iOS tweak中添加第三方库

前几天在github上看到一个不错的第三方的调试库DBDebugToolkit，不过这是在开发环境中使用的，做为逆向新手的我想把它通过tweak添加到其它StoreApp中去练练手。

环境：

• iPhone6s (已越狱)
• iOS9.3.1
• 目标app：Instagram

Instagram

1. 打包静态库

如果直接向tweak中添加第三方开源库的话，那需要在Makefile 中把所有的.m文件都要写进去，太麻烦了，所以我感觉应该把开源库打包成framework或者静态库比较方便些。一开始想打包成framwork， 于是就按照大神的文章添加，但是不知什么原因一直加载不进去。

Reason: image not found

最后没法解决只能用静态库解决了。按照这里的方法生成静态库，加入到tweak可以正常加载。

注意：工程中默认是不加载静态库中的 category，这个库中正好使用了好多 category，需要在Makefile中添加tweakName_LDFLAGS += -all_load才能加载分类。

2. 添加bundle

DBDebugToolkit使用了大量的xib和storyboard来创建view，所以还需要把这些文件添加到tweak中，源程序中使用了bundle我们也打包bundle添加到tweak中：

bundle
bundle位置改变了，也需要更改库的源码：

+ (instancetype)debugToolkitBundle {
//    NSBundle *podBundle = [NSBundle bundleForClass:[DBDebugToolkit class]];
//    NSURL *bundleURL = [podBundle URLForResource:@"DBDebugToolkit" withExtension:@"bundle"];
//    return [NSBundle bundleWithURL:bundleURL];

    NSBundle *podBundle = [NSBundle bundleWithPath:@"/InsBundle/DBDebug.bundle"];
    return podBundle;
}

3. Hook并配置DBDebugToolkit

Hook程序AppDelegate方法配置DBDebugToolkit

%hook AppDelegate
- (_Bool)application:(id)arg1 didFinishLaunchingWithOptions:(id)arg2 {
    [DBDebug setup];
    return %orig;
}
%end

另外：不知道什么原因，DBDebugToolkit中的+ (IMP)replaceMethodWithSelector:(SEL)originalSelector block:(id)block方法调用一直不成功，所以我又对源码进行了更改，并且Tweak.xm也需要hook一些其它方法（如有大神知道什么原因欢迎留言交流）：

@implementation UIView (DBUserInterfaceToolkit)

#pragma mark - Method swizzling
- (void)hookInitMethod {
    [self db_refreshDebugBorders];
    [self db_registerForNotifications];
}

- (void)hookDellocMethod {
    [[NSNotificationCenter defaultCenter] removeObserver:self];
}
//+ (void)load {
//    static dispatch_once_t onceToken;
//    dispatch_once(&onceToken, ^{
//        __block IMP originalInitWithCoderIMP = [self replaceMethodWithSelector:@selector(initWithCoder:)
//                                                                         block:^UIView * (UIView *blockSelf, NSCoder *aDecoder) {
//                                                                            UIView *res = ((UIView * (*)(id, SEL, NSCoder *))originalInitWithCoderIMP)(blockSelf, @selector(initWithCoder:), aDecoder);
//                                                                            [res db_refreshDebugBorders];
//                                                                            [res db_registerForNotifications];
//                                                                            return res;
//                                                                         }];
//        __block IMP originalInitWithFrameIMP = [self replaceMethodWithSelector:@selector(initWithFrame:)
//                                                                         block:^UIView * (UIView *blockSelf, CGRect frame) {
//                                                                             UIView *res = ((UIView * (*)(id, SEL, CGRect))originalInitWithFrameIMP)(blockSelf, @selector(initWithCoder:), frame);
//                                                                             [res db_refreshDebugBorders];
//                                                                             [res db_registerForNotifications];
//                                                                             return res;
//                                                                         }];
//        __block IMP originalDeallocIMP = [self replaceMethodWithSelector:NSSelectorFromString(@"dealloc")
//                                                                   block:^(__unsafe_unretained UIView *blockSelf) {
//                                                                       [[NSNotificationCenter defaultCenter] removeObserver:blockSelf];
//                                                                       ((void (*)(id, SEL))originalDeallocIMP)(blockSelf, NSSelectorFromString(@"dealloc"));
//                                                                   }];
//    });
//}

@implementation UIWindow (DBShakeTrigger)

#pragma mark - Recognizing shake motion
//+ (void)load {
//    static dispatch_once_t onceToken;
//    dispatch_once(&onceToken, ^{
//        // Adding informing delegates about shake motion to the original implementation.
//        __block IMP originalIMP = [self replaceMethodWithSelector:@selector(motionEnded:withEvent:)
//                                                            block:^(UIWindow *blockSelf, UIEventSubtype motion, UIEvent *event) {
//                                                                if (motion == UIEventSubtypeMotionShake) {
//                                                                    [blockSelf.shakeDelegates makeObjectsPerformSelector:@selector(windowDidEndShakeMotion:) withObject:self];
//                                                                }
//                                                                ((void (*)(id, SEL, UIEventSubtype, UIEvent *))originalIMP)(blockSelf, @selector(motionEnded:withEvent:), motion, event);
//                                                            }];
//    });
//}

@implementation UIWindow (DBUserInterfaceToolkit)

#pragma mark - Method swizzling
//+ (void)load {
//    NSLog(@"load====DBUserInterfaceToolkit===========");
//    static dispatch_once_t onceToken;
//    dispatch_once(&onceToken, ^{
//        __block IMP originalIMP = [self replaceMethodWithSelector:@selector(sendEvent:)
//                                                            block:^(UIWindow *blockSelf, UIEvent *event) {
//                                                                if (event.type == UIEventTypeTouches) {
//                                                                    [blockSelf db_handleTouches:event.allTouches];
//                                                                }
//                                                                ((void (*)(id, SEL, UIEvent *))originalIMP)(blockSelf, @selector(sendEvent:), event);
//                                                            }];
//    });
//}

Tweak.xm

%hook UIResponder
- (void)motionEnded:(UIEventSubtype)motion withEvent:(UIEvent *)event {
    UIWindow* window = [UIApplication sharedApplication].keyWindow;
    if (motion == UIEventSubtypeMotionShake) {
        [[window shakeDelegates] makeObjectsPerformSelector:@selector(windowDidEndShakeMotion:) withObject:self];
    }
}
%end


%hook UIWindow
- (void)sendEvent:(UIEvent *)event {
    %orig;
    [self db_handleTouches:event.allTouches];
}
%end

%hook UIView
- (id)initWithCoder:(NSCoder *)aDecod {
    [self hookInitMethod];
    return %orig;
}
- (id)initWithFrame:(CGRect)aDecod {
    [self hookInitMethod];
    return %orig;
}

- (void)dealloc {
    [self hookDellocMethod];
    %orig;
}
%end

编译打包安装，成功：

image.png image.png image.png image.png image.png

其中的网络请求监控还是挺好的，对逆向app有一定帮助。

完

如有错误欢迎留言指正。

所有代码已上传github