iOS越狱-Cycript的第三方库mjcript.cy示例
mjcript下载地址:https://github.com/CoderMJLee/mjcript
安装方法
将mjcript.cy文件拖到/usr/lib/cycript0.9
使用方法
1.使用SSH登录到服务器,使用之前介绍的脚本命令
sh usb.sh
sh login.sh
2.使用Cycript监听App,例如微信
cycript -p WeChat
3.导入导入mjcript
@import mjcript
实用函数示例
1.获取AppId
MJAppId
输出示例微信
@"com.tencent.xin"
2.App包存储路径
MJAppPath
输出示例
@"/var/containers/Bundle/Application/39508FC2-EE84-45C2-8373-11C4D41B4760/WeChat.app"
3.App沙盒路径
MJDocPath
输出示例
@"/var/mobile/Containers/Data/Application/DBA965AC-3B8A-45F3-BEC9-17DD3DFF30B4/Documents"
MJCachesPath
输出示例
@"/var/mobile/Containers/Data/Application/DBA965AC-3B8A-45F3-BEC9-17DD3DFF30B4/Library/Caches"
4.拿到显示在最前面的控制器
MJFrontVc()
输出示例
#""
在手机上点击注册按钮,再次输入指令看看最前面的控制器
输出示例:
#""
5..获得某个类的对象方法名列表
MJInstanceMethodNames(WCAccountLoginFirstViewController)
输出示例
[&"getVisibleHeight",&"initView",&"adjustViewAndNavBarRect",&"onLanguageChange",&"adjustTableViewRect",&"updateChangeLanguageBtn",&"onChangeLanguage",&"getBackgroundImgWithOrientation:",&".cxx_destruct",&"setDelegate:",&"dealloc",&"init",&"willAnimateRotationToInterfaceOrientation:duration:",&"didRotateFromInterfaceOrientation:"]
支持正则
MJInstanceMethodNames(WCAccountLoginFirstViewController,/adjust/)
输出示例
[&"adjustViewAndNavBarRect",&"adjustTableViewRect"]
6.获取某个对象的类方法名列表
MJClassMethodNames(#0x13901b5a0)
微信某个
button
输出示例[&"buttonWithType:",&"_setVisuallyHighlighted:forViews:initialPress:",&"_defaultNormalTitleColor",&"_defaultNormalTitleShadowColor",&"_defaultImageForType:andState:",&"_buttonTypeIsModernUI:",&"_setVisuallyHighlighted:forViews:initialPress:baseAlpha:",&"_selectedIndicatorImage",&"_infoLightImage",&"_detailDisclosureImage",&"_plusImage",&"_infoDarkImage",&"_exclamationMarkImage",&"_questionMarkImage",&"_checkmarkImage",&"_minusImage",&"_xImage",&"_defaultBackgroundImageForType:andState:",&"_defaultTitleColorForState:button:",&"_defaultImageColorForState:button:"]
7.获取根控制器
MJRootVc()
输出示例微信
#""
8.获取KeyWindow
MJKeyWin()
输出示例
#";
layer = >"
9.某个控制器的子控制器,例如根控制器的子控制器
MJChildVcs(MJRootVc())
输出示例
, state: appeared, view:
| , state: appeared, view:
|| , state: appeared, view:
||| , state: appeared, view:
|||| , state: appeared, view:
||||| , state: appeared, view:
|||||| , state: appeared, view:
...
