ipa重签名2（.dylib注入）

最近在iPad上经常用”xx视频”客户端看视频，每个视频播放前总有时间不短的广告，非常不爽（尤其是视频2分钟，广告2分钟）。于是逆向了”xx视频”客户端，用theos写了一个Tweak；终于，可以在iPad(已越狱)上用“xx视频”客户端愉快的看视频了。
但是，想在非越狱设备上安装无广告版“xx视频”客户端该怎么办呢？
将在越狱设备上编写的Tweak注入到“xx视频”的可执行文件中，重签名、打包、安装完成。

正文：
上篇博客已经介绍了重签名技术，这里不再详细介绍相关步骤。

xxVideo: 已砸壳的“xx视频”可执行文件；
rexxvideo.dylib: 去广告插件工程中生成的动态库（make）;
libsubstrate.dylib: rexxvideo依赖的动态库文件，文件路径为/opt/theos/lib/；

步骤：
1、修改rexxvideo.dylib依赖库
1>查看rexxvideo.dylib的依赖库

localhost:xxVideo_HD xin$ otool -L rexxvideo.dylib
rexxvideo.dylib:
    /Library/MobileSubstrate/DynamicLibraries/rexxvideo.dylib (compatibility version 0.0.0, current version 0.0.0)
    /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
    /System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 1349.55.0)
    /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation (compatibility version 150.0.0, current version 1349.56.0)
    /Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate (compatibility version 0.0.0, current version 0.0.0)
    /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 307.5.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1238.50.2)

2>修改CydiaSubstrate依赖库为libsubstrate.dylib

install_name_tool -change /Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate @loader_path/libsubstrate.dylib rexxvideo.dylib

3>再次查看rexxvideo.dylib的依赖库

localhost:xxVideo_HD xin$ otool -L rexxvideo.dylib
rexxvideo.dylib:
    /Library/MobileSubstrate/DynamicLibraries/rexxvideo.dylib (compatibility version 0.0.0, current version 0.0.0)
    /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
    /System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 1349.55.0)
    /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation (compatibility version 150.0.0, current version 1349.56.0)
    @loader_path/libsubstrate.dylib (compatibility version 0.0.0, current version 0.0.0)
    /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 307.5.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1238.50.2)

OK!修改成功。

2、给rexxvideo.dylib和libsubstrate.dylib重签名

localhost:xxVideo_HD xin$ codesign -f -s "iPhone Developer: xxx xxx (3MXB5W5VUZ)" libsubstrate.dylib
libsubstrate.dylib: replacing existing signature
localhost:xxVideo_HD xin$ codesign -f -s "iPhone Developer: xxx xxx (3MXB5W5VUZ)" rexxvideo.dylib

3、注入：
用工具yololib,将rexxvideo.dylib注入到xxVideo中。

localhost:xxVideo_HD xin$ ./yololib xxVideo rexxvideo.dylib
2017-08-24 11:24:48.062 yololib[3993:55619] dylib path @executable_path/rexxvideo.dylib
2017-08-24 11:24:48.063 yololib[3993:55619] dylib path @executable_path/rexxvideo.dylib
Reading binary: xxVideo

2017-08-24 11:24:48.063 yololib[3993:55619] Thin 64bit binary!
2017-08-24 11:24:48.063 yololib[3993:55619] dylib size wow 64
2017-08-24 11:24:48.063 yololib[3993:55619] mach.ncmds 65
2017-08-24 11:24:48.063 yololib[3993:55619] mach.ncmds 66
2017-08-24 11:24:48.063 yololib[3993:55619] Patching mach_header..
2017-08-24 11:24:48.063 yololib[3993:55619] Attaching dylib..

2017-08-24 11:24:48.063 yololib[3993:55619] size 56
2017-08-24 11:24:48.063 yololib[3993:55619] complete!

3、Payload/xxxx.app/中的可执行文件替换为xxVideo(已注入rexxvideo.dylib)，
将rexxvideo.dylib、libsubstrate.dylib拷贝到Payload/xxxx.app/中。

localhost:xxVideo_HD xin$ cp xxVideo Payload/xxxx.app/xxxx
localhost:xxVideo_HD xin$ cp libsubstrate.dylib Payload/xxxx.app/
localhost:xxVideo_HD xin$ cp rexxvideo.dylib Payload/xxxx.app/

4、重签名（这里不再详述）,打包 ,安装

localhost:xxVideo_HD xin$ rm -rf Payload/xxxx.app/_CodeSignature
localhost:xxVideo_HD xin$ cp embedded.mobileprovision Payload/xxxx.app/
localhost:xxVideo_HD xin$ codesign -f -s "iPhone Developer: xxx xxx (3MXB5W5VUZ)" --entitlements "entitlements.plist" Payload/xxxx.app
Payload/xxxx.app: replacing existing signature

localhost:xxVideo_HD xin$ zip -r xxVideo.ipa Payload

localhost:xxVideo_HD xin$ mobiledevice install_app xxVideo.ipa
OK

OK，安装成功。

其他：
在iPad设备上运行该客户端直接崩溃，在Xcode查看崩溃日志为：

Aug 24 11:30:04 lide-iPad ReportCrash(CrashReporterSupport)[4853] <Notice>: Exception Type:  EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Exception Note:  EXC_CORPSE_NOTIFY
Termination Description: DYLD, Library not loaded: @executable_path/rexxvideo.dylib | Referenced from: /var/containers/Bundle/Application/9BC4363C-7A5A-4C57-ACC2-606CFB8DBB4A/qqlive.app/qqlive | Reason: Incompatible library version: qqlive requires version 1.0.0 or later, but rexxvideo.dylib provides version 0.0.0
Triggered by Thread:  0

根据日志判断崩溃的原因是因为版本号不对。
OK,我们通过MachOView修改rexxvideo.dylib的版本号，修改结果如下：

localhost:qqlive.app xin$ otool -L rexxvideo.dylib
rexxvideo.dylib:
    /Library/MobileSubstrate/DynamicLibraries/rexxvideo.dylib (compatibility version 1.0.0, current version 1.0.0)
    /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
    /System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 1349.55.0)
    /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation (compatibility version 150.0.0, current version 1349.56.0)
    @loader_path/libsubstrate.dylib (compatibility version 0.0.0, current version 0.0.0)
    /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 307.5.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1238.50.2)

然后重新签名rexxvideo.dylib，
拷贝到Payload/xxxx.app/中，
重签名，
打包，
安装，
运行成功。

参考：

http://blog.csdn.net/b719426297/article/details/77528786
http://www.iosre.com/t/dylib/5056
https://github.com/KJCracks/yololib
https://github.com/aDreamCatcher/MachOView