Use Reveal to analyze the UI and revealappui of a third-party App

Use Reveal to analyze the UI and revealappui of a third-party App

From: Listening to cloud blog

Reveal introduction:

This is a magic tool that can thoroughly analyze the UI structure of an App.

This tool consists of two parts: an independent application running on a PC, that is, Reveal. app, another part of the code is in an App you want to analyze. For this reason, Reveal provides a Framework and a Dylib for use. The two parts communicate with each other through a zero-configuration network such as Bonjure.

Official Address:Www.revealapp.com

Basic usage:

There is nothing to say about the use of Reveal. app, that is, click to run. The key is how to embed it into the App.

Our own apps all have source code, so the simplest way is to integrate static links into apps.

For basic usage, see "Integration Guide" in the help section or refer to these links.

Http://blog.csdn.net/yongyinmg/article/details/39293015

Http://chuansong.me/n/1308113

Http://blog.csdn.net/yiyaaixuexi/article/details/18220875

Real needs

My weak question: Do I still need to use this tool to analyze my UI? Do you have this requirement?

In fact, Reveal is a reverse engineering tool, mainly used to analyze other people's apps (UIS), that is, learning, research, and plagiarism, the true value and significance of this tool is to analyze others' apps.

LibReaveal. dylib restrictions

LibReveal. dylib is required to analyze other apps. Unfortunately, dylib provided in version 1.5 does not support the ARM architecture, that is, it can only be used in simulators. After half a day, I just analyzed my App and Reveal. What do you mean?

In fact, earlier versions of libReveal. dylib support the ARM architecture. At that time, you only need to throw the libReveal. dylib file to the/Library/MobileSubstrate/DynamicLibraries/directory of the mobile phone. Why didn't we support the ARM architecture later? I think something must have happened here. I think it may have been a complaint of infringement ...... It's useless to think about anything. This libReveal. dylib cannot be used now!

After searching, the previous versions do not support ARM. It was a very early time and the official version did not download it. It is said that it cannot be used with the new version of ReavealApp.

Reveal, are you a little embarrassed?

Create a libReveal. dylib

Don't blame Reveal. In fact, people have given everything, isn't there Reveal. framwwork? It is supported by both the simulator and the real machine. If you use it to create libReveal. dylib and support the ARM architecture to analyze other apps, then ...... "The consequences are at your own risk", which is definitely the meaning of Reveal.

Haha 〜~ Isn't it a jailbreak plug-in? It's easy. I made attachments. The production process is also a little pitfall, so it is also posted.

(This requires the OS or iOSOpenDev. I have installed iOSOpenDev)

Open xcode and create a new project,

My project is also called libReveal.

After the project is created, I drag Reveal. framework in and add a line of log.

Compile, OK, and dylib files.

Drag it and try to open an App. No, Reveal. App didn't find anything. Well, I expected it would not be so smooth!

I took a closer look at the libReveal. dylib file compiled and produced. The size is only 150 K. Why is it so small?

I remember, isn't it "zero code? "Zero code" should use the class loading mechanism, and the startup code should be put in load or initialize. As long as this class is loaded, it will be executed.

At the same time, we also need to ensure that this class will be used. This requires the category feature of Objective-c. It is likely that the category of UIApplication is implemented. I will understand it later.

If you want to use the OC category feature in the dynamic library, you must inform the connector at link. Otherwise, the code in the category will not be compiled into dylib or framwwork (unless explicitly used ). Add connection parameters:

After compilation, more than 60 errors are generated, indicating that the xxx symbol cannot be found. Add Foundition, UIKit, coreGraphics, QuartzCore, CFNetwork, and libz as prompted. (Note: Foundtion. the framework is added. You need to delete and add the framework again. Otherwise, it cannot run on iOS before 8.0, and NSNetService cannot be found in the report. This is a small pitfall ).

Compiled, passed! This time the size is 1.7 MB (armv7 and arm64 are supported). After a try, we have done it!

There are two points to note:

1. plist file, that is, libReveal. the plist file filters out the App, or determines which App/process you want to study. You can specify the bundleId to determine the libReveal when the App/process is started. dylib injection.

2. libReveal. dylib is dangerous for system processes such as springboard. You should not inject it into it; otherwise, it may be dangerous. In particular, when libReveal. plist does not exist, it is equivalent to no filtering, no restriction, and all processes will be injected. I have tried to delete libReveal. dylib. It is really not fun. Restart will be finished, and the final price is to refresh the machine.

 

Link: https://blog.tingyun.com/web/article/detail/262