Batch tracking of objc method call records

IOS objc method call record plug-in: itracer v1.2

If you want to reverse the calling process of some apps or the private framework class API calling process of some functions of the system app, you can try this tool.

You only need to configure the name of the class to be mounted and the app name to track the calling process of related functions in real time. Supports batch hook n multiple class names

Features:

• Batch tracking of all calling processes of a specified class object in IOS
• Supports IOS for armv6, armv7, arm64, MAC for x86, and x64
• Automatically detects parameter types and prints details of all parameters

Update content:

• Support for arm64 is added, and the stability of just-tuned access is to be tested.
  Arm64 process injection has no time to do. Currently, the hookprocess of substrate is used. Therefore, you need to install libsubstrate. dylib first.
  The version of armv7 is completely independent of substrate.

• The arm64 version slightly enhances the printing of parameter information.

Note: This project is no longer maintained and is for reference only.

1. Configure the class to be mounted

   Modify the itrace. xml configuration file and add the class name to be hooked:
   
   
   

   <SSDevice/><SSDownload/><SSDownloadManager/><SSDownloadQueue/><CPDistributedMessagingCenter/><CPDistributedNotificationCenter/><NSString args="0"/>

   
   

   Note: Do not hook classes that are frequently called, such as uiview nsstring. Otherwise, the operation will be very slow and inconvenient.
   Note: If a class is attached and the parameter information is printed halfway, you can add the ARGs = "0" attribute after the corresponding class name to disable printing of the parameter information. This will be stable.

   To disable all classes from printing parameter information, you can directly set: <class ARGs = "0">

2. Installation File

   Upload all the files in the entire itracer directory to the/tmp directory of the IOS system using the mobile assistant tool:
   /Tmp/itracer
   /Tmp/itrace. dylib
   /Tmp/itrace. xml

3. Trace

   Go to the itracer directory:
   CD/tmp

   Modify execution permission:
   Chmod 777./itracer

   Run the program:

   ./Itracer springboard (spingboard is the name of the process to be attached and supports simple fuzzy match)

4. View trace log. Note: The actual output of log is in xcode-Windows menu-organizer-console:

   Jan 21 11:12:58 unknown springboard [5706]: [itrace]: [3edc9d98]: [ssdownloadqueue downloads]
   Jan 21 11:12:58 unknown springboard [5706]: [itrace]: [3edc9d98]: [ssdownloadmanager downloads]
   Jan 21 11:12:58 unknown springboard [5706]: [itrace]: [3edc9d98]: [ssdownloadmanagerCopydownloads]
   Jan 21 11:12:58 unknown springboard [5706]: [itrace]: [3edc9d98]: [ssdownloadqueueSenddownloadstatuschangedatindex:]: 0
   Jan 21 11:12:58 unknown springboard [5706]: [itrace]: [3edc9d98]: [ssdownloadqueueMessageobserverswithfunction: Context:]: 0x334c5d51: 0x2fe89de0
   Jan 21 11:12:58 unknown springboard [5706]: [itrace]: [3edc9d98]: [ssdownloadqueue downloads]
   Jan 21 11:12:58 unknown springboard [5706]: [itrace]: [3edc9d98]: [ssdownloadmanager downloads]
   Jan 21 11:12:58 unknown springboard [5706]: [itrace]: [3edc9d98]: [ssdownloadmanagerCopydownloads]
   Jan 21 11:12:58 unknown springboard [5706]: [itrace]: [3edc9d98]: [ssdownload cachedapplicationidentifier]
   Jan 21 11:12:58 unknown springboard [5706]: [itrace]: [3edc9d98]: [ssdownload status]
   Jan 21 11:12:58 unknown springboard [5706]: [itrace]: [3edc9d98]: [ssdownload cachedapplicationidentifier]
   Jan 21 11:12:58 unknown springboard [5706]: [itrace]: [3edc9d98]: [cpdistributednotificationcenter postnotificationname: userinfo:]: sbapplicationnotifnotifstatechanged :{

   SBApplicationStateDisplayIDKey = "com.apple.AppStore";  SBApplicationStateKey = 2;  SBApplicationStateProcessIDKey = 5868;  SBMostElevatedStateForProcessID = 2;

   }
   Jan 21 11:12:58 unknown springboard [5706]: [itrace]: [3edc9d98]: [cpdistributednotificationcenter postnotificationname: userinfo: tobundleidentifier:]: sbapplicationnotificationstatechanged :{

   SBApplicationStateDisplayIDKey = "com.apple.AppStore";  SBApplicationStateKey = 2;  SBApplicationStateProcessIDKey = 5868;  SBMostElevatedStateForProcessID = 2;

   }: NULL
   Jan 21 11:12:59 unknown springboard [5706]: [itrace]: [105d7000]: [ssdownloadmanagerHandlemessage: fromserverconnection:]: 0xe6920b0: 0xe007040
   Jan 21 11:12:59 unknown springboard [5706]: [itrace]: [105d7000]: [ssdownloadmanagerHandledownloadstateschanged:]: 0xe6920b0
   Jan 21 11:12:59 unknown springboard [5706]: [itrace]: [105d7000]: [ssdownloadmanagerCopydownloads]
   Jan 21 11:12:59 unknown springboard [5706]: [itrace]: [105d7000]: [ssdownload persistentidentifier]
   Jan 21 11:12:59 unknown springboard [5706]: [itrace]: [105d7000]: [ssdownloadAddcachedpropertyvalues:]: {

   I = SSDownloadPhaseDownloading;

   }
   Jan 21 11:12:59 unknown springboard [5706]: [itrace]: [105d7000]: [ssdownload _ applyphase: tostatus:]: ssdownloadphasedownloading:
   Jan 21 11:12:59 unknown springboard [5706]: [itrace]: [105d7000]: [ssdownloadqueue downloadmanager: downloadstatesdidchange:]: (

   "<SSDownload: 0xe6bd970>: -4085275246093726486"

   )

Source code: https://github.com/waruqi/itrace

Batch tracking of objc method call records