}

//hook
MSHookFunction((void*)CNCopyCurrentNetworkInfo, (void*)new_CNCopyCurrentNetworkInfo, (void **)
&orig_CNCopyCurrentNetworkInfo);

9.2.3 Modify DeviceToken

DeviceToken is mainly used for message pushing of applications. Some applications use DeviceToken as the basis for identifying devices. AppDelegate's didRegister ForRemoteNotifications WithDeviceToken function contains DeviceToken in its parameters, so to modify DeviceToken, hook the function. But the problem is that the name of AppDelegate is not fixed. It may also be called P1AppDelegate or a class name modified by the developer. In this case, we can call objc_getClassList to get all classes, and then use class_conformsToProtocol and class_getInstanceMethod to confirm whether it is AppDelegate for each class. The code is as follows:

//Find the name of AppDelegate
int numClasses = objc_getClassList(NULL, 0);
Class* list = (Class*)malloc(sizeof(Class) * numClasses);
objc_getClassList(list, numClasses);    

for (int i = 0; i < numClasses; i++)
{
if (class_conformsToProtocol(list[i], @protocol(UIApplicationDelegate)) &&
class_getInstanceMethod(list[i],
@selector(application:didRegisterForRemoteNotificationsWithDeviceToken:)))
{
NSLog(@"class %@", list[i]);
MSHookMessageEx(list[i],
@selector(application:didRegisterForRemoteNotificationsWithDeviceToken:),
(IMP)replaced_didRegisterForRemoteNotificationsWithDeviceToken,
(IMP*)&original_didRegisterForRemoteNotificationsWithDeviceToken);
}
}

This is the new didRegister ForRemoteNotifications WithDeviceToken function we built:

}

Because the deviceToken parameter is similar to NSData, not NSString, we need to do a transformation here, the specific code is as follows:

}

9.2.4 Modification of location information

Location method of hook CLLocation Manager and coordinate method of CLLocation are used to modify location information. The code is as follows:

//Location
MSHookMessageEx(objc_getClass("CLLocationManager"), @selector(location), 
    (IMP)CLLocationManager_location, (IMP *)&_orig_CLLocationManager_location);
MSHookMessageEx(objc_getClass("CLLocation"), @selector(coordinate), (IMP)CLLocation_coordinate, 
    (IMP *)&_orig_CLLocation_coordinate);

The new location and coordinate processing code is as follows:

}

static CLLocationCoordinate2D (* _orig_CLLocation_coordinate)(id _self, SEL _cmd1);
CLLocationCoordinate2D CLLocation_coordinate(id _self, SEL _cmd1) {

NSLog(@"CLLocation_coordinate");

NSString *strLatitude = @"39.98788022"
NSString *strLongitude = @"116.34287412"

if([g_strRandomLocaltion isEqualToString:@"1"]){

    CLLocationCoordinate2D coordinate;
    coordinate.latitude = [strLatitude doubleValue];
    coordinate.longitude = [strLongitude doubleValue];
    return coordinate;
}
else if((strLatitude != nil) && (strLongitude != nil)){

    CLLocationCoordinate2D coordinate;
    coordinate.latitude = [strLatitude doubleValue];
    coordinate.longitude = [strLongitude doubleValue];
    return coordinate;
}
else{

    return _orig_CLLocation_coordinate(_self, _cmd1);
}

}

9.3 Clearance of application data

Because iOS applications generally store data in sandbox directories, as long as the application sandbox directory is emptied, the ordinary data stored by applications will be deleted. In this way, the application will be considered as a new running environment when it is re-installed.

For example, to clear the sandbox data of Wechat, we first need to get the path of the sandbox directory of Wechat and call the custom function getWeChat.- Sandbox Path, which uses private API s such as LS Application Workspace all Applications, obtains installation information for all applications, judges from the installation information that if Bundle ID is com.tencent.xin, it returns to the corresponding sandbox directory.

