02-Use of Cycript

Cycript介绍

---

Cycript是Objective-C++、ES6（JavaScript）、Java等语法的混合物,可以用来探索、修改、调试正在运行的Mac\iOS APP,需要通过Cydia安装Cycript,即可在iPhone上来调试运行中的App,可以点击官网来查看,可以点击Cycript文档来查看Cycript的使用方式

注意：AppDebugging is only possible at runtime

Cycript开启和关闭

---

before doing this step,需要先将Mac和iPhone用USB进行连接（在第一节中有介绍）

Cycrip的指令有：

• 开启
  • cycript
  • cycript -p 进程ID（App的进程ID）
  • cycript -p 进程名称（App名称）

• 取消输入：Ctrl + C
• 退出：Ctrl + D
• 清屏：Command + R

那么如何获取AppThe process name or processID呢？
A plugin is required for this（adv-cmds）,需要在,利用ps命令（process status）List all current processes,需要通过Cydia安装

ps指令：

• 列出所有进程：ps -A

iPhone:~ root# ps -A
 PID TTY           TIME CMD
 1 ??         2:48.49 /sbin/launchd -s
 28 ??         0:00.01 checkra1nd
 33 ??         0:49.86 /usr/libexec/substrated
   ...
 4221 ??         0:00.07 /System/Library/Frameworks/CryptoTokenKit.framework/Pl
 4222 ??         0:00.16 /System/Library/Frameworks/LocalAuthentication.framewo
 4227 ??         0:00.19 /Applications/iMessageAppsViewService.app/iMessageApps
 4290 ??         0:00.26 /usr/libexec/ptpd -t usb
 4295 ??         0:00.15 /System/Library/PrivateFrameworks/ContactsDonation.fra
 4296 ??         0:00.23 /System/Library/PrivateFrameworks/SyncedDefaults.frame
 4298 ??         0:00.11 sshd: [email protected] i
 4300 ttys000    0:00.03 -sh
 4303 ttys000    0:00.02 ps -A

• 搜索关键词：ps -A | grep 关键词

iPhone:~ root# ps -A | grep music
 3493 ??         0:12.51 /var/containers/Bundle/Application/992C4ACA-4B99-4FC2-8BEE-11A3BDA1E9D0/neteasemusic.app/neteasemusic
 4308 ttys000    0:00.01 grep music

Cycript常用语法

---

• 查看UIApplication：UIApp

cy# UIApp
#"<NMApplication: 0x109901880>"

• 定义变量：var 变量名 = 变量值

cy# var a = 100
100
cy# a + 10
110

• Get the object with memory：#内存地址

cy# #0x109901880
#"<NMApplication: 0x109901880>"

• 查看对象的所有成员变量：*对象

cy# *UIApp
{
    isa:NMApplication,_responderFlags:@error,_delegate:#"<NMAppDelegate: 0x283e32250>",_remoteControlEventObservers:2 ...}

• print all recursivelyview的子控件：view.recursiveDescription().toString()
• 筛选出某种类型的对象：choose(UIView)

// The first of the child controls above
cy# choose(OTTouchObservingWindow)
[#"<OTTouchObservingWindow: 0x10992e5a0; baseClass = UIWindow; frame = (0 0; 375 812); gestureRecognizers = <NSArray: 0x280322700>; layer = <UIWindowLayer: 0x280cb80c0>>"]

• 当前App已加载的所有OC类：ObjectiveC.classes

封装Cycript - .cy文件编写

---

Found out after getting familiar with the above syntax,Found it a bit cumbersome,Therefore, some commonly used operations can be encapsulated in one.cy文件中

(function(exports) {
    
	// keyWindow
	KeyWindow = function() {
    
		return UIApp.keyWindow;
	};
	// app id
	AppId = [NSBundle mainBundle].bundleIdentifier;
	// mainBundlePath
	AppPath = [NSBundle mainBundle].bundlePath;
	// document path
	DocPath = NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES)[0];
	
})(exports);

然后将.cy文件存放到/usr/lib/cycript0.9目录下,在Cycript中引用.cy文件,and use the interface it provides,如下：

cy# @import Tool
cy# tool.rootVc()
#"<ViewController: 0x13dd41540>"