iOS越狱-Cycript的第三方库mjcript.cy示例

mjcript下载地址:https://github.com/CoderMJLee/mjcript
安装方法
将mjcript.cy文件拖到/usr/lib/cycript0.9
使用方法
1.使用SSH登录到服务器,使用之前介绍的脚本命令

sh usb.sh sh login.sh

2.使用Cycript监听App,例如微信
cycript -p WeChat

3.导入导入mjcript
@import mjcript

实用函数示例
1.获取AppId
MJAppId

输出示例微信
@"com.tencent.xin"

2.App包存储路径
MJAppPath

输出示例
@"/var/containers/Bundle/Application/39508FC2-EE84-45C2-8373-11C4D41B4760/WeChat.app"

3.App沙盒路径
MJDocPath

输出示例
@"/var/mobile/Containers/Data/Application/DBA965AC-3B8A-45F3-BEC9-17DD3DFF30B4/Documents"

MJCachesPath

输出示例
@"/var/mobile/Containers/Data/Application/DBA965AC-3B8A-45F3-BEC9-17DD3DFF30B4/Library/Caches"

4.拿到显示在最前面的控制器
MJFrontVc()

输出示例
#""

在手机上点击注册按钮,再次输入指令看看最前面的控制器
输出示例:
#""

5..获得某个类的对象方法名列表
MJInstanceMethodNames(WCAccountLoginFirstViewController)

输出示例
[&"getVisibleHeight",&"initView",&"adjustViewAndNavBarRect",&"onLanguageChange",&"adjustTableViewRect",&"updateChangeLanguageBtn",&"onChangeLanguage",&"getBackgroundImgWithOrientation:",&".cxx_destruct",&"setDelegate:",&"dealloc",&"init",&"willAnimateRotationToInterfaceOrientation:duration:",&"didRotateFromInterfaceOrientation:"]

支持正则
MJInstanceMethodNames(WCAccountLoginFirstViewController,/adjust/)

输出示例
[&"adjustViewAndNavBarRect",&"adjustTableViewRect"]

6.获取某个对象的类方法名列表
MJClassMethodNames(#0x13901b5a0)

微信某个button输出示例
[&"buttonWithType:",&"_setVisuallyHighlighted:forViews:initialPress:",&"_defaultNormalTitleColor",&"_defaultNormalTitleShadowColor",&"_defaultImageForType:andState:",&"_buttonTypeIsModernUI:",&"_setVisuallyHighlighted:forViews:initialPress:baseAlpha:",&"_selectedIndicatorImage",&"_infoLightImage",&"_detailDisclosureImage",&"_plusImage",&"_infoDarkImage",&"_exclamationMarkImage",&"_questionMarkImage",&"_checkmarkImage",&"_minusImage",&"_xImage",&"_defaultBackgroundImageForType:andState:",&"_defaultTitleColorForState:button:",&"_defaultImageColorForState:button:"]

7.获取根控制器
MJRootVc()

输出示例微信
#""

8.获取KeyWindow
MJKeyWin()

输出示例
#"; layer = >"

9.某个控制器的子控制器,例如根控制器的子控制器
MJChildVcs(MJRootVc())

输出示例
, state: appeared, view: | , state: appeared, view: || , state: appeared, view: ||| , state: appeared, view: |||| , state: appeared, view: ||||| , state: appeared, view: |||||| , state: appeared, view: ...

10.打印控制器的子控件(微信注册页示例)
MJSubviews(#0x137980200.view)

输出了一大堆
11.设置对象的frame
#0x13901b5a0.frame = MJRectMake(100,100,200,200)

输出示例
{0:{0:100,1:100},1:{0:200,1:200}}

12.加载framework,例如MapKit
MJLoadFramework('MapKit')

输出示例
#"NSBundle(loaded)"

13.加载某个对象的所有成员变量
MJIvarNames(#0x144889800)

输出示例(网易云NMSettingViewController)
["isa","_hasAlternateNextResonder","_hasInputAssistantItem","_overrideTransitioningDelegate","_view","_tabBarItem","_navigationItem","_toolbarItems","_title","_nibName"," _nibBundle","_parentViewController","_childModalViewController","_parentModalViewController","_previousRootViewController","_modalTransitionView","_modalPreservedFirstResponder","_dimmingView","_dropShadowView", "_currentAction","_storyboard","_externalObjectsTableForViewLoading","_topLevelObjectsToKeepAliveFromStoryboard","_savedHeaderSuperview","_savedFooterSuperview","_editButtonItem","_searchDisplayController","_strongSearchDisplayController","_modalTransitionStyle", "_modalPresentationStyle","_lastKnownInterfaceOrientation","_popoverController","_containerViewInSheet","_contentSizeForViewInPopover","_formSheetSize","_recordedContentScrollView","_afterAppearance","_explicitAppearanceTransitionLevel","_interfaceBuilderKeyCommands", "_addedKeyCommands","_overrideTraitCollections","_previewSourceViews","_viewControllerFlags","_retainCount","_ignoreAppSupportedOrientations","_viewHostsLayoutEngine","_storyboardIdentifier","_transitioningDelegate","overrideUseCustomPresentation","_modalPresentationCapturesStatusBarAppearance","_ignoresParentMargins","_childViewControllers","_customNavigationInteractiveTransitionDuration","_customNavigationInteractiveTransitionPercentComplete","_customTransitioningView","_lastNotifiedTraitCollection"," …

支持正则
MJIvarNames(#0x144889800,/view/)

输出示例
["_view","_savedHeaderSuperview","_savedFooterSuperview","_previewSourceViews","_viewControllerFlags", "_viewHostsLayoutEngine","_storyboardPreviewSegueTemplates","_storyboardPreviewingRegistrants"]

14.所有继承自某个类的控制器,如UIViewController
MJSubclasses(UIViewController)

输出示例
[CNContactPicker,SFBrowserServiceViewController,NMPlayDeviceAudioEffectViewController,NMRecommendFriendViewController, SFWebViewController,_MKPlaceViewController,NMLyricViewController,NMMyCollectionSubViewController,QLWebViewDisplayBundle, NMLLiveBGMBaseViewController,MKActivityViewController,DDSafariViewController,EKUIEventInviteesViewController, NMMVChoiceSearchViewController,NMLLiveBGMDetailViewController,_SFPopoverSizingTableViewController,QLGenericDisplayBundle, DDRemoteActionHostViewController,QLDisplayBundle,NMLLiveAlbumListViewController,NMLLiveAnchorBGMListViewController, …

mjcript实战示例,给WeChat注册页添加一个红色的View
点击手机微信进入到注册页面
1.创建一个view
var view = [[UIView alloc]init]

2.设置view的frame和背景色
view.frame = MJRectMake(100,100,200,200) view.backgroundColor = [UIColor redColor]

3.将view添加到frontVc的view上
[#0x137980200.view addSubview:view]

iOS越狱-Cycript的第三方库mjcript.cy示例
文章图片
demo.png 需求:要找登录页面的”登录”按钮
利用MJSubviews(#0x137980200.view)函数打印出一大堆view,button等等,在输出中查找的登录两个字,然而终端输出的内容,中文全部转成了unicode码,因此拿到”登录”的unicode码,便可以找到”登录”按钮的内存地址
中文转unicode,例如”登录”
利用python unicode()函数
1.终端进入到python环境
python

2.输入unicode函数指令
unicode('登录','UTF-8')

输出显示
u'\u767b\u5f55'

【iOS越狱-Cycript的第三方库mjcript.cy示例】“\u767b\u5f55”就是”登录”的unicode码

    推荐阅读