WVWebView

前言

逆向分析WVWebView的重要突破口：

通过代码分析jsBridgeCallHistory，即js调用app的方法历史：

- (id)getMainFrame{
    %log();
    NSLog(@"jsBridgeCallHistory %@:",[self jsBridgeCallHistory]);
    return %orig;
}

Oct 24 11:51:27 iPhone Moon[982] <Notice>: [taokeSearchTweak] Tweak.xm:255 DEBUG: -[<WVWebView: 0x1a9f7f30> getMainFrame]
Oct 24 11:51:27 iPhone Moon[982] <Notice>: [taokeSearchTweak] Tweak.xm:195 DEBUG: -[<WVWebView: 0x1a9f7f30> jsBridgeCallHistory]
Oct 24 11:51:27 iPhone Moon[982] <Warning>: jsBridgeCallHistory {
        "MtopWVPlugin.send" = 1;
        "WVTBUserTrack.toUT" = 1;
    }:

@property(readonly, nonatomic) NSDictionary *jsBridgeCallHistory;

其中包含了调用历史，从这个地方入手，找到字典中的对象以及方法包括：

MoonJSBridge.openWebView

@interface MoonJSBridge : WVDynamicHandler
{
}

+ (void)openWebView:(id)arg1 withCallback:(CDUnknownBlockType)arg2 withWebView:(id)arg3 withViewController:(id)arg4;

MtopWVPlugin.send

@interface MtopWVPlugin : WVDynamicHandler

- (void)pending:(id)arg1 request:(id)arg2 delegate:(id)arg3;
- (void)send:(id)arg1 withCallback:(CDUnknownBlockType)arg2 withWebView:(id)arg3 withViewController:(id)arg4;

WVTBUserTrack.toUT

@interface WVTBUserTrack : WVDynamicHandler
{
}

+ (void)toUT:(id)arg1 withCallback:(CDUnknownBlockType)arg2 withWebView:(id)arg3 withViewController:(id)arg4;

进一步分析

TBSDKMTOPServer ApiRequestDelegateImpl、MtopWVPlugin、ApiRequest 进行分析

结论

调用 MtopWVPlugin.send 的时候会创建ApiRequestDelegateImpl.initWithRequest 并回调到requestSuccess

总结

%hook WVWebView


- (NSDictionary *)jsBridgeCallHistory{
    %log();
    return %orig;
}

- (id)getMainFrame{
    %log();
    NSLog(@"jsBridgeCallHistory %@:",[self jsBridgeCallHistory]);
    return %orig;
}

- (void)dealloc{
    %log();
    
    // NSDictionary *tmp =[self jsBridgeCallHistory];
    // NSLog(@"jsBridgeCallHistory %@:",tmp);
    return %orig;
}
- (void)setTitle:(id)arg1{
    %log();
    [self openJSBridgeLog];
    return %orig;
}
%end