导出的时候注意一下SpringBoard的路径,我这里导出ios5.0的如下:
class-dump -H /Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator5.0.sdk/System/Library/CoreServices/SpringBoard.app -o /Users/x/Desktop/SpringBoard
执行完命令之后就会生成.h文件了
然后把头文件拷贝到
/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS5.0.sdk/usr/include/SpringBoard/
并将substrate.h移动到/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS5.0.sdk/usr/include/目录下
substrate.h文件的代码如下:
- #ifndef SUBSTRATE_H_
- #define SUBSTRATE_H_
- #ifdef __cplusplus
- extern "C" {
- #endif
- #include <mach-o/nlist.h>
- #ifdef __cplusplus
- }
- #endif
- #include <objc/runtime.h>
- //#include <objc/message.h>
- #include <dlfcn.h>
- #ifdef __cplusplus
- #define _default(value) = value
- #else
- #define _default(value)
- #endif
- #ifdef __cplusplus
- extern "C" {
- #endif
- void MSHookFunction(void *symbol, void *replace, void **result);
- IMP MSHookMessage(Class _class, SEL sel, IMP imp, const char *prefix _default(NULL));
- #ifdef __cplusplus
- }
- #endif
- #ifdef __cplusplus
- template <typename Type_>
- static inline Type_ *MSHookMessage(Class _class, SEL sel, Type_ *imp, const char *prefix = NULL) {
- return reinterpret_cast<Type_ *>(MSHookMessage(_class, sel, reinterpret_cast<IMP>(imp), prefix));
- }
- template <typename Type_>
- static inline void MSHookFunction(Type_ *symbol, Type_ *replace, Type_ **result) {
- return MSHookFunction(
- reinterpret_cast<void *>(symbol),
- reinterpret_cast<void *>(replace),
- reinterpret_cast<void **>(result)
- );
- }
- template <typename Type_>
- static inline void MSHookFunction(Type_ *symbol, Type_ *replace) {
- return MSHookFunction(symbol, replace, reinterpret_cast<Type_ **>(NULL));
- }
- template <typename Type_>
- static inline void MSHookSymbol(Type_ *&value, const char *name, void *handle) {
- value = reinterpret_cast<Type_ *>(dlsym(handle, name));
- }
- template <typename Type_>
- static inline Type_ &MSHookIvar(id self, const char *name) {
- Ivar ivar(class_getInstanceVariable(object_getClass(self), name));
- void *pointer(ivar == NULL ? NULL : reinterpret_cast<char *>(self) + ivar_getOffset(ivar));
- return *reinterpret_cast<Type_ *>(pointer);
- }
- #endif
- #define MSHook(type, name, args...) \
- static type (*_ ## name)(args); \
- static type $ ## name(args) \
- #define Foundation_f "/System/Library/Frameworks/Foundation.framework/Foundation"
- #define UIKit_f "/System/Library/Frameworks/UIKit.framework/UIKit"
- #define JavaScriptCore_f "/System/Library/PrivateFrameworks/JavaScriptCore.framework/JavaScriptCore"
- #define IOKit_f "/System/Library/Frameworks/IOKit.framework/IOKit"
- #endif//SUBSTRATE_H_
然后把libsubstrate.dylib(网上下载)复制到:
/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS5.0.sdk/usr/lib/
目录下。
至此导入完成,剩下的就是在工程中加入libsubstrate.dylib,引入头文件了。
MobileSubstrate Dylib Template for Xcode
下载MobileSubstrate Dylib.zip并移动到:/Developer/Platforms/iPhoneOS.platform/Developer/Library/Xcode/Project Templates/Application目录下
xcode添加MobileSubstrateDylib开发模版这里没有测试成功,
方法:把MobileSubstrateDylib模版复制到
/Developer/Platforms/iPhoneOS.platform/Developer/Library/Xcode/Templates/Project Templates/Application目录下
然后新建工程即可看到MobileSubstrateDylib模版
之前的模板会出现在选项中
(PS:记得添加头文件substrate.h,已经添加framework---libsubstrate.dylib)
(PS:编译的时候选择Device)
编译好后,右键点击生成的app,选择显示包内容,给里面的程序添加后缀—.dylib,即:***.dylib
自己新建个后缀为.plist的同名文件,在里面添加要hook的应用
最后将dylib和同名的plist放到/Library/MobileSubstrate/DynamicLibraries目录下,重启springboard即可
参考资料:http://www.ifans.com/forums/threads/xcode-template-mobilesubstrate-dylib-template-for-xcode.163185/