MonkeyDev
强大的工具集,MonkeyDev
,使用它行了!
使用
- 拿着之前通过 frida砸壳 的 ipa包,先创建一个 MonkeyDev 工程。这里以
qqmusic
为例
-
将砸壳的 ipa 放到
qqmusic/TargetApp/
下,然后拖拽至工程文件中。 -
设置主工程的证书,dylib的不用设置
提示Showing All Messages Signing for "qqmusicDylib" requires a development team. Select a development team in the Signing & Capabilities editor.
,此时选择qqmusicDylib->Build Settings->Add User-Defined Setting
添加CODE_SIGNING_ALLOWED
为 NO,再运行即可。 -
file not found: /usr/lib/libstdc++.dylib
问题原因是新版本xcode去掉了
libstdc++
这个库,从老版本复制过来即可,这里直接使用别人的 https://github.com/devdawei/libstdc-
注入SDK
- 可以运行之后,我们在工程中初始化pod,
修改pod文件,注释use_frameworks!
# platform :ios, '9.0'
target 'qqmusic' do
# Comment the next line if you don't want to use dynamic frameworks
# use_frameworks!
pod 'GrowingAnalytics-cdp/Autotracker'
# Pods for qqmusic
end
target 'qqmusicDylib' do
# Comment the next line if you don't want to use dynamic frameworks
# use_frameworks!
pod 'GrowingAnalytics-cdp/Autotracker'
# Pods for qqmusicDylib
end
- 查找对应的
appdelegate
类,使用class-dump
命令
class-dump -H xxx.app -o yourDir/Headers
发现其 AppDelegate
类叫 XXXXAppDelegate
- 然后使用
logos
注入SDK
初始化代码,使用文档查看官网 http://iphonedevwiki.net/index.php/Logos
// See http://iphonedevwiki.net/index.php/Logos
#import <UIKit/UIKit.h>
#import "GrowingAutotracker.h"
static NSString *const kGrowingProjectId = @"91eaf9b283361032";
%hook XXXXAppDelegate
- (BOOL)application:(UIApplication *)application didFinishLaunchingWithOptions:(NSDictionary *)launchOptions {
BOOL result = %orig;
GrowingTrackConfiguration *configuration = [GrowingTrackConfiguration configurationWithProjectId:kGrowingProjectId];
configuration.debugEnabled = YES;
configuration.impressionScale = 1.0;
configuration.dataCollectionServerHost = @"https://run.mocky.io/v3/08999138-a180-431d-a136-051f3c6bd306";
[GrowingAutotracker startWithConfiguration:configuration launchOptions:launchOptions];
return result;
}
%end
然后再编译运行,至此,已经可以在App中调试SDK,并有相关日志输出了。