Microsoft Word - iOSAppReverseEngineering.docx

(Romina) #1

Figure 10- 91 Trace IMHandle


You’ll find it is indeed an addObject:, and by its context, you’ll see its argument comes from


imHandleWithID:alreadyCanonical:. As the name suggests, it returns an IMHandle object. It’s


getting closer, let’s set a breakpoint on the first objc_msgSend in figure 10-91 to reconstruct the


prototype of imHandleWithID:alreadyCanonical:.


Process 343388 stopped
* thread #1: tid = 0x53d5c, 0x30a84e98 ChatKit`-[CKTranscriptController sendMessage:] +
516, queue = 'com.apple.main-thread, stop reason = breakpoint 1.1
frame #0: 0x30a84e98 ChatKit`-[CKTranscriptController sendMessage:] + 516
ChatKit`-[CKTranscriptController sendMessage:] + 516:




  • 0x30a84e98: blx 0x30b3bf44 ; symbol stub for:
    MarcoShouldLogMadridLevel$shim
    0x30a84e9c: mov r2, r0
    0x30a84e9e: ldr r0, [sp, #40]
    0x30a84ea0: mov r1, r11
    (lldb) p (char )$r1
    (char
    ) $0 = 0x30b55fb4 "imHandleWithID:alreadyCanonical:"
    (lldb) po $r0
    IMAccount: 0x145e30d0 [ID: 26B3EC90-783B-4DEC-82CF-F58FBBB22363 Service:
    IMService[iMessage] Login: P:+86PhoneNumber Active: YES LoginStatus: Connected]
    (lldb) po $r2
    [email protected]
    (lldb) p $r3
    (unsigned int) $3 = 0





Both arguments are revealed; the 1st is my iMessage address, the 2nd is 0, i.e. NO in BOOL.


The receiver is an IMAccount object, where is it from? As shown in figure 10-91, R0 comes from


[SP, #0xA8+var_84], so according to figure 10-92 and 10-93, IMAccount comes from


[[IMAccountController sharedInstance] __ck_defaultAccountForService:[CKConversation


sendingService]].

Free download pdf