10.打印控制器的子控件(微信注册页示例)
MJSubviews(#0x137980200.view)
输出了一大堆
11.设置对象的frame
#0x13901b5a0.frame = MJRectMake(100,100,200,200)
输出示例
{0:{0:100,1:100},1:{0:200,1:200}}
12.加载framework,例如
MapKit
MJLoadFramework('MapKit')
输出示例
#"NSBundle(loaded)"
13.加载某个对象的所有成员变量
MJIvarNames(#0x144889800)
输出示例(网易云NMSettingViewController)
["isa","_hasAlternateNextResonder","_hasInputAssistantItem","_overrideTransitioningDelegate","_view","_tabBarItem","_navigationItem","_toolbarItems","_title","_nibName","
_nibBundle","_parentViewController","_childModalViewController","_parentModalViewController","_previousRootViewController","_modalTransitionView","_modalPreservedFirstResponder","_dimmingView","_dropShadowView",
"_currentAction","_storyboard","_externalObjectsTableForViewLoading","_topLevelObjectsToKeepAliveFromStoryboard","_savedHeaderSuperview","_savedFooterSuperview","_editButtonItem","_searchDisplayController","_strongSearchDisplayController","_modalTransitionStyle",
"_modalPresentationStyle","_lastKnownInterfaceOrientation","_popoverController","_containerViewInSheet","_contentSizeForViewInPopover","_formSheetSize","_recordedContentScrollView","_afterAppearance","_explicitAppearanceTransitionLevel","_interfaceBuilderKeyCommands",
"_addedKeyCommands","_overrideTraitCollections","_previewSourceViews","_viewControllerFlags","_retainCount","_ignoreAppSupportedOrientations","_viewHostsLayoutEngine","_storyboardIdentifier","_transitioningDelegate","overrideUseCustomPresentation","_modalPresentationCapturesStatusBarAppearance","_ignoresParentMargins","_childViewControllers","_customNavigationInteractiveTransitionDuration","_customNavigationInteractiveTransitionPercentComplete","_customTransitioningView","_lastNotifiedTraitCollection","
…
支持正则
MJIvarNames(#0x144889800,/view/)
输出示例
["_view","_savedHeaderSuperview","_savedFooterSuperview","_previewSourceViews","_viewControllerFlags",
"_viewHostsLayoutEngine","_storyboardPreviewSegueTemplates","_storyboardPreviewingRegistrants"]
14.所有继承自某个类的控制器,如
UIViewController
MJSubclasses(UIViewController)
输出示例
[CNContactPicker,SFBrowserServiceViewController,NMPlayDeviceAudioEffectViewController,NMRecommendFriendViewController,
SFWebViewController,_MKPlaceViewController,NMLyricViewController,NMMyCollectionSubViewController,QLWebViewDisplayBundle,
NMLLiveBGMBaseViewController,MKActivityViewController,DDSafariViewController,EKUIEventInviteesViewController,
NMMVChoiceSearchViewController,NMLLiveBGMDetailViewController,_SFPopoverSizingTableViewController,QLGenericDisplayBundle,
DDRemoteActionHostViewController,QLDisplayBundle,NMLLiveAlbumListViewController,NMLLiveAnchorBGMListViewController,
…
mjcript
实战示例,给WeChat
注册页添加一个红色的View
点击手机微信进入到注册页面
1.创建一个view
var view = [[UIView alloc]init]
2.设置view的frame和背景色
view.frame = MJRectMake(100,100,200,200)
view.backgroundColor = [UIColor redColor]
3.将view添加到frontVc的view上
[#0x137980200.view addSubview:view]
文章图片
demo.png 需求:要找登录页面的”登录”按钮
利用中文转unicode,例如”登录”MJSubviews(#0x137980200.view)
函数打印出一大堆view,button等等,在输出中查找的登录两个字,然而终端输出的内容,中文全部转成了unicode码,因此拿到”登录”的unicode码,便可以找到”登录”按钮的内存地址
利用python unicode()函数
1.终端进入到python环境
python
2.输入unicode函数指令
unicode('登录','UTF-8')
输出显示
u'\u767b\u5f55'
【iOS越狱-Cycript的第三方库mjcript.cy示例】“\u767b\u5f55”就是”登录”的unicode码
推荐阅读
- 2020-04-07vue中Axios的封装和API接口的管理
- iOS中的Block
- 记录iOS生成分享图片的一些问题,根据UIView生成固定尺寸的分享图片
- 2019-08-29|2019-08-29 iOS13适配那点事
- Hacking|Hacking with iOS: SwiftUI Edition - SnowSeeker 项目(一)
- iOS面试题--基础
- 接口|axios接口报错-参数类型错误解决
- iOS|iOS 笔记之_时间戳 + DES 加密
- iOS,打Framework静态库
- 常用git命令总结