4
4
5
5
from chomper import Chomper
6
6
from chomper .const import ARCH_ARM64 , OS_IOS
7
+ from chomper .objc import ObjC
7
8
8
9
base_path = os .path .abspath (os .path .dirname (__file__ ))
9
10
16
17
logger = logging .getLogger (__name__ )
17
18
18
19
19
- def create_emulator ():
20
- return Chomper (
21
- arch = ARCH_ARM64 ,
22
- os_type = OS_IOS ,
23
- logger = logger ,
24
- rootfs_path = os .path .join (base_path , "ios/rootfs" ),
25
- enable_objc = True ,
26
- enable_ui_kit = True ,
27
- )
28
-
29
-
30
- def objc_get_class (emu , class_name ):
31
- return emu .call_symbol ("_objc_getClass" , emu .create_string (class_name ))
32
-
33
-
34
- def objc_sel_register_name (emu , sel_name ):
35
- return emu .call_symbol ("_sel_registerName" , emu .create_string (sel_name ))
36
-
37
-
38
- def objc_create_ns_string (emu , s ):
39
- ns_string_class = objc_get_class (emu , "NSString" )
40
- string_with_utf8_string_sel = objc_sel_register_name (emu , "stringWithUTF8String:" )
41
- obj = emu .call_symbol (
42
- "_objc_msgSend" ,
43
- ns_string_class ,
44
- string_with_utf8_string_sel ,
45
- emu .create_string (s ),
46
- )
47
- return obj
48
-
49
-
50
- def objc_read_ns_string (emu , obj ):
51
- c_string_using_encoding_sel = objc_sel_register_name (emu , "cStringUsingEncoding:" )
52
- ptr = emu .call_symbol ("_objc_msgSend" , obj , c_string_using_encoding_sel , 4 )
53
- return emu .read_string (ptr )
54
-
55
-
56
- def hook_pass (uc , address , size , user_data ):
20
+ def hook_skip (uc , address , size , user_data ):
57
21
pass
58
22
59
23
@@ -64,90 +28,90 @@ def decorator(uc, address, size, user_data):
64
28
return decorator
65
29
66
30
67
- def hook_ns_bundle (emu ):
68
- ns_mutable_dictionary_cls = objc_get_class (emu , "NSMutableDictionary" )
69
- dictionary_with_object_for_key_sel = objc_sel_register_name (emu , "dictionaryWithObject:forKey:" )
70
- add_object_for_key_sel = objc_sel_register_name (emu , "addObject:forKey:" )
31
+ def hook_ns_bundle (emu , objc ):
32
+ bundle_identifier = objc .msg_send ("NSString" , "stringWithUTF8String:" , "com.ceair.b2m" )
71
33
72
- bundle_identifier = objc_create_ns_string (emu , "com.ceair.b2m" )
73
- executable_path = objc_create_ns_string (emu , f"/var/containers/Bundle/Application"
74
- f"/{ uuid .uuid4 ()} /com.ceair.b2m/ceair_iOS_branch" )
34
+ executable_path = objc .msg_send (
35
+ "NSString" ,
36
+ "stringWithUTF8String:" ,
37
+ f"/var/containers/Bundle/Application/{ uuid .uuid4 ()} /com.ceair.b2m/ceair_iOS_branch" ,
38
+ )
75
39
76
- bundle_info_directory = emu .call_symbol (
77
- "_objc_msgSend" ,
78
- ns_mutable_dictionary_cls ,
79
- dictionary_with_object_for_key_sel ,
80
- objc_create_ns_string (emu , "9.4.7" ),
81
- objc_create_ns_string (emu , "CFBundleShortVersionString" ),
40
+ bundle_info_directory = objc .msg_send (
41
+ "NSMutableDictionary" ,
42
+ "dictionaryWithObject:forKey:" ,
43
+ objc .msg_send ("NSString" , "stringWithUTF8String:" , "9.4.7" ),
44
+ objc .msg_send ("NSString" , "stringWithUTF8String:" , "CFBundleShortVersionString" ),
82
45
)
83
46
84
- emu .call_symbol (
85
- "_objc_msgSend" ,
47
+ objc .msg_send (
86
48
bundle_info_directory ,
87
- add_object_for_key_sel ,
49
+ "addObject:forKey:" ,
88
50
executable_path ,
89
- objc_create_ns_string ( emu , "CFBundleExecutable" ),
51
+ objc . msg_send ( "NSString" , "stringWithUTF8String:" , "CFBundleExecutable" ),
90
52
)
91
53
92
- emu .add_interceptor ("-[NSBundle initWithPath:]" , hook_pass )
54
+ emu .add_interceptor ("-[NSBundle initWithPath:]" , hook_skip )
93
55
emu .add_interceptor ("-[NSBundle bundleIdentifier]" , hook_retval (bundle_identifier ))
94
56
emu .add_interceptor ("-[NSBundle executablePath]" , hook_retval (executable_path ))
95
57
emu .add_interceptor ("-[NSBundle infoDictionary]" , hook_retval (bundle_info_directory ))
96
58
97
59
98
- def hook_ns_locale (emu ):
99
- ns_array_cls = objc_get_class (emu , "NSArray" )
100
- array_with_object_sel = objc_sel_register_name (emu , "arrayWithObject:" )
101
-
102