Clean Bundle Container clears sandbox data, and when it's done, remember to create a directory as a mobile user. Otherwise, the sandbox directory may not be writable after installing Wechat again due to permission issues. The code is as follows:

}

-(NSString*) getWeChatSandboxPath{

NSMutableArray *arrayAppInfo = [[NSMutableArray alloc] init];

//Get the list of applications
Class cls = NSClassFromString(@"LSApplicationWorkspace");
id s = [(id)cls performSelector:NSSelectorFromString(@"defaultWorkspace")];
NSArray *array = [s performSelector:NSSelectorFromString(@"allApplications")];

Class LSApplicationProxy_class = NSClassFromString(@"LSApplicationProxy");

for (LSApplicationProxy_class in array){

    NSString *strBundleID = [LSApplicationProxy_class performSelector:
        @selector(bundleIdentifier)];

    //Getting information about the application
    NSString *strVersion =  [LSApplicationProxy_class performSelector:@selector(bundleVersion)];
    NSString *strShortVersion =  [LSApplicationProxy_class performSelector:
        @selector(shortVersionString)];

    NSURL *strContainerURL = [LSApplicationProxy_class performSelector:@selector(containerURL)];
    NSString *strContainerDataPath = [strContainerURL path];

    NSURL *strResourcesDirectoryURL = [LSApplicationProxy_class performSelector:
        @selector(resourcesDirectoryURL)];
    NSString *strContainerBundlePath = [strResourcesDirectoryURL path];

    NSString *strLocalizedName = [LSApplicationProxy_class performSelector:
        @selector(localizedName)];
    NSString *strBundleExecutable = [LSApplicationProxy_class performSelector:
        @selector(bundleExecutable)];

    //NSLog(@"bundleID: %@ localizedName: %@", strBundleID, strLocalizedName);

    if ([strBundleID isEqualToString:@"com.tencent.xin"]) {

        return strContainerDataPath;
    }
}

return nil;

}

• (void)viewDidLoad {
  [super viewDidLoad];
  //Do any additional setup after loading the view, typically from a nib

  // Get Wechat Sandbox Catalogue
  NSString *strContainerDataPath = [self getWeChatSandboxPath];
  if (strContainerDataPath) {

    //Clear the Sandbox Catalogue of Wechat
    [self cleanBundleContainer:strContainerDataPath];
  

  }
  else{
  NSLog(@"can't find WeChat sandbox path");
  }
  }

In addition to the sandbox directory, the application data may also be stored in a. plist file in the / var/mobile/Library/Preferences directory. For example, QQ will save / var/mobile/Library/Preferences / com. tencent. mqqq. plist, and Wechat will save / var/mobile/Library/Preferences/com.tencent.xin.plist. Clear their code as follows:

}

9.4 Clear Keychain

On iOS system, Keychain's data is stored in / var/Keychains/keychain-2.db. This file is a SQLite database, and we can execute SQL statements to delete the corresponding data. Because Keychain is very important data, deleting system-related data may lead to serious consequences such as inability to access the system. If you want to delete application-related storage, you can clean it up by executing the following statements:

DELETE FROM genp WHERE agrp<>'apple' 
DELETE FROM cert WHERE agrp<>'lockdown-identities'
DELETE FROM keys WHERE agrp<>'lockdown-identities'
DELETE FROM inet
DELETE FROM sqlite_sequence

Keychain can also be cleaned up by code, noting that the application must run with root privileges. The code is as follows:

}

9.5 Clear Clipboard

The way to clear the clipboard is to call the launchctl unload command to stop the clipboard service, then delete the pasteboardDB file, and then call the launchctl load to load the clipboard service. So the content of the clipboard is empty. The relevant code is as follows:

}

The above method can clear the clipboard in iOS 8 and iOS 9, but by iOS 10, the storage location and structure of the clipboard have changed, so it can no longer be used. The specific code for iOS 10 to clear the clipboard is as follows:

}

9.6 Publishing Applications

When we write a jailbreak application, we usually pack the application into deb format, then make our own Cydia source and publish the Cydia source address. In this way, the user can search for our application and download it by adding the source address.

