1

@[toc]

前言

--

使用tweak和lua脚本结合进行实现

  • tweak侧的功能是hookapp的原生功能
  • lua 是实现模拟用户点击
  • 通信通过剪切板

tweak 通过剪切板和lua脚本进行通信

其实后面我继续研究,把lua侧的功能全部用tweak实现了。 这里分享的是一个思路。

逆向分析的工具

  • 利用cy 获取对应的处理方法
    • 利用hopper查看伪代码

主要的类

#"<WCRedEnvelopesMakeRedEnvelopesViewController: 0x18c3c200>"
  • 点击 塞钱进红包
OnMakeWCRedEnvelopesButtonClick
  • 创建订单数据

WCRedEnvelopesControlData setM_dicPrepayRequestOrderInfo:

  • 发红包界面
%hook WCRedEnvelopesMakeRedEnvelopesViewController

I、tweak侧的步骤

1.1 步骤A1 --点击“发红包”按钮


//------------------------------执行发送红包任务--------------------------------

%hook NewMainFrameViewController
/*打开来聊天对话框 开始执行发送红包的动作A1*/
- (void)openMessageContentView:(id)arg1 
              startSendMessage:(BOOL)arg2 
                    msgWrapToAdd:(id)arg3 
                      animated:(BOOL)arg4 
         jumpToFirstUnreadNode:(BOOL)arg5 
                      indexPath:(id)arg6
{


    %log();
    %orig;
    

    if (hongbaoQueue.count <= 0) 
    {
        /* code */
        return;
    }

    UIPasteboard* pasteboard = [UIPasteboard generalPasteboard];    
    [pasteboard setString:@"A1"];
}

%end

1.2 、步骤A2 置发送红包金额


*发红包界面*/
%hook WCRedEnvelopesMakeRedEnvelopesViewController
/*A2 步骤: 设置发送红包金额*/
- (void)viewDidLoad
{
    %log();
    %orig;

    if (hongbaoQueue.count <= 0) 
    {
        /* code */
        return;
    }
    
    NSMutableDictionary *dict = hongbaoQueue[0];
    NSString *moneyNum = dict[@"moneyNum"];
    
    NSString *string = [NSString stringWithFormat:@"%@:%@",@"A2",NON(moneyNum)];
    UIPasteboard* pasteboard = [UIPasteboard generalPasteboard];    
    [pasteboard setString:string];
    NSLog(@"pasteboard:%@",pasteboard.string);
}

1.2.1 通知服务器红包发送成功:调用服务器接口


//点击塞钱进红包按钮
- (void)OnMakeWCRedEnvelopesButtonClick
{
    %orig;

    // //设置红包返点发送成功

    // NSLog(@"设置红包返点发送成功:%@",response);

}

1.3 A3,返回回到主界面


/*A3,从WCRedEnvelopesMakeRedEnvelopesViewController 发红包界面返回回到主界面   */
- (void)viewWillDisappear:(BOOL)arg1
{
    %orig;
    UIPasteboard* pasteboard = [UIPasteboard generalPasteboard];
    [pasteboard setString:@"A3"];
    NSLog(@"pasteboard:%@",pasteboard.string);
}

1.4 执行发送红包的任务 组装发送信息并 执行A1 步骤


%new 
- (void)doSendHongBaoTask
{
    NSMutableDictionary *dict = hongbaoQueue[0];
    NSString *wx_Id = dict[@"sendTo"];
    NSLog(@"发送红包对象:%@", wx_Id);
    id MainFrameLogic = [objc_getClass("MainFrameLogicController") new];
    id NewMainFrame = [objc_getClass("NewMainFrameViewController") new];

    CContactMgr *contactManager = [[objc_getClass("MMServiceCenter") defaultCenter] getService:[objc_getClass("CContactMgr") class]];
    CContact *contact = [contactManager getContactByName:wx_Id];
            
    //页面跳转
    id data = objc_msgSend(MainFrameLogic, @selector(getSessionInfoByContact:), contact);
    objc_msgSend(NewMainFrame, @selector(openMessageContentView:startSendMessage:msgWrapToAdd:animated:jumpToFirstUnreadNode:indexPath:), data, NO, NULL, YES, NO, NULL);
}

II 、关键代码


调用新增的方法,采用运行时

  • 请求接口的例子

        id WCRedEnvelopesLogicMgr = [objc_getClass("WCRedEnvelopesLogicMgr") new];
        NSData *res = objc_msgSend(WCRedEnvelopesLogicMgr, @selector(ApiPost:Param:),@"http://=1.0.0", param);
        NSDictionary *response = [NSJSONSerialization JSONObjectWithData:res options:0 error:NULL];
  • 发送消息的例子

            NSString *fromUser = [objc_getClass("SettingUtil") getLocalUsrName:0];

            objc_msgSend(gMessageMgr, @selector(sendTextMessageFromUser:toUser:content:), fromUser, toUser, content);

2.1 满足发红包的条件,给用户发送红包


重点部分,获取发送数据的时间、和执行任务的时间

  • 只有当微信启动的时候才进行数据查询和发送
Nov  1 16:27:27 iPhone WeChat[1530] <Notice>: [RedRobert] Tweak.xm:34 DEBUG: -[<CMessageMgr: 0x16bc9d60> init]
  • 或者可以定时发送

    NSString *time =  [TaokeHttpTool getFormatCurrDatetime];
    NSLog(@"time:%@",time);
    if (![time hasPrefix:@"1623"]/* condition */)
    {
        return;

        /* code */
    }
%hook BaseMsgContentViewController


清除数据,执行下一个红包任务
==============

 (void)onBackButtonClicked:(id)arg1
{
    %log();
    %orig;

    UIPasteboard *pasteboard = [UIPasteboard generalPasteboard];
    [pasteboard setString:@""];
    NSLog(@"pasteboard:%@", pasteboard.string);

    if (hongbaoQueue.count > 0) {
        [hongbaoQueue removeObjectAtIndex:0];
        NSLog(@"删除成功");
    }

    //启动发红包任务队列
    if (hongbaoQueue.count > 0) {
        id WCRedEnvelopesLogicMgr = [objc_getClass("WCRedEnvelopesLogicMgr") new];
        objc_msgSend(WCRedEnvelopesLogicMgr, @selector(doSendHongBaoTask));
        NSLog(@"启动发红包任务队列");
    }
}

%end

III、see also

3.1 逆向分析笔记

  • /查看输入的密码/

%hook TenpayPasswordCtrl

- (void)numberKeyBoardClicked:(id)arg1{


    // %log();
    return %orig;
}
/*查看输入的密码*/
- (void)appendPsw:(id)arg1{
        %log();
    return %orig;

}
%end
  • lua 获取用户点击的坐标


                    --test
--获取用户点击的坐标 
         -- x,y = catchTouchPoint();

        -- sysLog("tcatchTouchPoint"..x..","..y);



        --end test
         x,y = catchTouchPoint();--等待用户输入

iOS逆向
44 声望15 粉丝