Use hook in iPhone jailbreak Machine

Since many of my friends need the demo of this article, it is troublesome to send them one by one. I wrote a similar demo and put it on csdn without points. If necessary, you can download it directly. Project files are created according to the document description. In addition, libsubstrate. dylib is not in the i386 architecture, so it must be compiled by a real machine and debugged by a real machine.

:Http://download.csdn.net/detail/pp1pp1pp2/5253930

Use hook in iPhone jailbreak Machine

1. Download the libsubstrate. dylib dynamic library and the substrate. h header file, and add it to the project. The dynamic library is provided by the jailbreak team and can be used to dynamically change the Memory code. I have a good article on mobilesubstrate wiki.
2. Determine the object to be hooked.

For example, if you want to customize the processing before the system sends messages, you can hook the sendevent function of uiwindow.

 

Create a common base view project. The project name is hook2.

Messagehook. h

#import <UIKit/UIKit.h>#ifndef __MESSAGE_HOOK_H__#define __MESSAGE_HOOK_H__extern "C"{extern IMP original_UIWindow_sendEvent;extern void replace_UIWindow_sendEvent(UIWindow *self, SEL cmd, UIEvent *event);}#endif // __MESSAGE_HOOK_H__

　　

Messagehook. Mm

# Import "messagehook. H "// define the function imp original_uiwindow_sendevent to be hooked; // define the hook function void replace_uiwindow_sendevent (uiwindow * Self, Sel cmd, uievent * event) {nslog (@ "replease_uiwindow_sendevent is call in hook2"); original_uiwindow_sendevent (self, CMD, event );}

　　

Note that the file name of this implementation function is suffixed. mm, that is, C ++ mixed compilation is supported. Otherwise, an error is returned when importing C/C ++ header files or related code.

Messagehook. h Includes the declaration of the hook function and the declaration of the hook function.

1. Configure other_ldflags-Init _ $ (project_name) initialize-lsubstrate-dynamiclib

(Other_ldflags in build settings ---- linking ----- other linker flags)

The subsrate and dynaliclib dynamic libraries are required during the connection phase. -Init $ (project_name) initialize defines the initialization function after the dynamic library compiled by the project is loaded.

Because our project name is hook2, we need to create a new file named hook2initialize. mm. At runtime, the system will find the initialization function based on the claimed dylib. This function is the $ (project_name) initialize function in the $ (project_name) file.

Therefore, hook2initialize. MM contains the hook2initialize function implementation.

# Import "substrate. H "# import" messagehook. H "extern" C "Void hook2initialize () {nslog (@" hook2initialize start. "); NSAID utoreleasepool * Pool = [[NSAID utoreleasepool alloc] init]; // configure the hook function, hook function, and function pointer to the hook function (IMP) mshookmessageex ([uiwindow class], @ selector (sendevent :), (IMP) replace_uiwindow_sendevent, (IMP *) & original_uiwindow_sendevent); [pool release]; nslog (@ "hook2initialize end. ");}

　　

The hook2 folder generated after the compilation is successful. The package content is displayed. Change the hook2 file to hook2.dylib. You can use iPhone explorer to place hook2.dylib to the/library/mobilesubstate/dynamiclibraries folder, respring, the replease_uiwindow_sendevent is call in hook2 will be printed for any operation such as the drag interface, indicating that our event was intercepted successfully.

 

I don't know how to upload attachments here, so I can upload sample projects in every way. I am not very grateful to anyone who knows this.

You can join the QQ group: 3078698 for discussion.