%hook

指定需要hook的class,必須以％end結(jié)尾。

// hook SpringBoard類里面的_menuButtonDown函數(shù),先打印一句話,再之子那個(gè)函數(shù)原始的操作
%hook SpringBorad
- (void)_menuButtonDown:(id)down
{
    NSLog(@"111111");
   %orig; // 調(diào)用原始的_menuButtonDown函數(shù)
}
%end

%log

該指令在%hook內(nèi)部使用，將函數(shù)的類名、參數(shù)等信息寫入syslog,可以％log([(),…..])的格式追加其他打印信息。

%hook SpringBorad
- (void)_menuButtonDown:(id)down
{
    %log((NSString *)@"iosre",(NSString *)@"Debug");
    %orig; // 調(diào)用原始的_menuButtonDown方法
}
%end

%orig

該指令在%hook內(nèi)部使用，執(zhí)行被hook的函數(shù)的原始代碼；也可以用％orig更改原始函數(shù)的參數(shù)。

%hook SpringBorad
- (void)setCustomSubtitleText:(id)arg1 withColor:   (id)arg2
{
    %orig(@"change arg2",arg2);// 將arg2的參數(shù)修 改為"change arg2"
}
%end

%group

該指令用于將%hook分組，便于代碼管理及按條件初始化分組，必須以%end結(jié)尾。
一個(gè)％group可以包含多個(gè)%hook,所有不屬于某個(gè)自定義group的％hook會(huì)被隱式歸類到％group_ungrouped中。

/*
在%group iOS7Hook中鉤住iOS7Class的iOS7Method,在%group iOS8Class中鉤住iOS8Method函數(shù),然后在%group _ungroup中鉤住SpringBoard類的powerDown函數(shù).
*/
%group iOS7Hook
%hook iOS7Class
- (id)ios7Method
{
    id result = %orig;
    NSLog(@"這個(gè)方法只有iOS7適用");
    return result;
}
%end
%end // iOS7Method

%group iOS8Hook
%hook iOS8Class
- (id)ios8Method
{
    id result = %orig;
    NSLog(@"這個(gè)方法只有iOS7適用");
    return result;
}
%end
%end // iOS8Method

%hook SpringBoard
- (void)powerDown
{
     %orig;
}
%end

%init

該指令用于初始化某個(gè)％group，必須在%hook或％ctor內(nèi)調(diào)用；如果帶參數(shù)，則初始化指定的group，如果不帶參數(shù)，則初始化_ungrouped.
注：
切記，只有調(diào)用了％init,對(duì)應(yīng)的%group才能起作用！

#ifndef KCFCoreFoundationVersionNumber_iOS_8_0
#define KCFCoreFoundationVersionNumber_iOS_8_0      1140.10
#endif

- (void)applicationDidFinishLaunching:(UIApplication    *)application
{
    %orig;

    %init; // Equals to init(_ungrouped)

    if (KCFCoreFoundationVersionNumber >=   KCFCoreFoundationVersionNumber_iOS_7_0 &&   KCFCoreFoundationVersionNumber >    KCFCoreFoundationVersionNumber_iOS_8_0)
        %init(iOS7Hook);
    if (KCFCoreFoundationVersionNumber >= KCFCoreFoundationVersionNumber_iOS_8_0)
        %init(iOS8Hook);
}
%end

%ctor

tweak的constructor,完成初始化工作；如果不顯示定義，Theos會(huì)自動(dòng)生成一個(gè)%ctor,并在其中調(diào)用%init(_ungrouped)。%ctor一般可以用來(lái)初始化%group,以及進(jìn)行MSHookFunction等操作,如下:

#ifndef KCFCoreFoundationVersionNumber_iOS_8_0
#define KCFCoreFoundationVersionNumber_iOS_8_0      1140.10
#endif

%ctor
{
    %init;

    if (KCFCoreFoundationVersionNumber >= KCFCoreFoundationVersionNumber_iOS_7_0 && KCFCoreFoundationVersionNumber > KCFCoreFoundationVersionNumber_iOS_8_0)
    %init(iOS7Hook);
    if (KCFCoreFoundationVersionNumber >= KCFCoreFoundationVersionNumber_iOS_8_0)
    %init(iOS8Hook);
    MSHookFunction((void *)&AudioServicesPlaySystemSound,(void *)&replaced_AudioServerPlaySystemSound,(void **)&orginal_AudioServicesPlaySystemSound);
}

%new

在%hook內(nèi)部使用，給一個(gè)現(xiàn)有class添加新函數(shù)，功能與class_addMethod相同.

注：
Objective-C的category與class_addMethod的區(qū)別：
前者是靜態(tài)的而后者是動(dòng)態(tài)的。使用%new添加,而不需要向.h文件中添加函數(shù)聲明,如果使用category,可能與遇到這樣那樣的錯(cuò)誤.

%hook SpringBoard
%new
- (void)addNewMethod
{
    NSLog(@"動(dòng)態(tài)添加一個(gè)方法到SpringBoard");
}
%end

%c

該指令的作用等同于objc_getClass或NSClassFromString,即動(dòng)態(tài)獲取一個(gè)類的定義，在%hook或％ctor內(nèi)使用 。 動(dòng)態(tài)獲取一個(gè)類,如果用’+’標(biāo)記,則獲取類的對(duì)象,如果用’-’標(biāo)記則獲取實(shí)例對(duì)象,默認(rèn)是’-’

%property

Add a property to a %subclass just like you would with @property to a normal Objective-C subclass as well as adding new properties to existing classes within %hook.

%property (nonatomic|assign|retain|copy|weak|strong|getter|setter) Type name;

%subclass

Subclass block - the class is created at runtime and populated with methods. ivars are not yet supported (use associated objects). The %new specifier is needed for a method that doesn't exist in the superclass. To instantiate an object of the new class, you can use the %c operator.

Can be inside a %group block.

%subclass MyObject : NSObject

- (id)init {
    self = %orig;
    [self setSomeValue:@"value"];
    return self;
}

//the following two new methods act as `@property (nonatomic, retain) id someValue;`
%new
- (id)someValue {
    return objc_getAssociatedObject(self, @selector(someValue));
}

%new
- (void)setSomeValue:(id)value {
    objc_setAssociatedObject(self, @selector(someValue), value, OBJC_ASSOCIATION_RETAIN_NONATOMIC);
}

%end

%ctor {
    MyObject *myObject = [[%c(MyObject) alloc] init];
    NSLog(@"myObject: %@", [myObject someValue]);
}