@[toc]
前言
--
使用tweak和lua脚本结合进行实现
- tweak侧的功能是hookapp的原生功能
- lua 是实现模拟用户点击
- 通信通过剪切板
tweak 通过剪切板和lua脚本进行通信
其实后面我继续研究,把lua侧的功能全部用tweak实现了。 这里分享的是一个思路。
逆向分析的工具
- 利用cy 获取对应的处理方法
- 利用hopper查看伪代码
主要的类
#"<WCRedEnvelopesMakeRedEnvelopesViewController: 0x18c3c200>"
- 点击 塞钱进红包
OnMakeWCRedEnvelopesButtonClick
- 创建订单数据
WCRedEnvelopesControlData setM_dicPrepayRequestOrderInfo:
- 发红包界面
%hook WCRedEnvelopesMakeRedEnvelopesViewController
I、tweak侧的步骤
1.1 步骤A1 --点击“发红包”按钮
//------------------------------执行发送红包任务--------------------------------
%hook NewMainFrameViewController
/*打开来聊天对话框 开始执行发送红包的动作A1*/
- (void)openMessageContentView:(id)arg1
startSendMessage:(BOOL)arg2
msgWrapToAdd:(id)arg3
animated:(BOOL)arg4
jumpToFirstUnreadNode:(BOOL)arg5
indexPath:(id)arg6
{
%log();
%orig;
if (hongbaoQueue.count <= 0)
{
/* code */
return;
}
UIPasteboard* pasteboard = [UIPasteboard generalPasteboard];
[pasteboard setString:@"A1"];
}
%end
1.2 、步骤A2 置发送红包金额
*发红包界面*/
%hook WCRedEnvelopesMakeRedEnvelopesViewController
/*A2 步骤: 设置发送红包金额*/
- (void)viewDidLoad
{
%log();
%orig;
if (hongbaoQueue.count <= 0)
{
/* code */
return;
}
NSMutableDictionary *dict = hongbaoQueue[0];
NSString *moneyNum = dict[@"moneyNum"];
NSString *string = [NSString stringWithFormat:@"%@:%@",@"A2",NON(moneyNum)];
UIPasteboard* pasteboard = [UIPasteboard generalPasteboard];
[pasteboard setString:string];
NSLog(@"pasteboard:%@",pasteboard.string);
}
1.2.1 通知服务器红包发送成功:调用服务器接口
//点击塞钱进红包按钮
- (void)OnMakeWCRedEnvelopesButtonClick
{
%orig;
// //设置红包返点发送成功
// NSLog(@"设置红包返点发送成功:%@",response);
}
1.3 A3,返回回到主界面
/*A3,从WCRedEnvelopesMakeRedEnvelopesViewController 发红包界面返回回到主界面 */
- (void)viewWillDisappear:(BOOL)arg1
{
%orig;
UIPasteboard* pasteboard = [UIPasteboard generalPasteboard];
[pasteboard setString:@"A3"];
NSLog(@"pasteboard:%@",pasteboard.string);
}
1.4 执行发送红包的任务 组装发送信息并 执行A1 步骤
%new
- (void)doSendHongBaoTask
{
NSMutableDictionary *dict = hongbaoQueue[0];
NSString *wx_Id = dict[@"sendTo"];
NSLog(@"发送红包对象:%@", wx_Id);
id MainFrameLogic = [objc_getClass("MainFrameLogicController") new];
id NewMainFrame = [objc_getClass("NewMainFrameViewController") new];
CContactMgr *contactManager = [[objc_getClass("MMServiceCenter") defaultCenter] getService:[objc_getClass("CContactMgr") class]];
CContact *contact = [contactManager getContactByName:wx_Id];
//页面跳转
id data = objc_msgSend(MainFrameLogic, @selector(getSessionInfoByContact:), contact);
objc_msgSend(NewMainFrame, @selector(openMessageContentView:startSendMessage:msgWrapToAdd:animated:jumpToFirstUnreadNode:indexPath:), data, NO, NULL, YES, NO, NULL);
}
II 、关键代码
调用新增的方法,采用运行时
- 请求接口的例子
id WCRedEnvelopesLogicMgr = [objc_getClass("WCRedEnvelopesLogicMgr") new];
NSData *res = objc_msgSend(WCRedEnvelopesLogicMgr, @selector(ApiPost:Param:),@"http://=1.0.0", param);
NSDictionary *response = [NSJSONSerialization JSONObjectWithData:res options:0 error:NULL];
- 发送消息的例子
NSString *fromUser = [objc_getClass("SettingUtil") getLocalUsrName:0];
objc_msgSend(gMessageMgr, @selector(sendTextMessageFromUser:toUser:content:), fromUser, toUser, content);
2.1 满足发红包的条件,给用户发送红包
重点部分,获取发送数据的时间、和执行任务的时间
- 只有当微信启动的时候才进行数据查询和发送
Nov 1 16:27:27 iPhone WeChat[1530] <Notice>: [RedRobert] Tweak.xm:34 DEBUG: -[<CMessageMgr: 0x16bc9d60> init]
- 或者可以定时发送
NSString *time = [TaokeHttpTool getFormatCurrDatetime];
NSLog(@"time:%@",time);
if (![time hasPrefix:@"1623"]/* condition */)
{
return;
/* code */
}
%hook BaseMsgContentViewController
清除数据,执行下一个红包任务
==============
(void)onBackButtonClicked:(id)arg1
{
%log();
%orig;
UIPasteboard *pasteboard = [UIPasteboard generalPasteboard];
[pasteboard setString:@""];
NSLog(@"pasteboard:%@", pasteboard.string);
if (hongbaoQueue.count > 0) {
[hongbaoQueue removeObjectAtIndex:0];
NSLog(@"删除成功");
}
//启动发红包任务队列
if (hongbaoQueue.count > 0) {
id WCRedEnvelopesLogicMgr = [objc_getClass("WCRedEnvelopesLogicMgr") new];
objc_msgSend(WCRedEnvelopesLogicMgr, @selector(doSendHongBaoTask));
NSLog(@"启动发红包任务队列");
}
}
%end
III、see also
3.1 逆向分析笔记
- /查看输入的密码/
%hook TenpayPasswordCtrl
- (void)numberKeyBoardClicked:(id)arg1{
// %log();
return %orig;
}
/*查看输入的密码*/
- (void)appendPsw:(id)arg1{
%log();
return %orig;
}
%end
- lua 获取用户点击的坐标
--test
--获取用户点击的坐标
-- x,y = catchTouchPoint();
-- sysLog("tcatchTouchPoint"..x..","..y);
--end test
x,y = catchTouchPoint();--等待用户输入
**粗体** _斜体_ [链接](http://example.com) `代码` - 列表 > 引用
。你还可以使用@
来通知其他用户。