Microsoft Word - iOSAppReverseEngineering.docx

%hook SpringBoard

• (void)_menuButtonDown:(id)down
  {
  NSLog(@"You’ve pressed home button.");
  %orig; // call the original _menuButtonDown:
  }
  %end

This snippet is to hook [SpringBoard _menuButtonDown:], write something to syslog

before executing the original method.

² %log

This directive is used inside %hook to write the method arguments to syslog. We can also

append anything else with the format of %log([(), ...]), for example:

%hook SpringBoard

• (void)_menuButtonDown:(id)down
  {
  %log((NSString )@"iOSRE", (NSString )@"Debug");
  %orig; // call the original _menuButtonDown:
  }
  %end

The output is as follows:

Dec 3 10:57:44 FunMaker- 5 SpringBoard[786]: - [<SpringBoard: 0x150eb800>

_menuButtonDown:+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Timestamp: 75607608282

Total Latency: 20266 us

SenderID: 0x0000000100000190

BuiltIn: 1

AttributeDataLength: 16

AttributeData: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

ValueType: Absolute

EventType: Keyboard

UsagePage: 12

Usage: 64

Down: 1

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

]: iOSRE, Debug

² %orig

%orig is also used inside %hook; it executes the original hooked method, for example:

%hook SpringBoard

• (void)_menuButtonDown:(id)down
  {
  NSLog(@"You’ve pressed home button.");
  %orig; // call the original _menuButtonDown:
  }
  %end

If %orig is removed, the original method will not be executed, for example:

%hook SpringBoard

• (void)_menuButtonDown:(id)down
  {