最近在iPad上经常用”xx视频”客户端看视频,每个视频播放前总有时间不短的广告,非常不爽(尤其是视频2分钟,广告2分钟)。于是逆向了”xx视频”客户端,用theos写了一个Tweak;终于,可以在iPad(已越狱)上用“xx视频”客户端愉快的看视频了。
但是,想在非越狱设备上安装无广告版“xx视频”客户端该怎么办呢?
将在越狱设备上编写的Tweak注入到“xx视频”的可执行文件中,重签名、打包、安装完成。
正文:
上篇博客已经介绍了重签名技术,这里不再详细介绍相关步骤。
xxVideo: 已砸壳的“xx视频”可执行文件;
rexxvideo.dylib: 去广告插件工程中生成的动态库(make);
libsubstrate.dylib: rexxvideo依赖的动态库文件,文件路径为/opt/theos/lib/;
步骤:
1、修改rexxvideo.dylib依赖库
1>查看rexxvideo.dylib的依赖库
localhost:xxVideo_HD xin$ otool -L rexxvideo.dylib
rexxvideo.dylib:
/Library/MobileSubstrate/DynamicLibraries/rexxvideo.dylib (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 1349.55.0)
/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation (compatibility version 150.0.0, current version 1349.56.0)
/Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 307.5.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1238.50.2)
2>修改CydiaSubstrate依赖库为libsubstrate.dylib
install_name_tool -change /Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate @loader_path/libsubstrate.dylib rexxvideo.dylib
3>再次查看rexxvideo.dylib的依赖库
localhost:xxVideo_HD xin$ otool -L rexxvideo.dylib
rexxvideo.dylib:
/Library/MobileSubstrate/DynamicLibraries/rexxvideo.dylib (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 1349.55.0)
/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation (compatibility version 150.0.0, current version 1349.56.0)
@loader_path/libsubstrate.dylib (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 307.5.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1238.50.2)
OK!修改成功。
2、给rexxvideo.dylib和libsubstrate.dylib重签名
localhost:xxVideo_HD xin$ codesign -f -s "iPhone Developer: xxx xxx (3MXB5W5VUZ)" libsubstrate.dylib
libsubstrate.dylib: replacing existing signature
localhost:xxVideo_HD xin$ codesign -f -s "iPhone Developer: xxx xxx (3MXB5W5VUZ)" rexxvideo.dylib
3、注入:
用工具yololib,将rexxvideo.dylib注入到xxVideo中。
localhost:xxVideo_HD xin$ ./yololib xxVideo rexxvideo.dylib
2017-08-24 11:24:48.062 yololib[3993:55619] dylib path @executable_path/rexxvideo.dylib
2017-08-24 11:24:48.063 yololib[3993:55619] dylib path @executable_path/rexxvideo.dylib
Reading binary: xxVideo
2017-08-24 11:24:48.063 yololib[3993:55619] Thin 64bit binary!
2017-08-24 11:24:48.063 yololib[3993:55619] dylib size wow 64
2017-08-24 11:24:48.063 yololib[3993:55619] mach.ncmds 65
2017-08-24 11:24:48.063 yololib[3993:55619] mach.ncmds 66
2017-08-24 11:24:48.063 yololib[3993:55619] Patching mach_header..
2017-08-24 11:24:48.063 yololib[3993:55619] Attaching dylib..
2017-08-24 11:24:48.063 yololib[3993:55619] size 56
2017-08-24 11:24:48.063 yololib[3993:55619] complete!
3、Payload/xxxx.app/中的可执行文件替换为xxVideo(已注入rexxvideo.dylib),
将rexxvideo.dylib、libsubstrate.dylib拷贝到Payload/xxxx.app/中。
localhost:xxVideo_HD xin$ cp xxVideo Payload/xxxx.app/xxxx
localhost:xxVideo_HD xin$ cp libsubstrate.dylib Payload/xxxx.app/
localhost:xxVideo_HD xin$ cp rexxvideo.dylib Payload/xxxx.app/
4、重签名(这里不再详述),打包 ,安装
localhost:xxVideo_HD xin$ rm -rf Payload/xxxx.app/_CodeSignature
localhost:xxVideo_HD xin$ cp embedded.mobileprovision Payload/xxxx.app/
localhost:xxVideo_HD xin$ codesign -f -s "iPhone Developer: xxx xxx (3MXB5W5VUZ)" --entitlements "entitlements.plist" Payload/xxxx.app
Payload/xxxx.app: replacing existing signature
localhost:xxVideo_HD xin$ zip -r xxVideo.ipa Payload
localhost:xxVideo_HD xin$ mobiledevice install_app xxVideo.ipa
OK
OK,安装成功。
其他:
在iPad设备上运行该客户端直接崩溃,在Xcode查看崩溃日志为:
Aug 24 11:30:04 lide-iPad ReportCrash(CrashReporterSupport)[4853] <Notice>: Exception Type: EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Exception Note: EXC_CORPSE_NOTIFY
Termination Description: DYLD, Library not loaded: @executable_path/rexxvideo.dylib | Referenced from: /var/containers/Bundle/Application/9BC4363C-7A5A-4C57-ACC2-606CFB8DBB4A/qqlive.app/qqlive | Reason: Incompatible library version: qqlive requires version 1.0.0 or later, but rexxvideo.dylib provides version 0.0.0
Triggered by Thread: 0
根据日志判断崩溃的原因是因为版本号不对。
OK,我们通过MachOView修改rexxvideo.dylib的版本号,修改结果如下:
localhost:qqlive.app xin$ otool -L rexxvideo.dylib
rexxvideo.dylib:
/Library/MobileSubstrate/DynamicLibraries/rexxvideo.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 1349.55.0)
/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation (compatibility version 150.0.0, current version 1349.56.0)
@loader_path/libsubstrate.dylib (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 307.5.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1238.50.2)
然后重新签名rexxvideo.dylib,
拷贝到Payload/xxxx.app/中,
重签名,
打包,
安装,
运行成功。
参考:
http://blog.csdn.net/b719426297/article/details/77528786
http://www.iosre.com/t/dylib/5056
https://github.com/KJCracks/yololib
https://github.com/aDreamCatcher/MachOView