Microsoft Word - iOSAppReverseEngineering.docx

(Romina) #1

  • (void)dealloc;

  • (id)initWithCGColor:(struct CGColor *)arg1;

  • (id)initWithWhite:(float)arg1 alpha:(float)arg2;


@end

UIDeviceWhiteColor inherits from UIColor. Since UIColor is a public class, stop our


analysis at this level is enough for us to get the result. For other id type arguments, we can apply


the same solution.


After we have known the effect of calling a method and analyzed its arguments, we can


write our own documents. I suggest you make some simple notes on the analysis results of


private methods so that you can recall it quickly next time you use the same private method.


Next, let’s use Cycript to test this method and see what effect it is when we pass [UIColor


magentaColor] as the argument.


FunMaker-5:~ root# cycript -p SpringBoard
cy# [[SBScreenFlash mainScreenFlasher] flashColor:[UIColor magentaColor]
withCompletion:nil]

A magenta flash scatters on the screen and it is much cooler than the original white flash.


Check the album and we don’t find a new screenshot. Therefore we guess that this method is


just for flashing the screen without actually performing the screenshot operation. Aha, a new


tweak inspiration arises, we can hook flashColor:withCompletion: and pass it a custom color to


enrich the screen flash with more colors. Also, we present it as an exercise and ask you to write a


tweak.


All above methodologies are summary of my 5-year experience. Because there is no official


documentations for iOS reverse engineering, my personal experiences will inevitably be biased


and impossible to cover everything. So you are welcome to http://bbs.iosre.com for further


discussions if you have any questions.


5.2.6 Limitations of class-dump


By analyzing class-dump headers, we’ve found what we are interested in. In section 5.2.4,


we’ve seen the effect by passing two contrary arguments to [SBScreenShotter saveScreenShot:].


In section 5.2.5, we’ve analyzed the 1st argument of flashColor:withCompletion: in


SBScreenFlash. From the effect of flashColor:withCompletion:, we guess that it should happen


inside saveScreenShot:. But if we just take class-dump headers and the private methods’ effects


as references, we can only know the execution order of saveScreenShot: and

Free download pdf