【iOS逆向】一、逆向内容简介与越狱环境搭建

2020-03-13  本文已影响0人  Travelcolor

总体内容

1、逆向课程简介
2、学习逆向的条件
3、iOS越狱（iOS Jailbreak）的优点和缺点
4、完美越狱和非完美越狱以及如何判断是否越狱成功？
5、Cydia(越狱后的AppStore)
6、iPhone/Mac必备软件安装以及安装包
7、代码判断设备是否越狱

一、逆向课程简介

二、学习逆向的条件

三、iOS越狱(iOS Jailbreak)的优点和缺点

四、完美越狱和不完美越狱

注意：Cydia 出现无法加载网络的解决办法

Cydia 无法加载网络
Cydia正常打开的页面

**五、Cydia(越狱后的App Store)

六、iphone/Mac必备软件安装以及安装包

  • iFunBox：http://dl.i-funbox.com/管理文件系统
  • 爱思助手：自由安装海量APP;卸载APP;备份APP为ipa安装包

七、代码判断设备是否越狱,参考博客一和参考博客二，手机是否越狱判断的 demo

const char* jailbreak_tool_pathes[] = {
   "/Applications/Cydia.app",
   "/Applications/limera1n.app",
   "/Applications/greenpois0n.app",
   "/Applications/blackra1n.app",
   "/Applications/blacksn0w.app",
   "/Applications/redsn0w.app",
   "/Applications/Absinthe.app",
   "/Library/MobileSubstrate/MobileSubstrate.dylib",
   "/bin/bash",
   "/usr/sbin/sshd",
   "/etc/apt",
   "/private/var/lib/apt/",
   NULL,
 };

+(BOOL)isJailBreak1
{
     for (int i=0; i<ARRAY_SIZE(jailbreak_tool_pathes); i++) {
         if ([[NSFileManager defaultManager] fileExistsAtPath:[NSString stringWithUTF8String:jailbreak_tool_pathes[i]]]) {
             NSLog(@"The device is jail broken!");
             return YES;
         }
      }
     NSLog(@"The device is NOT jail broken!");
     return NO;
}

+(BOOL)isJailBreak2{

    if ([[UIApplication sharedApplication] canOpenURL:[NSURL URLWithString:@"cydia://"]]) {
          NSLog(@"The device is jail broken!");
          return YES;
    }
    NSLog(@"The device is NOT jail broken!");
    return NO;
}

+(BOOL)isJailBreak3{
    if ([[NSFileManager defaultManager] fileExistsAtPath:@"User/Applications/"]) {
        NSLog(@"The device is jail broken!");
        NSArray *appList = [[NSFileManager defaultManager] contentsOfDirectoryAtPath:@"User/Applications/" error:nil];
        NSLog(@"appList = %@", appList);
        return YES;
     }
     NSLog(@"The device is NOT jail broken!");
     return NO;
}

#import <sys/stat.h>  

+(BOOL)isJailBreak4
{
   struct stat stat_info;
   if (0 == stat("/Applications/Cydia.app", &stat_info)) {
      NSLog(@"Device is jailbroken");
      return YES;
   }

   return NO;
}

7.6、判断设备是否越狱五：攻击者可能会利用 Fishhook原理 hook了stat。那么，你可以看看stat是不是出自系统库，有没有被攻击者换掉：

#import <dlfcn.h>  

+(BOOL)isJailBreak5
{
   int ret ;
   Dl_info dylib_info;
   int (*func_stat)(const char *, struct stat *) = stat;
   if ((ret = dladdr(func_stat, &dylib_info))) {
        NSLog(@"lib :%s", dylib_info.dli_fname);
        return YES;
   }
   return NO;
}

7.7、判断设备是否越狱六：读取环境变量这个DYLD_INSERT_LIBRARIES环境变量，在非越狱的机器上应该是空，越狱的机器上基本都会有Library/MobileSubstrate/MobileSubstrate.dylib

char* printEnv(void) {
   char *env = getenv("DYLD_INSERT_LIBRARIES");
   return env;
}
+(BOOL)isJailBreak6{
   if (printEnv()) {
      NSLog(@"The device is jail broken!");
      return YES;
   }
   NSLog(@"The device is NOT jail broken!");
   return NO;
}

此文参考【IIronMan简书】

上一篇 下一篇

猜你喜欢

热点阅读