class-dump
可以将Objective-C
编写的二进制文件反编出头文件,需要是已砸壳的二进制文件。
在官网下载最新版本
下载后解压得到文件:
将该文件放置到系统目录下 /usr/local/bin/
打开终端,执行class-dump
,如打印如下信息,说明可使用
wuxiaoxin@Apple ~ % class-dump
class-dump 3.5 (64 bit)
Usage: class-dump [options] <mach-o-file>
where options are:
-a show instance variable offsets
-A show implementation addresses
--arch <arch> choose a specific architecture from a universal binary (ppc, ppc64, i386, x86_64, armv6, armv7, armv7s, arm64)
-C <regex> only display classes matching regular expression
-f <str> find string in method name
-H generate header files in current directory, or directory specified with -o
-I sort classes, categories, and protocols by inheritance (overrides -s)
-o <dir> output directory used for -H
-r recursively expand frameworks and fixed VM shared libraries
-s sort classes and categories by name
-S sort methods by name
-t suppress header in output, for testing
--list-arches list the arches in the file, then exit
--sdk-ios specify iOS SDK version (will look in /Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS<version>.sdk
--sdk-mac specify Mac OS X version (will look in /Developer/SDKs/MacOSX<version>.sdk
--sdk-root specify the full SDK root path (or use --sdk-ios/--sdk-mac for a shortcut)
使用:
将.ipa 包体修改成.zip再解压,进入包体找到Mach-O
可执行文件 xxx,命令:
class-dump -H xxx -o path
xxx 表示待解析的Mach-O文件路径,path 表示导出文件存放的文件夹路径
如果出现这种错误:
class-dump[6911:783784] Error: Cannot find offset for address 0x9000000001000626 in stringAtAddress:
说明包体使用了 swift,可以下载使用这个别人修改过的
class-dump