iOS底子开发知识速览 - 理解你要逆向的目的 - ToB企服应用市场:ToB评测及商务社交产业平台

// 头文件 (.h)
@interface MyClass : NSObject
@property (nonatomic, strong) NSString *name;
@property (nonatomic, assign) int age;
- (void)sayHello;
- (NSString *)getGreetingForName:(NSString *)name withAge:(int)age;
@end
// 实现文件 (.m)
@implementation MyClass
- (void)sayHello {
NSLog(@"Hello, I'm %@", self.name);
}
**绕过方法**：
- Hook sysctl和ptrace函数
- 修改返回的进程信息
- 使用反调试保护绕过插件
### 3. 代码混淆与加密
开发者可能会使用代码混淆和加密技术保护核心代码：
**常见技术**：
- 字符串加密
- 控制流扁平化
- 函数名混淆
- 自定义加密算法
**逆向对策**：
- 动态分析：在运行时观察解密后的数据
- 使用Frida Hook关键函数
- 编写脚本自动解密字符串
- 利用模式识别还原控制流
### 4. SSL Pinning
SSL Pinning用于防止中间人攻击，但也会阻碍网络流量分析：
**常见实现**：
```objective-c
// 使用NSURLSession进行证书验证
- (void)URLSession:(NSURLSession *)session didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition, NSURLCredential *))completionHandler {
if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {
NSString *host = challenge.protectionSpace.host;
SecTrustRef serverTrust = challenge.protectionSpace.serverTrust;
// 加载本地证书
NSString *certPath = [[NSBundle mainBundle] pathForResource:@"server" ofType:@"cer"];
NSData *certData = [NSData dataWithContentsOfFile:certPath];
CFDataRef certDataRef = (__bridge CFDataRef)certData;
SecCertificateRef cert = SecCertificateCreateWithData(NULL, certDataRef);
// 设置证书验证策略
SecPolicyRef policy = SecPolicyCreateSSL(true, (__bridge CFStringRef)host);
SecTrustSetPolicies(serverTrust, policy);
CFRelease(policy);
// 添加锚点证书
SecTrustSetAnchorCertificates(serverTrust, (__bridge CFArrayRef)@[(__bridge id)cert]);
SecTrustSetAnchorCertificatesOnly(serverTrust, true);
CFRelease(cert);
// 执行验证
SecTrustResultType result;
SecTrustEvaluate(serverTrust, &result);
if (result == kSecTrustResultUnspecified || result == kSecTrustResultProceed) {
NSURLCredential *credential = [NSURLCredential credentialForTrust:serverTrust];
completionHandler(NSURLSessionAuthChallengeUseCredential, credential);
} else {
completionHandler(NSURLSessionAuthChallengeRejectProtectionSpace, nil);
}
} else {
completionHandler(NSURLSessionAuthChallengePerformDefaultHandling, nil);
}
}

复制代码

strings AppBinary | grep -i "password\|login\|token\|secure"

复制代码

class-dump -H AppBinary | grep -A 10 -B 10 "login"

复制代码

Interceptor.attach(ObjC.classes.NSFileManager["- writeData:toFile:options:error:"].implementation, {
onEnter: function(args) {
var data = new ObjC.Object(args[2]);
var path = new ObjC.Object(args[3]).toString();
console.log("[+] 写入文件: " + path);
console.log(" 数据: " + data);
}
});

复制代码

# 解密应用
python3 dump.py "SecureNotes"
# 提取头文件
class-dump -H SecureNotes.decrypted -o SecureNotes_headers

复制代码

// 监控登录方法
Interceptor.attach(ObjC.classes.SNLoginViewController["- loginWithUsername:password:completion:"].implementation, {
onEnter: function(args) {
var username = new ObjC.Object(args[2]).toString();
var password = new ObjC.Object(args[3]).toString();
console.log("[+] 登录尝试:");
console.log(" 用户名: " + username);
console.log(" 密码: " + password);
}
});
// 监控网络请求
Interceptor.attach(ObjC.classes.NSURLSession["- dataTaskWithRequest:completionHandler:"].implementation, {
onEnter: function(args) {
var request = new ObjC.Object(args[2]);
if (request.URL().absoluteString().toString().includes("login")) {
console.log("[+] 登录请求:");
console.log(" URL: " + request.URL().absoluteString());
var body = request.HTTPBody();
if (body) {
console.log(" Body: " + new ObjC.Object(body).toString());
}
}
}
});

复制代码

// 监控加密方法
Interceptor.attach(ObjC.classes.SNEncryptionService["- encryptData:withKey:error:"].implementation, {
onEnter: function(args) {
this.data = new ObjC.Object(args[2]);
this.key = new ObjC.Object(args[3]);
console.log("[+] 加密数据:");
console.log(" 原始数据: " + this.data.toString());
console.log(" 密钥: " + this.key.toString());
},
onLeave: function(retval) {
var encryptedData = new ObjC.Object(retval);
console.log(" 加密结果: " + encryptedData);
}
});

复制代码

// 绕过生物认证
Interceptor.attach(ObjC.classes.LAContext["- evaluatePolicy:localizedReason:reply:"].implementation, {
onEnter: function(args) {
var reason = new ObjC.Object(args[3]);
console.log("[+] 请求生物认证: " + reason);
// 获取原始回调块
var originalBlock = new ObjC.Block(args[4]);
// 替换为我们的回调
var replacementBlock = function(success, error) {
console.log(" 拦截生物认证回调，强制成功");
originalBlock(true, null);
};
args[4] = replacementBlock;
}
});

复制代码

# 查找SQLite数据库
find /var/mobile/Containers/Data/Application/*/SecureNotes -name "*.sqlite"
# 查看UserDefaults内容
plutil -p /var/mobile/Containers/Data/Application/*/SecureNotes/Library/Preferences/com.example.securenotes.plist

复制代码

// 监控同步请求
Interceptor.attach(ObjC.classes.SNCloudSyncManager["- syncNotes:"].implementation, {
onEnter: function(args) {
var notes = new ObjC.Object(args[2]);
console.log("[+] 开始同步笔记:");
console.log(" 笔记数量: " + notes.count());
for (var i = 0; i < notes.count(); i++) {
var note = notes.objectAtIndex_(i);
console.log(" 笔记 " + i + ": " + note.title());
}
}
});

复制代码