9.6.1 Package App into deb

Create a new debtest directory and two new directories, DEBIAN and Applications, under the debtest directory. Then a new text file control is created under DEBIAN, which is the configuration file for packaging. The editing file is as follows:

Package: net.exchen.test
Name: Application testing
Version: 0.1
Description: This is a test program.
Section: Game
Depends: firmware (>= 8.0)
Priority: optional
Architecture: iphoneos-arm
Author: exchen
Homepage: http://www.exchen.net
Icon: file:///Applications/test.app/Icon.png
Maintainer: exchen

Find the application you compiled with Xcode, copy it to the Applications directory, and remember to delete the. DS_Store file, otherwise the installation may fail, use ls-al to view the file for confirmation. Switch to the debtest superior directory and run the following command. If dpkg-deb is prompted not to find this command, go to the Theos directory to find:

/opt/theos/bin/dpkg-deb -b debtest test.deb

Package test.deb and install it. There are two ways to install, the first is to use iFile installation, upload files to any location on the mobile phone, open with iFile can be installed, if there are installation errors, the return code is 256, then it may be packaging. DS_Store into the package, the debtest directory. DS_Store files are deleted, re-typed. Package upload installation once, you can install successfully.

The second is to use Cydia installation to upload test.deb to the / var/root/Media/Cydia/AutoInstall directory, which will be installed automatically after reboot. Sometimes we need to decompress other people's packages for analysis. The DEB unpacking command is as follows:

dpkg -x test.deb testdir

9.6.2 Making Cydia Source Publishing Application

First generate Packages.bz2:

dpkg-scanpackages xxxx.deb > Packages

Packages file is actually a collection of control files. Open Packages and check it out. It's similar to the following format:

Package: net.exchen.xxx
Version: 1.0.0
Architecture: iphoneos-arm
Maintainer: exchen <http://www.exchen.net>
Depends: firmware (>= 8.0)
Filename: xxx.deb
Size: 120682
MD5sum: a55677d77e229dace421d65db2a80603
SHA1: 43bcff95156c043c461650938c89fce8dc8da037
SHA256: d088b1d050a7191078550a24340ed8228cfca019b665a60706d0996dd2e197e3
Section: System tools
Priority: optional
Homepage: http://www.exchen.net
Description: Powerful xxx Software
Author: exchen <http://www.exchen.net>
Icon: file:///Applications/xxx.app/AppIcon60x60@2x.png
Name: xxx

Also note that if your application contains dylib, to add Depends to the dependency of mobile strategy, Cydia will prompt you to restart after installing the application:

Depends: firmware (>= 8.0) mobilesubstrate

Then compress to generate Packages.bz2:

bzip2 Packages

Write Release files:

Origin: exchen Software Source™
Label: exchen
Suite: stable
Version: 1.7
Codename: exchen
Architectures: iphoneos-arm
Components: main
Description: exchen Software Source

Upload deb, Packages.bz2, Release to the Web server, add the source server address in Cydia, and install the application after successful addition, as shown in Figure 9-6.

9.7 Switching of Privileges

The application uses setuid(0); there is a problem when it is set to root. Because SpringBoard users are mobile, it can't "kill" the application. That is to say, double-clicking the Home button to push upward can't exit the application, but can cause the system to get stuck. At this time, only through SSH login to the system, executing killall-9 XXXX "kill" application, can the system return to normal use.

There are several ways to solve this problem, such as writing a Tweak to detect the event that SpringBoard double-clicks the Home key to exit the application, and then "kill" the application. But this method is somewhat circumvented, the simplest is to switch permissions, the application does not need to set uid at the beginning of startup, when it needs only root permission to do things, only set uid to 0, such as clearing Keychain must switch uid to 0, clearing after the uid set to 501, that is, mobile users.

setreuid(0,0);
clearKeychain(); 
setreuid(501,0);

9.8 Change IP Address

Opening an application or registering an account may be recorded as an IP address. If IP is unchanged, the application provider can filter the brush volume data through the IP address field. If IP is changed every time an application opens or registers, then big data statistics can not filter the brush volume behavior through the IP field.

In terms of network communication technology, the IP address of external network communication can not be disguised and modified by hook like system information. The most common way to change IP is to use VPN and HTTP proxy. These two methods need a large number of VPN servers and HTTP proxy servers. The cost is very high. At present, the most convenient way is to make the IP address of the operator with SIM card. Every time the flight mode is switched, the IP address will be retrieved.