- preferred_languages = emu .call_symbol (
103
- "_objc_msgSend" ,
104
- ns_array_cls ,
105
- array_with_object_sel ,
106
- objc_create_ns_string (emu , "zh-cn" ),
60
+ def hook_ns_locale (emu , objc ):
61
+ preferred_languages = objc .msg_send (
62
+ "NSArray" ,
63
+ "arrayWithObject:" ,
64
+ objc .msg_send ("NSString" , "stringWithUTF8String:" , "zh-cn" )
107
65
)
108
66
109
67
emu .add_interceptor ("+[NSLocale preferredLanguages]" , hook_retval (preferred_languages ))
110
68
111
69
112
- def hook_ui_device (emu ):
113
- system_version = objc_create_ns_string ( emu , "14.4.0" )
114
- device_name = objc_create_ns_string ( emu , "iPhone" )
115
- device_model = objc_create_ns_string ( emu , "iPhone13,1" )
70
+ def hook_ui_device (emu , objc ):
71
+ system_version = objc . msg_send ( "NSString" , "stringWithUTF8String:" , "14.4.0" )
72
+ device_name = objc . msg_send ( "NSString" , "stringWithUTF8String:" , "iPhone" )
73
+ device_model = objc . msg_send ( "NSString" , "stringWithUTF8String:" , "iPhone13,1" )
116
74
117
75
emu .add_interceptor ("-[UIDevice systemVersion]" , hook_retval (system_version ))
118
76
emu .add_interceptor ("-[UIDevice name]" , hook_retval (device_name ))
119
77
emu .add_interceptor ("-[UIDevice model]" , hook_retval (device_model ))
120
78
121
79
122
80
def main ():
123
- emu = create_emulator ()
81
+ emu = Chomper (
82
+ arch = ARCH_ARM64 ,
83
+ os_type = OS_IOS ,
84
+ logger = logger ,
85
+ rootfs_path = os .path .join (base_path , "ios/rootfs" ),
86
+ enable_ui_kit = True ,
87
+ )
88
+
89
+ objc = ObjC (emu )
124
90
125
- hook_ns_bundle (emu )
126
- hook_ns_locale (emu )
127
- hook_ui_device (emu )
91
+ hook_ns_bundle (emu , objc )
92
+ hook_ns_locale (emu , objc )
93
+ hook_ui_device (emu , objc )
128
94
95
+ # Skip a file operation
129
96
emu .add_interceptor ("_fopen" , hook_retval (0 ))
130
97
131
98
emu .load_module (os .path .join (base_path , "ios/apps/com.csair.MBP/CSMBP-AppStore-Package" ))
132
99
133
- ali_tiger_tally_class = objc_get_class ( emu , "AliTigerTally " )
100
+ ali_tiger_tally_instance = objc . msg_send ( "AliTigerTally" , "sharedInstance " )
134
101
135
- shared_instance_sel = objc_sel_register_name (emu , "sharedInstance" )
136
- initialize_sel = objc_sel_register_name (emu , "initialize:" )
137
- vmp_sign_sel = objc_sel_register_name (emu , "vmpSign:" )
138
- data_using_encoding_sel = objc_sel_register_name (emu , "dataUsingEncoding:" )
139
-
140
- ali_tiger_tally_instance = emu .call_symbol ("_objc_msgSend" , ali_tiger_tally_class , shared_instance_sel )
141
-
142
- app_key = objc_create_ns_string (emu , "xPEj7uv0KuziQnXUyPIBNUjnDvvHuW09VOYFuLYBcY-jV6fgqmfy5B1y75_iSuRM5U2zNq7MRoR9N1F-UthTEgv-QBWk68gr95BrAySzWuDzt08FrkeBZWQCGyZ0iAybalYLOJEF7nkKBtmDGLewcw==" , )
143
- emu .call_symbol ("_objc_msgSend" , ali_tiger_tally_instance , initialize_sel , app_key )
102
+ app_key = objc .msg_send (
103
+ "NSString" ,
104
+ "stringWithUTF8String:" ,
105
+ "xPEj7uv0KuziQnXUyPIBNUjnDvvHuW09VOYFuLYBcY-jV6fgqmfy5B1y75_iSuRM5U2zNq7MRoR9N1F-UthTEgv-QBWk68gr95BrAySzWuDzt08FrkeBZWQCGyZ0iAybalYLOJEF7nkKBtmDGLewcw==" ,
106
+ )
144
107
145
- encrypt_str = objc_create_ns_string (emu , '{"biClassId":["2","3","4"]}' )
146
- encrypt_bytes = emu .call_symbol ("_objc_msgSend" , encrypt_str , data_using_encoding_sel , 1 )
108
+ objc .msg_send (ali_tiger_tally_instance , "initialize:" , app_key )
147
109
148
- vmp_sign = emu .call_symbol ("_objc_msgSend" , ali_tiger_tally_instance , vmp_sign_sel , encrypt_bytes )
110
+ encrypt_str = objc .msg_send ("NSString" , "stringWithUTF8String:" , '{"biClassId":["2","3","4"]}' )
111
+ encrypt_bytes = objc .msg_send (encrypt_str , "dataUsingEncoding:" , 1 )
149
112
150
- logger .info ("vmp sign: %s" , objc_read_ns_string (emu , vmp_sign ))
113
+ vmp_sign = objc .msg_send (ali_tiger_tally_instance , "vmpSign:" , encrypt_bytes )
114
+ logger .info ("vmp sign: %s" , emu .read_string (objc .msg_send (vmp_sign , "cStringUsingEncoding:" , 4 )))
151
115
152
116
153
117
if __name__ == "__main__" :
0 commit comments