ios逆向开发工具,ios 开发者工具

iOS逆向工具之Theos(MacOS)介绍

终端执行这个命令就可以安装

正向iOS开发者,Mac上都安装着Xcode.如果你安装多个版本Xcode,指定其中一版本的Xcode就行.

终端执行命令

越狱iPhone下的签名工具（更改授权entitlements），可以为theos开发的程序进程签名 (支持在OS X和iOS上运行）。

我们可以通过终端命令进行安装

-ldid 用于签名

-fakeroot 用于模拟root权限

安装可能要花费一段时间,耐心等待一下.

注意:

关于ldid签名知识点补充

这里要提一下加密算法:

1. 对称加密算法:

RC4,DES,3DES,AES128,AES356等,加解密双方密钥相同.

2. 非对称加密算法:

RSA,Elgamal等,加解密双方使用密钥对.

3. 哈希算法:

注意

苹果签名:

1. 苹果签名 是苹果官方的私钥签名,公钥验证

2. 以数字签名形式进行签名

注意

数字签名

1. 数字签名是非对称密钥加密技术与数字摘要技术的应用.

2. 对指定信息使用哈希算法,得到一个固定长度的信息摘要.

3. 然后再使用 私钥 对该摘要加密,就得到了数字签名.

注意

数字证书:

1. 数字证书是一个文件,由苹果的Apple Worldwide Developer

Relations Certification Authority(WWDR)证书认证中心进行签名

2. 其主要作用是用来标识身份.

注意

证书文件主要包含两部分内容: 证书信息 和 证书签名

1.证书信息

包含用户的公钥,用户个人信息,证书颁发机构信息,证书有效期等信息

2.证书签名

WWDR将上述证书本身内容,通过哈希算法得到一个固定长度的信息摘要,然后使用自己的私钥对该信息摘要加密生成数字签名.

3.证书验证

注意

到这里,ldid介绍完成

dpkg:用于管理deb包.

deb是越狱开发安装包的标准格式,dpkg-deb是一个用于操作deb文件的工具,有了这个工具,Theos才能正确地把工程打包成为deb文件.

有的朋友会使用这个命令

报错 Error: invalid option: --from-bottle

大概意思是:无效的参数,这个有可能和安装的版本原因.

我多次安装后,把参数去掉了

到这里就完成了dpkg的安装.

我们在终端使用命令

sudo git clone --recursive /opt/theos

我们通过git clone 到/opt/theos目录下.

克隆需要一部分时间,我们需要耐心等待一会.

我们在终端添加/opt/thoes目录的所有者

sudo chown -R $(id -u):$(id -g) /opt/theos

source ~/.bash_profile

保存环境变量并生效

thoes到这里安装完成.

本篇文章主要介绍了Theos安装前准备.

我们下篇文章会介绍如何是theos,我们会创建tweak demo为大家介绍.

有问题请留言,持续关注.

逆向需要的工具汇总（持续更新中）

一、砸壳工具

dumpdecrypted:

Clutch:

二、界面分析工具

Reveal:

三、监控工具

snoop-it:

introspy:

四、静态分析工具

IDA:

Hopper:

五、动态调试工具

lldb:

六、动态脚本工具

cycript:

frida:

七、抓包工具

BurpSuite:

Charles:

Wireshark:

八、Mac工具

MachOView:

九、导出头文件工具

class-dump:

十、THEOS越狱开发工具包

thoes:

十一、文件管理工具

Filza ios设备查看文件系统

iFunBox/iExplorer mac设备查看ios设备的文件系统

十二、debugserver (动态调试,附加子进程)

十三、常用Tweak.xm预处理指令

十四、符号表恢复工具（restore-symbol）

其他工具：

iOSOpenDev:

insert_dylib:

iTerm:

Alfred:

iTools:

更新：2018-8-16

phantomjs ：提供一个浏览器环境的命令行接口，相当于"虚拟浏览器"。

PhantomJS官方地址： 。

PhantomJS官方API： 。

PhantomJS官方示例： 。

PhantomJS GitHub： 。

参考文档：

MonkeyDev ：

这里我就直接copy功能点了：

原有iOSOpenDev的升级，非越狱插件开发集成神器！

frida-ios-dump ：一键砸壳工具，非常的好用。

Hookzz ：通过Hookzz可以快速找到调用的方法，理清程序调用逻辑。

源码：

文档：

iOS逆向之动态调试 (LLDB)介绍

1. 如果说IDA是倚天剑,LLDB就是屠龙刀.

