IOS Reverse Code injection

Off topic: This tutorial is a serious academic discussion of the article, only for study, but also please do not use for commercial or other illegal ways, the author is not responsible for yo ~ ~

Preparatory work

• Non-Jailbreak iphone phone
• Download with pp helper: 6.6.5 (Jailbreak app)

• Machoview

  machoview:http://sourceforge.net/projects/machoview/
  Machoview Source Address: Https://github.com/gdbinit/MachOView

• Yololib

  Yololibhttps://github.com/kjcracks/yololib?spm=a2c4e.11153940.blogcont63256.9.5126420eajpqbd

Code Injection Ideas:

DYLB will load all the dynamic libraries in the frameworks, then add a dynamic library of your own in frameworks and then hook and inject the code into your own dynamic library

Location of the dynamic stock put: frameworks

Find executable file WeChat

Open executable WeChat with Machoview, you can view the dynamic library in load commands

Step: 1, new framework

Targets add:

2. Create a new Wjhook class

3, want to implement just load will run, the code will be written in the Load method

4. Add dependencies for the project

• Add the copy Files in the build phases of the code injection targets
  
• Select Frameworks in the Copy files
  

• Add Wjhookframework
  

  5, compile, in the location of the app package to view

  
  Show package contents, view in Frameworks
  
  From the above, Wjhookframework has joined the success

6, run, and did not succeed, did not execute the code in load

Reason: Open executable with Machoview WeChat, in load commands cannot find Wjhookframework

7. Write wjhookframework to macho file

Tools Required: Yololib
Because this tool is often used, it is recommended to put it in /usr/local/bin

Show hidden files, you can use
$defaults Write Com.apple.finder Appleshowallfiles-bool True
$KillAll Finder
This command to show. Also, the hidden state can be restored by changing the true to False.

• Unpacking the Jailbreak pack
  

• Wechat.app Display the package contents, find the WeChat executable file
  To increase execution permissions:chmod +x WeChat

• Write the WeChat executable file:
  yololib WeChat Frameworks/WJHookFrameWork.framework/WJHookFrameWork

  The "frameworks/wjhookframework.framework/wjhookframework" path refers to the path to the Wjhookframework executable file
  

• Check the macho file for wjhookframework in the load commands
  
  and join the success.

• Delete the original -6.6.5 (Jailbreak app). IPA, Packaging payload
  zip -ry WeChat.ipa Payload
  Put Wechat.ipa into the app directory and delete other folders
  

  8, run, Success!

IOS Reverse Code injection