)用了ALUAccuratePWDView的onNext方法。
dump頭文件獲取onNext方法如下：

- (void)onNext;

所以Hook代碼如下：

%hook ALUAccuratePWDView

- (void)onNext {
    
}

%end

2.1.2 分析密碼邏輯

上面已經(jīng)找到了登錄按鈕調(diào)用方法，接下來(lái)要分析輸入框。對(duì)于輸入框aluTextField 0x10cadf800在aluInputBox 0x121cb4b40中。
而在ALUAccuratePWDView 0x121cad170中有如下代碼：

@property(retain, nonatomic) aluLoginBox *loginBox; // @synthesize loginBox=_loginBox;

那么aluInputBox應(yīng)該和aluLoginBox有關(guān)，在aluLoginBox中有如下代碼：

    aluInputBox *_loginIdInputBox;
    aluInputBox *_passwordInputBox;

在aluInputBox中正好有一個(gè)aluTextField：

    aluTextField *_textField;

那么猜測(cè)_passwordInputBox應(yīng)該就是aluInputBox 0x121cb4b40。
總結(jié)：在ALUAccuratePWDView 0x121cad170 -> _loginBox -> _passwordInputBox->_textField

驗(yàn)證

cy# #0x121cad170->_loginBox->_passwordInputBox->_textField
#"<aluTextField: 0x10cadf800; baseClass = UITextField; frame = (2 0; 220.5 45); text = '123456'; opaque = NO; autoresize = W; tintColor = UIExtendedSRGBColorSpace 0.0862745 0.466667 1 1; gestureRecognizers = <NSArray: 0x283e19590>; placeholder = \xe8\xaf\xb7\xe8\xbe\x93\xe5\x85\xa5\xe7\x99\xbb\xe5\xbd\x95\xe5\xaf\x86\xe7\xa0\x81; borderStyle = None; background = <_UITextFieldNoBackgroundProvider: 0x28319de40: textfield=<aluTextField 0x10cadf800>>; layer = <CALayer: 0x2838400a0>>"

aluTextField: 0x10cadf800就是密碼輸入框：

image.png

所以獲取密碼的方式為：self -> _loginBox -> _passwordInputBox->_textField
同理可以獲得登錄賬戶：self-> _labelLoginID
修改Hook代碼如下：

%hook ALUAccuratePWDView

- (void)onNext {
//賬戶
//self-> _loginBox->_loginIdInputBox-> _textField
//密碼
//self -> _labelLoginID
}

%end

2.2 Theos獲取支付寶密碼

2.2.1 創(chuàng)建Tweak工程

?  HPProject nic.pl
NIC 2.0 - New Instance Creator
------------------------------
  [1.] iphone/activator_event
  [2.] iphone/activator_listener
  [3.] iphone/application_modern
  [4.] iphone/application_swift
  [5.] iphone/cydget
  [6.] iphone/flipswitch_switch
  [7.] iphone/framework
  [8.] iphone/library
  [9.] iphone/notification_center_widget
  [10.] iphone/notification_center_widget-7up
  [11.] iphone/preference_bundle_modern
  [12.] iphone/theme
  [13.] iphone/tool
  [14.] iphone/tool_swift
  [15.] iphone/tweak
  [16.] iphone/tweak_with_simple_preferences
  [17.] iphone/xpc_service
Choose a Template (required): 15
Project Name (required): AlipayHook
Package Name [com.yourcompany.alipayhook]: com.hotpotcat.alipayhook
Author/Maintainer Name [ZP]:
[iphone/tweak] MobileSubstrate Bundle filter [com.apple.springboard]: com.alipay.iphoneclient
[iphone/tweak] List of applications to terminate upon installation (space-separated, '-' for none) [SpringBoard]: AlipayWallet
Instantiating iphone/tweak in alipayhook/...
Done.

• tweak：15代表創(chuàng)建插件。
• Project Name：工程名。
• Package Name：包名稱，都小寫(xiě)不能駝峰。
• Author/Maintainer Name：不填默認(rèn)電腦名稱
• [iphone/tweak] MobileSubstrate Bundle filter [com.apple.springboard]：要附加的進(jìn)程（BundleId），不寫(xiě)默認(rèn)springboard。
• [iphone/tweak] List of applications to terminate upon installation (space-separated, '-' for none) [SpringBoard]：插件安裝后要?dú)⒌舻倪M(jìn)程。默認(rèn)SpringBoard。??推薦給默認(rèn)值，給應(yīng)用進(jìn)程有可能Hook失敗殺不掉App。

這樣就創(chuàng)建了插件工程了。

BundleId獲取

zaizai:~ root# cycript -p AlipayWallet
cy# APPID
@"com.alipay.iphoneclient"