2. LLDB 全名为 Low Level Debugger ,由苹果出品,内置于Xcode中的动态调试工具.

3. LLDB是Xcode自带的调试工具,可以进行Mac应用/iPhone应用调试.

地址: LLDB地址

如果想了解更多关于LLDB内容,可以查看一下LLDB介绍网站.

我们对LLDB命令进行翻译

Debugger commands:

apropos -- List debugger commands related to a word or subject.

breakpoint -- Commands for operating on breakpoints (see 'help b' for

shorthand.)

bugreport -- Commands for creating domain-specific bug reports.

command -- Commands for managing custom LLDB commands.

disassemble -- Disassemble specified instructions in the current

target. Defaults to the current function for the

current thread and stack frame.

expression -- Evaluate an expression on the current thread. Displays

any returned value with LLDB's default formatting.

frame -- Commands for selecting and examing the current thread's

stack frames.

gdb-remote -- Connect to a process via remote GDB server. If no host

is specifed, localhost is assumed.

gui -- Switch into the curses based GUI mode.

help -- Show a list of all debugger commands, or give details

about a specific command.

kdp-remote -- Connect to a process via remote KDP server. If no UDP

port is specified, port 41139 is assumed.

language -- Commands specific to a source language.

log -- Commands controlling LLDB internal logging.

memory -- Commands for operating on memory in the current target

process.

platform -- Commands to manage and create platforms.

plugin -- Commands for managing LLDB plugins.

process -- Commands for interacting with processes on the current

platform.

quit -- Quit the LLDB debugger.

register -- Commands to access registers for the current thread and

stack frame.

reproducer -- Commands controlling LLDB reproducers.

script -- Invoke the script interpreter with provided code and

display any results. Start the interactive interpreter

if no code is supplied.

settings -- Commands for managing LLDB settings.

source -- Commands for examining source code described by debug

information for the current target process.

statistics -- Print statistics about a debugging session

target -- Commands for operating on debugger targets.

thread -- Commands for operating on one or more threads in the

current process.

type -- Commands for operating on the type system.

version -- Show the LLDB debugger version.

watchpoint -- Commands for operating on watchpoints.

Current command abbreviations (type 'help command alias' for more info):

add-dsym -- Add a debug symbol file to one of the target's current modules

by specifying a path to a debug symbols file, or using the

options to specify a module to download symbols for.

attach -- Attach to process by ID or name.

b -- Set a breakpoint using one of several shorthand formats.

bt -- Show the current thread's call stack. Any numeric argument

displays at most that many frames. The argument 'all' displays

all threads.

c -- Continue execution of all threads in the current process.

call -- Evaluate an expression on the current thread. Displays any

returned value with LLDB's default formatting.

continue -- Continue execution of all threads in the current process.

detach -- Detach from the current target process.

di -- Disassemble specified instructions in the current target.

Defaults to the current function for the current thread and

stack frame.

dis -- Disassemble specified instructions in the current target.

Defaults to the current function for the current thread and

stack frame.

display -- Evaluate an expression at every stop (see 'help target

stop-hook'.)

down -- Select a newer stack frame. Defaults to moving one frame, a

numeric argument can specify an arbitrary number.

env -- Shorthand for viewing and setting environment variables.

exit -- Quit the LLDB debugger.

f -- Select the current stack frame by index from within the current

thread (see 'thread backtrace'.)

file -- Create a target using the argument as the main executable.

finish -- Finish executing the current stack frame and stop after

returning. Defaults to current thread unless specified.

image -- Commands for accessing information for one or more target

modules.

j -- Set the program counter to a new address.

jump -- Set the program counter to a new address.