The method of switching on and off flight mode is to use the private API [Radios Preferences setAirplane Mode], which is coded as follows:

Class RadiosPreferences = NSClassFromString(@"RadiosPreferences");
id radioPreferences = [[RadiosPreferences alloc] init];
[radioPreferences setAirplaneMode:YES];
sleep(1);
[radioPreferences setAirplaneMode:NO];

The header information of Radios Preferences is as follows:

@protocol RadiosPreferencesDelegate, OS_dispatch_queue, OS_os_log;
//#import "AppSupport-Structs.h"
@class NSObject;

typedef struct __SCPreferences* SCPreferencesRef;

@interface RadiosPreferences : NSObject {

SCPreferencesRef _prefs;
int _applySkipCount;
id<RadiosPreferencesDelegate> _delegate;
BOOL _isCachedAirplaneModeValid;
BOOL _cachedAirplaneMode;
//NSObject*<OS_dispatch_queue> _dispatchQueue;
//NSObject*<OS_os_log> radios_prefs_log;
BOOL notifyForExternalChangeOnly;

}

@property (assign,nonatomic) BOOL airplaneMode;
@property (assign,nonatomic) id<RadiosPreferencesDelegate> delegate; //@synthesize delegate=_delegate - In the implementation block
@property (assign,nonatomic) BOOL notifyForExternalChangeOnly;
+(BOOL)shouldMirrorAirplaneMode;
-(void*)getValueForKey:(id)arg1 ;
-(void)notifyTarget:(unsigned)arg1 ;
-(void)initializeSCPrefs:(id)arg1 ;
-(void)setAirplaneModeWithoutMirroring:(BOOL)arg1 ;
-(void*)getValueWithLockForKey:(id)arg1 ;
//-(void)setCallback:(/function pointer/void*)arg1 withContext:(SCD_Struct_Ra9*)arg2 ;
-(BOOL)notifyForExternalChangeOnly;
-(id)init;
-(oneway void)release;
-(void)setValue:(void*)arg1 forKey:(id)arg2 ;
-(id<RadiosPreferencesDelegate>)delegate;
-(void)synchronize;
-(void)setDelegate:(id<RadiosPreferencesDelegate>)arg1 ;
-(void)dealloc;
-(id)initWithQueue:(id)arg1 ;
-(void)refresh;
-(BOOL)airplaneMode;
-(void)setNotifyForExternalChangeOnly:(BOOL)arg1 ;
-(BOOL)telephonyStateWithBundleIdentifierOut:(id*)arg1 ;
-(void)setTelephonyState:(BOOL)arg1 fromBundleID:(id)arg2 ;
-(void)setAirplaneMode:(BOOL)arg1 ;
@end

Note that you also need to sign the executable file of the application, add access rights, and create a new ent2.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.wifi.manager-access</key>
<true/>
<key>com.apple.SystemConfiguration.SCPreferences-write-access</key>
<array>
<string>com.apple.radios.plist</string>
</array>
<key>com.apple.SystemConfiguration.SCDynamicStore-write-access</key>
<true/>
<key>com.apple.springboard.debugapplications</key>
<true/>
<key>run-unsigned-code</key>
<true/>
<key>get-task-allow</key>
<true/>
<key>task_for_pid-allow</key>
<true/>
</dict>
</plist>

Then sign:

BUILD_APP_PATH_FILE="$BUILT_PRODUCTS_DIR/$TARGET_NAME.app/$TARGET_NAME"
codesign -s - --entitlements ~/dev/tools/ent2.plist -f "$BUILD_APP_PATH_FILE"

In this way, the setAirplaneMode function can be executed effectively.

9.9 Prison Break Detection

If a device is jailbreaking, it may be considered a risky device by the supplier of the application. To avoid being detected in the jailbreaking state, brush teams will rack their brains to use various methods to combat it. Apple does not provide an API to detect jailbreak status directly. The common method of jailbreak detection is to judge whether Cydia and other related documents exist or if they exist, they indicate jailbreak, otherwise there will be no jailbreak. The following files are generally detected:

 /Applications/Cydia.app

 /private/var/lib/cydia

 /Applications/iFile.app

 /Library/MobileSubstrate/MobileSubstrate.dylib

 /usr/bin/sshd

 /var/lib/apt

 /private/var/lib/apt

 /.cydia_no_stash

To bypass jailbreak detection, hook-related file judgement functions such as [NSFileManager file ExistsAtPath] and stat are required. Then, determine the path of the file. If the file path is a file related to jailbreak, it returns to the state that cannot be found. The hook code is as follows:

