一、Tweak原理分析

1、获取APPID，com.tencent.xin

两种方式
1、Framework注入、修改了MachO
2、DYLD_INSERT_LIBRARIES环境变量插入，MachO没有改变

二、DYLD源码分析找到防护突破口

三、修改RESTRICT段防护Tweak

1、创建一个普通的工程

Snip20191223_24.png

四、参考dyld源码防护

1、dyld源码

#import "ViewController.h"
#import <mach-o/loader.h>
#import <mach-o/dyld.h>

#if __LP64__
    #define LC_SEGMENT_COMMAND        LC_SEGMENT_64
    #define LC_SEGMENT_COMMAND_WRONG LC_SEGMENT
    #define LC_ENCRYPT_COMMAND        LC_ENCRYPTION_INFO
    #define macho_segment_command    segment_command_64
    #define macho_section            section_64
    #define macho_header             mach_header_64
#else
    #define LC_SEGMENT_COMMAND        LC_SEGMENT
    #define LC_SEGMENT_COMMAND_WRONG LC_SEGMENT_64
    #define LC_ENCRYPT_COMMAND        LC_ENCRYPTION_INFO_64
    #define macho_segment_command    segment_command
    #define macho_section            section
    #define macho_header             mach_header
#endif

@interface ViewController ()

@end

@implementation ViewController

+ (void)load {
    //根据imagelist可以看出，imagelist 里面第0个是我们自己的可执行文件
    const struct mach_header * header = _dyld_get_image_header(0);
    if (hasRestrictedSegment(header)) {
        NSLog(@"没毛病");
    } else {
        NSLog(@"请删除插件！！！");
    }
    
}

- (void)viewDidLoad {
    [super viewDidLoad];
    // Do any additional setup after loading the view.
}

- (void)touchesBegan:(NSSet<UITouch *> *)touches withEvent:(UIEvent *)event {
    UIAlertController *ac = [UIAlertController alertControllerWithTitle:@"提示" message:@"点击了屏幕" preferredStyle:UIAlertControllerStyleAlert];
    UIAlertAction *action = [UIAlertAction actionWithTitle:@"取消" style:UIAlertActionStyleCancel handler:nil];
    [ac addAction:action];
    [self presentViewController:ac animated:true completion:nil];
    NSLog(@"点击了屏幕");
    
}

static bool hasRestrictedSegment(const struct macho_header* mh)
{
    const uint32_t cmd_count = mh->ncmds;
    const struct load_command* const cmds = (struct load_command*)(((char*)mh)+sizeof(struct macho_header));
    const struct load_command* cmd = cmds;
    for (uint32_t i = 0; i < cmd_count; ++i) {
        switch (cmd->cmd) {
            case LC_SEGMENT_COMMAND:
            {
                const struct macho_segment_command* seg = (struct macho_segment_command*)cmd;
                
                //dyld::log("seg name: %s\n", seg->segname);
                if (strcmp(seg->segname, "__RESTRICT") == 0) {
                    const struct macho_section* const sectionsStart = (struct macho_section*)((char*)seg + sizeof(struct macho_segment_command));
                    const struct macho_section* const sectionsEnd = &sectionsStart[seg->nsects];
                    for (const struct macho_section* sect=sectionsStart; sect < sectionsEnd; ++sect) {
                        if (strcmp(sect->sectname, "__restrict") == 0)
                            return true;
                    }
                }
            }
            break;
        }
        cmd = (const struct load_command*)(((char*)cmd)+cmd->cmdsize);
    }
        
    return false;
}


@end

3、修改二进制，用MachOView修改，方法如上。

4、重签名。使用MonkeyApp重签名。方法如上。打印请删除插件！！！，说明又防住了，✌️。