前言

CFNotificationCenter.h

Tweak端的API:

  • CFNotificationCenterAddObserver
CF_EXPORT void CFNotificationCenterAddObserver(CFNotificationCenterRef center, const void *observer, CFNotificationCallback callBack, CFStringRef name, const void *object, CFNotificationSuspensionBehavior suspensionBehavior);
  • CFNotificationCallback
typedef void (*CFNotificationCallback)(CFNotificationCenterRef center, void *observer, CFNotificationName name, const void *object, CFDictionaryRef userInfo);
//....  可以根据 name来判断是何种消息,发送端传了NULL,所以无需判断了,在多种消息的时候需要用到

例子1:SpringBoard 与daemon(Tweak tool) 之间的通信

static void Reboot(CFNotificationCenterRef center, void *observer, CFStringRef name, const void *object, CFDictionaryRef userInfo)
{
    NSLog(@"iOSRE: reboot");
#pragma GCC diagnostic push
#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
    system("reboot");//已经从iOS11中移除
#pragma GCC diagnostic pop
}

int main(int argc, char **argv, char **envp)
{
    NSLog(@"iOSRE: iOSREd is launched!");
    CFNotificationCenterAddObserver(CFNotificationCenterGetDarwinNotifyCenter(), NULL, Reboot, CFSTR("com.naken.iosred.reboot"), NULL, CFNotificationSuspensionBehaviorCoalesce);
    CFRunLoopRun(); // keep it running in background
    return 0;
}

APP端

FunMaker-SE:~ root# cycript -p SpringBoard
cy# np = @encode(unsigned int(*)(char const*))(dlsym(RTLD_DEFAULT, "notify_post"))
&(extern "C" unsigned int notify_post(char const*))
cy# np("com.naken.iosred.reboot")
Connection to localhost closed by remote host.
Connection to localhost closed.

例子2:Tweak端 与APP端: Core Foundation DEMO:

  • Tweak端
CFNotificationCenterAddObserver(CFNotificationCenterGetDarwinNotifyCenter(),
                                        NULL,
                                        &NotificationReceivedCallback,
                                        CFSTR("com.chinapyg.fakecarrier-change"),
                                        NULL,
                                        CFNotificationSuspensionBehaviorCoalesce);

//回调:
static void NotificationReceivedCallback(CFNotificationCenterRef center,
                                         void *observer, CFStringRef name,
                                         const void *object, CFDictionaryRef
                                         userInfo)
{
//....  可以根据 name来判断是何种消息,下面的客户端传了NULL,所以无需判断了,在多种消息的时候需要用到
}
  • APP端:

1.一句代码即可

notify_post("com.chinapyg.fakecarrier-change");

2.复杂点的

CF_EXPORT void CFNotificationCenterPostNotification(CFNotificationCenterRef center, CFNotificationName name, const void *object, CFDictionaryRef userInfo, Boolean deliverImmediately);

CFStringRef observedObject =
            CFSTR("com.chinapyg.fakecarrier-change");
CFNotificationCenterRef center =
            CFNotificationCenterGetDistributedCenter();
CFNotificationCenterPostNotification(center, NULL,
            observedObject, NULL /* no dictionary */, TRUE);

例子3:Cocoa DEMO:


//接收端(后台):

NSString *observedObject = @"com.chinapyg.notification";
// 处理Mac不同的进程之间的通知
NSDistributedNotificationCenter *center =
            [NSDistributedNotificationCenter defaultCenter];
[center addObserver: self
            selector: @selector(callbackWithNotification:)
            name: @"PiaoYun Notification"
            object: observedObject];

//回调:
- (void)callbackWithNotification:(NSNotification *)myNotification;
{
        NSLog(@"Notification Received");
}


发送端(app):


NSString *observedObject = @"com.mycompany.notification";
NSDistributedNotificationCenter *center =
            [NSDistributedNotificationCenter defaultCenter];
[center postNotificationName: @"PiaoYun Notification"
            object: observedObject
            userInfo: nil /* no dictionary */
            deliverImmediately: YES];

例子4:iOS foundation

// 处理单进程之间的通知
[[NSNotificationCenter defaultCenter] addObserver: self selector: @selector(callBack) name: @"back" object: nil];

// 回调
- (void)callBack
{        
        NSLog(@"Notification Received");
}

//发出通知        
[[NSNotificationCenter defaultCenter] postNotificationName:@"back" object:self];

WeCha msgsource

  • @某人
[<CMessageMgr: 0x16212580> AsyncOnAddMsg:51460663@chatroom MsgWrap:{m_uiMesLocalID=66, m_ui64MesSvrID=0, m_nsFromUsr=wxi*o22~19, m_nsToUsr=51460663@chatroom, m_uiStatus=1, type=1, msgSource="<msgsource><atuserlist>wxid_r5jqlwc8v1ua21,wxid_bz170vl82wl912</atuserlist></msgsource>"} ]
Nov 20 16:49:33 iPhone WeChat[4556] <Warning>:  AsyncOnAddMsg:51467663@chatroom wrap:{m_uiMesLocalID=66, m_ui64MesSvrID=0, m_nsFromUsr=wxi*o22~19, m_nsToUsr=51417663@chatroom, m_uiStatus=1, type=1, msgSource="<msgsource><atuserlist>wxid_r5jqlwc1ua21,wxid_bz17l82wl912</atuserlist></msgsource>"}  Content:@贺 @A思  type:1
  • 公告
"<msgsource><sequence_id>664254060</sequence_id>
    <atuserlist>announcement@all</atuserlist>
  </msgsource>
  "

iOS逆向
44 声望15 粉丝