使用MGCopyAnswer修改手机序列号

使用MGCopyAnswer修改手机序列号

#ios

#include <substrate.h>

static CFTypeRef (*orig_MGCopyAnswer)(CFStringRef str);
static CFTypeRef (*orig_MGCopyAnswer_internal)(CFStringRef str, uint32_t* outTypeCode);

CFTypeRef new_MGCopyAnswer(CFStringRef str);
CFTypeRef new_MGCopyAnswer_internal(CFStringRef str, uint32_t* outTypeCode);

CFTypeRef new_MGCopyAnswer(CFStringRef str) {
	NSLog(@"new_MGCopyAnswer");
	NSString *keyStr = (__bridge NSString *)str;
	if ([keyStr isEqualToString:@"SerialNumber"]) {
		NSString *strSerialNumber = @"SerialNumber just for fun";
		return (CFTypeRef)strSerialNumber;
	}
	return orig_MGCopyAnswer(str);
}

CFTypeRef new_MGCopyAnswer_internal(CFStringRef str, uint32_t* outTypeCode) {
	NSLog(@"new_MGCopyAnswer_internal");
	NSString *keyStr = (__bridge NSString *)str;
	if ([keyStr isEqualToString:@"SerialNumber"]) {
		NSString *strSerialNumber = @"SerialNumber just for fun";
		return (CFTypeRef)strSerialNumber;
	}
	return orig_MGCopyAnswer_internal(str, outTypeCode);
}

%ctor {
	char *dylib_path = (char*)"/usr/lib/libMobileGestalt.dylib";
	void *h = dlopen(dylib_path, RTLD_GLOBAL);
	if (h != 0) {
		MSImageRef ref = MSGetImageByName(dylib_path);
		void * MGCopyAnswerFn = MSFindSymbol(ref, "_MGCopyAnswer");

		// 64 code
		uint8_t MGCopyAnswer_arm64_impl[8] = {0x01, 0x00, 0x80, 0xd2, 0x01, 0x00, 0x00, 0x14};

		// 64 system
		if (memcmp(MGCopyAnswerFn, MGCopyAnswer_arm64_impl, 8) == 0) {
			MSHookFunction((void*)((uint8_t*)MGCopyAnswerFn + 8), (void*)new_MGCopyAnswer_internal, (void**)&orig_MGCopyAnswer_internal);
		} else {
			MSHookFunction(MGCopyAnswerFn, (void *)new_MGCopyAnswer, (void **)&orig_MGCopyAnswer);
		}
	}
}