kill -- Terminate the current target process.

l -- List relevant source code using one of several shorthand formats.

list -- List relevant source code using one of several shorthand formats.

n -- Source level single step, stepping over calls. Defaults to

current thread unless specified.

next -- Source level single step, stepping over calls. Defaults to

current thread unless specified.

nexti -- Instruction level single step, stepping over calls. Defaults to

current thread unless specified.

ni -- Instruction level single step, stepping over calls. Defaults to

current thread unless specified.

p -- Evaluate an expression on the current thread. Displays any

returned value with LLDB's default formatting.

parray -- Evaluate an expression on the current thread. Displays any

returned value with LLDB's default formatting.

po -- Evaluate an expression on the current thread. Displays any

returned value with formatting controlled by the type's author.

poarray -- Evaluate an expression on the current thread. Displays any

returned value with LLDB's default formatting.

print -- Evaluate an expression on the current thread. Displays any

returned value with LLDB's default formatting.

q -- Quit the LLDB debugger.

r -- Launch the executable in the debugger.

rbreak -- Sets a breakpoint or set of breakpoints in the executable.

re -- Commands to access registers for the current thread and stack

frame.

repl -- Evaluate an expression on the current thread. Displays any

returned value with LLDB's default formatting.

run -- Launch the executable in the debugger.

s -- Source level single step, stepping into calls. Defaults to

current thread unless specified.

si -- Instruction level single step, stepping into calls. Defaults to

current thread unless specified.

sif -- Step through the current block, stopping if you step directly

into a function whose name matches the TargetFunctionName.

step -- Source level single step, stepping into calls. Defaults to

current thread unless specified.

stepi -- Instruction level single step, stepping into calls. Defaults to

current thread unless specified.

t -- Change the currently selected thread.

tbreak -- Set a one-shot breakpoint using one of several shorthand formats.

undisplay -- Stop displaying expression at every stop (specified by stop-hook

index.)

up -- Select an older stack frame. Defaults to moving one frame, a

numeric argument can specify an arbitrary number.

v -- Show variables for the current stack frame. Defaults to all

arguments and local variables in scope. Names of argument,

local, file static and file global variables can be specified.

Children of aggregate variables can be specified such as

'var-child.x'. The - and [] operators in 'frame variable' do

not invoke operator overloads if they exist, but directly access

the specified element. If you want to trigger operator

overloads use the expression command to print the variable

instead.

It is worth noting that except for overloaded operators, when

printing local variables 'expr local_var' and 'frame var

local_var' produce the same results. However, 'frame variable'

is more efficient, since it uses debug information and memory

reads directly, rather than parsing and evaluating an

expression, which may even involve JITing and running code in

the target program.

var -- Show variables for the current stack frame. Defaults to all

arguments and local variables in scope. Names of argument,

local, file static and file global variables can be specified.

Children of aggregate variables can be specified such as

'var-child.x'. The - and [] operators in 'frame variable' do

not invoke operator overloads if they exist, but directly access

the specified element. If you want to trigger operator

overloads use the expression command to print the variable

instead.

It is worth noting that except for overloaded operators, when

printing local variables 'expr local_var' and 'frame var

local_var' produce the same results. However, 'frame variable'

is more efficient, since it uses debug information and memory

reads directly, rather than parsing and evaluating an

expression, which may even involve JITing and running code in

the target program.

vo -- Show variables for the current stack frame. Defaults to all

arguments and local variables in scope. Names of argument,

local, file static and file global variables can be specified.

Children of aggregate variables can be specified such as

'var-child.x'. The - and [] operators in 'frame variable' do

not invoke operator overloads if they exist, but directly access

the specified element. If you want to trigger operator

overloads use the expression command to print the variable

instead.

It is worth noting that except for overloaded operators, when

printing local variables 'expr local_var' and 'frame var

local_var' produce the same results. However, 'frame variable'

is more efficient, since it uses debug information and memory

reads directly, rather than parsing and evaluating an

expression, which may even involve JITing and running code in

the target program.

x -- Read from the memory of the current target process.