MSHookFunction((void*)stat, (void*)replaced_stat, (void **) &original_stat);
MSHookMessageEx(objc_getClass("NSFileManager"), @selector(fileExistsAtPath:), 
    (IMP)NSFileManager_fileExistsAtPath, (IMP *)&_orig_NSFileManager_fileExistsAtPath);
MSHookMessageEx(objc_getClass("NSFileManager"), @selector(fileExistsAtPath:isDirectory:), 
    (IMP)NSFileManager_fileExistsAtPath_isDirectory, (IMP *)&_orig_NSFileManager_
    fileExistsAtPath_isDirectory);

After hook, the new function is processed as follows:

NSArray *bypassList = [[NSArray alloc] initWithObjects:
    @"/Applications",
    @"/usr/sbin",
    @"/usr/libexec",
    @"/usr/bin/sshd",
    @"/var/lib",
    @"/private/var/lib",
    @"/var/root",
    @"/bin/bunzip2",
    @"/bin/bash",
    @"/bin/sh",
    @"/User/Applications",
    @"/User/Applications/",
    @"/etc",
    @"/panguaxe",
    @"/panguaxe.installed",
    @"/xuanyuansword",
    @"/xuanyuansword.installed",
    @"/taig",
    @"/report_3K.plist",
    @"/.pg_inst",
    @"/pguntether",
    @"/.cydia_no_stash",
    @"/Library/MobileSubstrate",
    @"/System/Library/LaunchDaemons",
    @"/var/mobile/Library/Preferences",
    nil];

int (*original_stat)(const char *path, struct stat *info);
static int replaced_stat(const char *path, struct stat *info) {

for (NSString *bypassPath in bypassList) {
    if (strncmp([bypassPath UTF8String], path, [bypassPath length]) == 0) {
        errno = ENOENT;
        return -1;
    }
}
return original_stat(path, info);

}

static BOOL (* _orig_NSFileManager_fileExistsAtPath)(id _self, SEL _cmd1, NSString *path);
BOOL NSFileManager_fileExistsAtPath(id _self, SEL _cmd1, NSString *path) {

for (NSString *bypassPath in bypassList) {
    if ([path hasPrefix:bypassPath]) {
        return NO;
    }
}
return _orig_NSFileManager_fileExistsAtPath(_self, _cmd1, path);

}

static BOOL (* _orig_NSFileManager_fileExistsAtPath_isDirectory)(id _self, SEL _cmd1, NSString *path,
BOOL *isDirectory);
BOOL NSFileManager_fileExistsAtPath_isDirectory(id _self, SEL _cmd1, NSString *path, BOOL *isDirectory) {

for (NSString *bypassPath in bypassList) {
    if ([path hasPrefix:bypassPath]) {
        return NO;
    }
}
return _orig_NSFileManager_fileExistsAtPath_isDirectory(_self, _cmd1, path, isDirectory);

}

In addition to file judgment, there are also some "advanced" methods of jailbreak detection, such as detecting the environment variables of DYLD_INSERT_LIBRARIES and whether the detection function is hook ed. These methods will be introduced in Section 12.4.

9.10 Modify any location information without jailbreak

The method of modifying location information is explained in Section 9.3.4. The principle is to hook the corresponding method after escape. How to modify the location information if you don't escape from prison? Of course, there are ways. Remember that in Xcode, debugging programs on simulators can set virtual locations? This method can also be applied to the real machine, so as to achieve the effect of modifying the location information without jailbreak.

iOS original coordinate system is WGS-84, Gaud coordinate system is GCS-02, Baidu coordinate system is BD-09. We need to do a coordinate conversion before changing the location. The Golden Map provides a coordinate pickup system, which can easily find the coordinate location. The address is http://lbs.amap.com/console/show/picker. First, find a coordinate position as the location we intend to specify, such as searching Beijing Jiaotong University, find the coordinates 116.342802, 39.952291, as shown in Figure 9-7.