2.2.2 Tweak工程配置

工程結(jié)構(gòu)如下：

image.png

• .plist中是包的名稱

{ Filter = { Bundles = ( "com.alipay.iphoneclient" ); }; }

• control是關(guān)于工程配置。版本號(hào)等相關(guān)信息。
• makefile是編譯配置
  安裝到手機(jī)是走的SSH安裝， 需要增加配置設(shè)置IP和端口號(hào)。這里配置的是走的USB

export THEOS_DEVICE_IP=localhost
export THEOS_DEVICE_PORT=12345

IP和端口號(hào)配置

可以配置到.zshrc中，這樣不用每個(gè)工程都配置了。

• Tweak.x是寫(xiě)logos hook代碼的地方，一般會(huì)將后綴改為.xm 。需要同時(shí)修改makefile的AlipayHook_FILES = Tweak.xm。

2.2.3 Hook代碼

#import <UIKit/UIKit.h>

%hook ALUAccuratePWDView

- (void)onNext {
    NSLog(@"\n\n\n??????????????\n\n\n");
    UIView *loginBox = MSHookIvar<UIView*>(self,"_loginBox");
    //賬戶
    //self-> _labelLoginID
    UILabel *labelLoginID = MSHookIvar<UILabel *>(self,"_labelLoginID");
    NSString *accountStr = labelLoginID.text;
    NSLog(@"賬戶：%@",accountStr);
    //密碼
    //self -> _loginBox -> _passwordInputBox->_textField
    UIView *passwordInputBox = MSHookIvar<UIView *>(loginBox,"_passwordInputBox");
    UITextField *pwdTextField = MSHookIvar<UITextField *>(passwordInputBox,"_textField");
    NSString *pwdStr = pwdTextField.text;
    NSLog(@"密碼：%@",pwdStr);
    NSLog(@"\n\n\n??????????????\n\n\n");
}

%end

2.2.4 編譯、打包、安裝

編譯make

?  alipayhook make
==> Notice: Build may be slow as Theos isn’t using all available CPU cores on this computer. Consider upgrading GNU Make: https://github.com/theos/theos/wiki/Parallel-Building
> Making all for tweak AlipayHook…
==> Preprocessing Tweak.xm…
==> Compiling Tweak.xm (armv7)…
==> Linking tweak AlipayHook (armv7)…
ld: warning: building for iOS, but linking in .tbd file (/Users/zaizai/.HotpotCat/theos/vendor/lib/CydiaSubstrate.framework/CydiaSubstrate.tbd) built for iOS Simulator
==> Generating debug symbols for AlipayHook…
rm /Users/zaizai/HPProject/alipayhook/.theos/obj/debug/armv7/Tweak.xm.mm
==> Preprocessing Tweak.xm…
==> Compiling Tweak.xm (arm64)…
==> Linking tweak AlipayHook (arm64)…
ld: warning: building for iOS, but linking in .tbd file (/Users/zaizai/.HotpotCat/theos/vendor/lib/CydiaSubstrate.framework/CydiaSubstrate.tbd) built for iOS Simulator
==> Generating debug symbols for AlipayHook…
rm /Users/zaizai/HPProject/alipayhook/.theos/obj/debug/arm64/Tweak.xm.mm
==> Merging tweak AlipayHook…
==> Signing AlipayHook…

打包make package

?  alipayhook make package
==> Notice: Build may be slow as Theos isn’t using all available CPU cores on this computer. Consider upgrading GNU Make: https://github.com/theos/theos/wiki/Parallel-Building
> Making all for tweak AlipayHook…
make[2]: Nothing to be done for `internal-library-compile'.
> Making stage for tweak AlipayHook…
dm.pl: building package `com.hotpotcat.alipayhook:iphoneos-arm' in `./packages/com.hotpotcat.alipayhook_0.0.1-1+debug_iphoneos-arm.deb'

打包完成后生成.deb文件。

安裝 make install

?  alipayhook make install
==> Installing…
Selecting previously unselected package com.hotpotcat.alipayhook.
(Reading database ... 1927 files and directories currently installed.)
Preparing to unpack /tmp/_theos_install.deb ...
Unpacking com.hotpotcat.alipayhook (0.0.1-4+debug) ...
Setting up com.hotpotcat.alipayhook (0.0.1-4+debug) ...
==> Unloading AlipayWallet…

安裝好之后正常對(duì)應(yīng)的進(jìn)程會(huì)被殺掉，安裝的插件會(huì)出現(xiàn)在cydia的已安裝中:

AlipayHook插件

• make編譯
• make package打包
• make install安裝
• 工程目錄中不能有中文
• make clean清空緩存
• 如果有多個(gè)XCode需要選擇XCode。

?  alipayhook xcode-select -p
/Applications/Xcode.app/Contents/Developer
?  alipayhook xcode-select --switch /Applications/Xcode.app/Contents/Developer

??在makefile同級(jí)目錄編譯。
make package;make install可以同時(shí)進(jìn)行。
如果安裝沒(méi)有殺掉進(jìn)程，發(fā)現(xiàn)沒(méi)有Hook成功，那么創(chuàng)建工程的時(shí)候直接
[iphone/tweak] List of applications to terminate upon installation (space-separated, '-' for none) [SpringBoard]直接給默認(rèn)值SpringBoard。

運(yùn)行

通過(guò)console查看日志看是否獲取賬戶密碼成功。

image.png