Microsoft Word - iOSAppReverseEngineering.docx

{

u_int32_t randomNumber;

if (i % 3 == 0) randomNumber = arc4random_uniform(i);

NSProcessInfo *processInfo = [NSProcessInfo processInfo];

NSString *hostName = processInfo.hostName;

int pid = processInfo.processIdentifier;

NSString *globallyUniqueString = processInfo.globallyUniqueString;

NSString *processName = processInfo.processName;

NSArray *junks = @[hostName, globallyUniqueString, processName];

NSString *junk = @"";

for (int j = 0; j < pid; j++)

{

if (pid % 6 == 0) junk = junks[j % 3];

}

if (i % 68 == 1) NSLog(@"Junk: %@", junk);

}

NSLog(@"iOSRE: CFunction: %s", arg0);

}

extern "C" void ShortCFunction(const char *arg0) // ShortCFunction is too short to be

hooked

{

CPPClass cppClass;

cppClass.CPPFunction(arg0);

}

@implementation RootViewController

• (void)loadView {
  self.view = [[[UIView alloc] initWithFrame:[[UIScreen mainScreen]
  applicationFrame]] autorelease];
  self.view.backgroundColor = [UIColor redColor];
  }


• (void)viewDidLoad
  {
  [super viewDidLoad];

CPPClass cppClass;

cppClass.CPPFunction("This is a C++ function!");

CFunction("This is a C function!");

ShortCFunction("This is a short C function!");

}

@end

We’ve written a CPPClass::CPPFunction, a CFunction, and a ShortCFunction as our

hooking targets. Here, we’ve intentionally added some useless code in CPPClass::CPPFunction

and CFuntion for the purpose of increasing the length of these two functions to validate

MSHookFunction. However, MSHookFunction will fail on ShortCFunction because of its short

length, and we have a plan B for this situation.

3. Modify Makefile and install the tweak:

export THEOS_DEVICE_IP = iOSIP

export ARCHS = armv7 arm64

export TARGET = iphone:clang:latest:8.0