When the coordinates of Golden Map are displayed on the mobile phone, there will be offset errors, so it needs to be converted to the coordinate system used by Apple. Through [JZLocation Converterger cj02ToWgs84:] method, coordinate transformation can be carried out. The specific code is as follows:

CLLocation *location = [[CLLocation alloc] initWithLatitude:39.952291 longitude:116.342802];
CLLocationCoordinate2D c2d = [JZLocationConverter gcj02ToWgs84:location.coordinate];
NSLog(@"The converted coordinates are:%f,%f",c2d.latitude,c2d.longitude);

The coordinates after transformation are 39.950950, 116.336629. Create a new APP project, create a new gpx file in the project, write the converted coordinates, the specific code is as follows:

<?xml version="1.0" encoding="UTF-8" ?>
<gpx version="1.1"
     creator="http://www.exchen.net"
     xmlns="http://www.topografix.com/GPX/1/1"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://www.topografix.com/GPX/1/1 http://www.topografix.com/GPX/1/1/gpx.xsd">
<wpt lat="39.950950" lon="116.336629">
<name>beijing</name>
<cmt>Beijing Jiaotong University</cmt>
<desc>Beijing Jiaotong University</desc>
</wpt>
</gpx>

Then click Produce Scheme Eidt Scheme Options in Xcode, check Allow Location Simulation, and select the new gpx file we just created, as shown in Figure 9-8.

After running, open Baidu Map or Gaode Map on the mobile phone, and it will show that the current location is in Beijing Jiaotong University, as shown in Figure 9-9.

9.11 Log on to the same Wechat on both mobile phones at the same time

We know that a Wechat account can only be logged on to one mobile phone. If a Wechat account is logged on to two mobile phones, the latter will cancel the former. So how to make a Wechat account login on two mobile phones at the same time? We found that Wechat supports simultaneous login of computers and mobile phones, but some people may overlook one thing: Wechat itself supports simultaneous login of the iPhone and the iPad. So there's a trick to change the iPhone to the iPad for Wechat on the system, so that you can log in at the same time, as shown in Figure 9-10.

The modified methods are hook uname and [UIDevice_model] methods, which are coded as follows:

MSHookFunction((void*)uname, (void*)new_uname, (void **)&orig_uname);
MSHookMessageEx(objc_getClass("UIDevice"), @selector(model), (IMP)UIDevice_model, &_orig_UIDevice_model);

Then write a new function with the following code:

static int (*orig_uname)(struct utsname *);
int new_uname(struct utsname *systemInfo);

int new_uname(struct utsname * systemInfo){

NSLog(@"new_uname");

int nRet = orig_uname(systemInfo);

char str_machine_name[100] = {"iPad3,6"};  //iPad4
char str_device_name[100] = {"iPad"};

strcpy(systemInfo->machine,str_machine_name);
strcpy(systemInfo->nodename, str_device_name);

return nRet;

}

static IMP _orig_UIDevice_model;
NSString *UIDevice_model(id _self, SEL _cmd1) {
NSString *fakeModel = @"iPad";
return fakeModel;
}

9.12 62 Data of Wechat

When a Wechat account is logged on to a new device, it is prompted to authenticate, as shown in Figure 9-11.

Click on "Start Verification" to indicate that there are three ways to authenticate identity. The first way is "Short Message Verification". The second way is "Sweep Two-Dimensional Code Verification". The third way is "Invite Friends to Authenticate". Only after the validation has passed, can the login succeed.

The purpose of 62 data is to bypass the authentication of new device login. 62 Data Stored in Sandbox Directory Library/ In the WechatPrivate/wx.dat file. Close the Wechat process, first copy the file to the new device, and then enter the following command to set the permission of the file:

chown -R mobile:mobile /private/var/mobile/Containers/Data/Application/236C09C7-E9BC-41E5-A956-
    53FE5743EDC8/Library/WechatPrivate
chmod -R 755 /private/var/mobile/Containers/Data/Application/236C09C7-E9BC-41E5-A956-53FE5743EDC8/
    Library/WechatPrivate

Finally, when you open the Wechat and log in, you won't be prompted to authenticate. This is called 62 data because the wx.dat file begins with hexadecimal 62, as shown in Figure 9-12.