折騰了很久的逆向終于邁出了一小步，哈哈！
這里不想寫太多，因?yàn)橐归_講有很多，一時(shí)半會(huì)講不完，如果有不懂，可以看前面的兩篇文章，也可以私信我一起研究學(xué)習(xí)
項(xiàng)目代碼：http://git.oschina.net/lishangkai/reverseproject
砸殼：
localhost:~ shangkai$ ssh root@192.168.1.47
root@192.168.1.47's password:
lishangkaide-iPhone4:~ root# ps -e
注意看粗體(??表示tab)(如果看不到wechat可能是cmd窗口太小沒顯示)
535 ??0:00.03 /System/Library/PrivateFrameworks/CoreSymbolication.framework/coresymbolicationd
672 ??0:00.18 /System/Library/PrivateFrameworks/CommunicationsFilter.framework/CMFSyncAgent.app/CMFSyncAgent
867 ??0:00.23 /System/Library/PrivateFrameworks/CloudServices.framework/Support/EscrowSecurityAlert.app/EscrowS
941 ??0:00.25 /usr/libexec/adid
943 ??0:06.89 com.apple.StreamingUnzipService
1026 ??0:33.04 /System/Library/CoreServices/SpringBoard.app/SpringBoard
398 ??0:13.86 /System/Library/TextInput/kbd1041 ??0:31.91 /var/mobile/Applications/11960679-AB53-4C45-9563-3602C2995700/WeChat.app/WeChat
lishangkaide-iPhone4:~ root# cd /var/mobile/Applications/11960679-AB53-4C45-9563-3602C2995700/Document
-sh: cd: /var/mobile/Applications/11960679-AB53-4C45-9563-3602C2995700/Document: No such file or directory
上面這樣進(jìn)路徑不行(其實(shí)是少了S)，需要用cycript
lishangkaide-iPhone4:~ root# cycript -p WeChat(此命令需要微信在前臺)
cy# NSHomeDirectory()
@"/var/mobile/Applications/11960679-AB53-4C45-9563-3602C2995700"
lishangkaide-iPhone4: ~root# cd /var/mobile/Applications/11960679-AB53-4C45-9563-3602C2995700/Documents/
lishangkaide-iPhone4:~ root# ls
localhost:~ shangkai$ scp /Users/shangkai/Desktop/123/dumpdecrypted.dylib root@192.168.1.47:/var/mobile/Applications/11960679-AB53-4C45-9563-3602C2995700/Documents/dumpdecrypted.dylib
dumpdecrypted.dylib100%81KB13.5KB/s00:06
localhost:~ shangkai$
重點(diǎn)來了，這是生成WeChat文件,也就是---砸殼
lishangkaide-iPhone4:/var/mobile/Applications/11960679-AB53-4C45-9563-3602C2995700/Documents root# su mobile
lishangkaide-iPhone4:~/Applications/11960679-AB53-4C45-9563-3602C2995700/Documents mobile$ DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib "/var/mobile/Applications/11960679-AB53-4C45-9563-3602C2995700/WeChat.app/WeChat"
mach-o decryption dumper
DISCLAIMER: This tool is only meant for security research purposes, not for application crackers.
[+] detected 32bit ARM binary in memory.
[+] offset to cryptid found: @0x3ea4c(from 0x3e000) = a4c
[+] Found encrypted data at address 00004000 of length 52756480 bytes - type 1.
[+] Opening /private/var/mobile/Applications/11960679-AB53-4C45-9563-3602C2995700/WeChat.app/WeChat for reading.
[+] Reading header
[+] Detecting header type
[+] Executable is a FAT image - searching for right architecture
[+] Correct arch is at offset 16384 in the file
[+] Opening WeChat.decrypted for writing.
[+] Copying the not encrypted start of the file
[+] Dumping the decrypted data into the file
[+] Copying the not encrypted remainder of the file
[+] Setting the LC_ENCRYPTION_INFO->cryptid to 0 at offset 4a4c
[+] Closing original file
[+] Closing dump file
lishangkaide-iPhone4:~/Applications/11960679-AB53-4C45-9563-3602C2995700/Documents mobile$
scp root@192.168.1.47:"/var/mobile/Applications/11960679-AB53-4C45-9563-3602C2995700/Documents/WeChat.decrypted" /Users/shangkai/Desktop/123/WeChat
此時(shí)桌面123文件夾多了一個(gè)WeChat的文件，可以關(guān)掉ssh連接了
localhost:bin shangkai$ class-dump --arch armv7 -H /Users/shangkai/Desktop/123/WeChat -o /Users/shangkai/Desktop/123/WeChatHeader
localhost:bin shangkai$
至此，2000+個(gè)微信頭文件出現(xiàn)，砸殼并且class-dump（掏出）頭文件成功！
我們發(fā)現(xiàn)在WCDeviceStepObject這個(gè)類里面有幾個(gè)很顯眼的屬性m7StepCount,hkStepCount 等.? 如下:
在終端運(yùn)行命令創(chuàng)建Tweak工程（需要安裝theos）安裝地址
/opt/theos/bin/nic.pl
創(chuàng)建一個(gè)Tweak工程, 如下:
編寫Tweak.xm和makefile文件。代碼
make package
make install
make并install Tweak工程后在測試機(jī)查看結(jié)果：
附上賤賤的效果圖
安裝代碼：
ps：后來試了一下hook QQ 更改步數(shù)，沒有成功，源碼已上傳，有興趣的可以看一下
