Microsoft Word - iOSAppReverseEngineering.docx

(Romina) #1

Figure 6-42 [PhoneSettingsController myNumber:]


The implementation of [PhoneSettingsController myNumber:] is rather straightforward.


This method simply checks whether the length of [[PhoneSettingsTelephony telephony]


myNumber] is 0. If it is not 0, it is returned as my number, otherwise this method returns an


“unknown number” as an error reminder. Let’s test [[PhoneSettingsTelephony telephony]


myNumber] with Cycript:


FunMaker-5:~ root# cycript -p Preferences
cy# [[PhoneSettingsTelephony telephony] myNumber]
@"+86PhoneNumber"

Now, press home button to quit Preferences, then terminate it completely and make sure


it’ s not running in the background. After that, launch it again and don’t enter


MobilePhoneSettings for now, let’s test this method again:


FunMaker-5:~ root# cycript -p Preferences
cy# [[PhoneSettingsTelephony telephony] myNumber]
ReferenceError: Can’t find variable: PhoneSettingsTelephony

An error happens. What’s wrong? The reason is that PhoneSettingsTelephony is a class of


MobilePhoneSettings.bundle. If we don’t enter MobilePhoneSettings, this bundle will not be


loaded, so this class doesn’t exist. In other words, this method will only work after


MobilePhoneSettings.bundle is loaded. The way Preference.app loads


MobilePhoneSettings.bundle is called lazy load, which is common in iOS reverse engineering.


When you come across it, welcome to discuss with us on http://bbs.iosre.com.


So far, we can say we have already found the target function, because we have got both the


caller and arguments of this method, plus no UI operation is involved, we can call this method


neatly. However, there is still a fly in the ointment: MobilePhoneSettings.bundle must be

Free download pdf