导出的时候注意一下SpringBoard的路径,我这里导出ios5.0的如下:
class-dump -H /Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator5.0.sdk/System/Library/CoreServices/SpringBoard.app -o /Users/x/Desktop/SpringBoard
执行完命令之后就会生成.h文件了
然后把头文件拷贝到
/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS5.0.sdk/usr/include/SpringBoard/
并将substrate.h移动到/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS5.0.sdk/usr/include/目录下
substrate.h文件的代码如下:
#ifndef SUBSTRATE_H_
#define SUBSTRATE_H_
#ifdef __cplusplus
extern "C" {
#endif
#include <mach-o/nlist.h>
#ifdef __cplusplus
}
#endif
#include <objc/runtime.h>
//#include <objc/message.h>
#include <dlfcn.h>
#ifdef __cplusplus
#define _default(value) = value
#else
#define _default(value)
#endif
#ifdef __cplusplus
extern "C" {
#endif
void MSHookFunction(void *symbol, void *replace, void **result);
IMP MSHookMessage(Class _class, SEL sel, IMP imp, const char *prefix _default(NULL));
#ifdef __cplusplus
}
#endif
#ifdef __cplusplus
template <typename Type_>
static inline Type_ *MSHookMessage(Class _class, SEL sel, Type_ *imp, const char *prefix = NULL) {
return reinterpret_cast<Type_ *>(MSHookMessage(_class, sel, reinterpret_cast<IMP>(imp), prefix));
}
template <typename Type_>
static inline void MSHookFunction(Type_ *symbol, Type_ *replace, Type_ **result) {
return MSHookFunction(
reinterpret_cast<void *>(symbol),
reinterpret_cast<void *>(replace),
reinterpret_cast<void **>(result)
);
}
template <typename Type_>
static inline void MSHookFunction(Type_ *symbol, Type_ *replace) {
return MSHookFunction(symbol, replace, reinterpret_cast<Type_ **>(NULL));
}
template <typename Type_>
static inline void MSHookSymbol(Type_ *&value, const char *name, void *handle) {
value = reinterpret_cast<Type_ *>(dlsym(handle, name));
}
template <typename Type_>
static inline Type_ &MSHookIvar(id self, const char *name) {
Ivar ivar(class_getInstanceVariable(object_getClass(self), name));
void *pointer(ivar == NULL ? NULL : reinterpret_cast<char *>(self) + ivar_getOffset(ivar));
return *reinterpret_cast<Type_ *>(pointer);
}
#endif
#define MSHook(type, name, args...) \
static type (*_ ## name)(args); \
static type $ ## name(args) \
#define Foundation_f "/System/Library/Frameworks/Foundation.framework/Foundation"
#define UIKit_f "/System/Library/Frameworks/UIKit.framework/UIKit"
#define JavaScriptCore_f "/System/Library/PrivateFrameworks/JavaScriptCore.framework/JavaScriptCore"
#define IOKit_f "/System/Library/Frameworks/IOKit.framework/IOKit"
#endif//SUBSTRATE_H_
然后把libsubstrate.dylib(网上下载)复制到:
/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS5.0.sdk/usr/lib/
目录下。
至此导入完成,剩下的就是在工程中加入libsubstrate.dylib,引入头文件了。
MobileSubstrate Dylib Template for Xcode
下载MobileSubstrate Dylib.zip并移动到:/Developer/Platforms/iPhoneOS.platform/Developer/Library/Xcode/Project Templates/Application目录下
xcode添加MobileSubstrateDylib开发模版这里没有测试成功,
方法:把MobileSubstrateDylib模版复制到
/Developer/Platforms/iPhoneOS.platform/Developer/Library/Xcode/Templates/Project Templates/Application目录下
然后新建工程即可看到MobileSubstrateDylib模版
之前的模板会出现在选项中
(PS:记得添加头文件substrate.h,已经添加framework---libsubstrate.dylib)
(PS:编译的时候选择Device)
编译好后,右键点击生成的app,选择显示包内容,给里面的程序添加后缀—.dylib,即:***.dylib
自己新建个后缀为.plist的同名文件,在里面添加要hook的应用
最后将dylib和同名的plist放到/Library/MobileSubstrate/DynamicLibraries目录下,重启springboard即可
参考资料:http://www.ifans.com/forums/threads/xcode-template-mobilesubstrate-dylib-template-for-xcode.163185/