Microsoft Word - iOSAppReverseEngineering.docx

(Romina) #1

loaded, which weakens elegancy. Is there any way that enables us to get rid of this burden? I


think so. Because ultimately, my number is stored on SIM card, the original data source of


[PhoneSettingsTelephony myNumber] should come from SIM card. Whereas, SIM card


accessibility is obviously not limited to MobilePhoneSettings.bundle, there must be a more


common as well lower level library that can read SIM card. If we can locate this library, we can


get my number without loading MobilePhoneSettings.bundle. Since it’s supposed to be a lower


level library, naturally, we should dig into [PhoneSettingsTelephony myNumber] to find out


how it reads my number, as shown in figure 6-43.


Figure 6-43 [PhoneSettingsTelephony myNumber]


This method is also very simple. It judges if the instance variable _myNumber is nil; if not,


branches left and records “My Number requested, returning cached value: %@”, namely,


returns a data in cache; or else branches right, first get my number by calling


PhoneSettingsCopyMyNumber, then records “My Number requested, no cached value, fetched:


%@”, namely, my number is not in cache, so it returns a newly fetched data. In consequence,


PhoneSettingsCopyMyNumber is able to get my number, but as its name suggests, it is still a


function inside MobilePhoneSettings.bundle, we can’t call it from outside this bundle. We’re


one step further, but not far enough. Let’s continue by digging into


PhoneSettingsCopyMyNumber, as shown in figure 6-44.

Free download pdf