MacOS 系统上给砸壳的ipa注入插件

安装brew

/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

安装dpkg

brew install dpkg

安装yololib

curl -Lk "https://github.com/teaold/yololib/raw/master/yololib" -o /usr/local/bin/yololib
chmod +x /usr/local/bin/yololib

解压deb文件获取dylib

[lookback@DT_LookBack_MacBookPro ~/Desktop/WetChat/deb]$ tree
.
├── cn.yttxcs.voice_1.4.6_iphoneos-arm.deb
├── cn.yttxcs.wechat.fzye_1.1.5_iphoneos-arm.deb
├── cn.yttxcs.wechatmsgtime_1.0_iphoneos-arm.deb
├── com.25mao.doutu_3.0-5_iphoneos-arm.deb
├── com.25mao.gamelogin_0.1-3_iphoneos-arm.deb
├── com.25mao.miyou_3.2-4_iphoneos-arm.deb
├── com.25mao.msgfilt_1.0-2_iphoneos-arm.deb
└── netskao.wechatpurification_2.1-7.6_iphoneos-arm.deb

0 directories, 8 files
[lookback@DT_LookBack_MacBookPro ~/Desktop/WetChat/deb]$ dpkg -X cn.yttxcs.voice_1.4.6_iphoneos-arm.deb cn.yttxcs.voice_1.4.6_iphoneos-arm
./
./Library/
./Library/MobileSubstrate/
./Library/MobileSubstrate/DynamicLibraries/
./Library/MobileSubstrate/DynamicLibraries/Voice.dylib
./Library/MobileSubstrate/DynamicLibraries/Voice.plist
[lookback@DT_LookBack_MacBookPro ~/Desktop/WetChat/deb]$ dpkg -X cn.yttxcs.wechat.fzye_1.1.5_iphoneos-arm.deb cn.yttxcs.wechat.fzye_1.1.5_iphoneos-arm
./
./Library/
./Library/MobileSubstrate/
./Library/MobileSubstrate/DynamicLibraries/
./Library/MobileSubstrate/DynamicLibraries/wechat.dylib
./Library/MobileSubstrate/DynamicLibraries/wechat.plist
[lookback@DT_LookBack_MacBookPro ~/Desktop/WetChat/deb]$ dpkg -X cn.yttxcs.wechatmsgtime_1.0_iphoneos-arm.deb cn.yttxcs.wechatmsgtime_1.0_iphoneos-arm
./
./Library/
./Library/MobileSubstrate/
./Library/MobileSubstrate/DynamicLibraries/
./Library/MobileSubstrate/DynamicLibraries/WeChatMsgTime.dylib
./Library/MobileSubstrate/DynamicLibraries/WeChatMsgTime.plist
[lookback@DT_LookBack_MacBookPro ~/Desktop/WetChat/deb]$ dpkg -X com.25mao.doutu_3.0-5_iphoneos-arm.deb com.25mao.doutu_3.0-5_iphoneos-arm
Library/
Library/MobileSubstrate/
Library/PreferenceLoader/
Library/PreferenceLoader/Preferences/
Library/PreferenceLoader/Preferences/dt_icon.png
Library/PreferenceLoader/Preferences/dt_icon_dark.png
Library/MobileSubstrate/DynamicLibraries/
Library/MobileSubstrate/DynamicLibraries/DouTu.plist
Library/MobileSubstrate/DynamicLibraries/DouTu.dylib
[lookback@DT_LookBack_MacBookPro ~/Desktop/WetChat/deb]$ dpkg -X com.25mao.gamelogin_0.1-3_iphoneos-arm.deb com.25mao.gamelogin_0.1-3_iphoneos-arm
Library/
Library/MobileSubstrate/
Library/MobileSubstrate/DynamicLibraries/
Library/MobileSubstrate/DynamicLibraries/GameLogin.plist
Library/MobileSubstrate/DynamicLibraries/GameLogin.dylib
[lookback@DT_LookBack_MacBookPro ~/Desktop/WetChat/deb]$ dpkg -X com.25mao.miyou_3.2-4_iphoneos-arm.deb com.25mao.miyou_3.2-4_iphoneos-arm
Library/
Library/MobileSubstrate/
Library/PreferenceLoader/
Library/PreferenceLoader/Preferences/
Library/PreferenceLoader/Preferences/friend_icon.png
Library/MobileSubstrate/DynamicLibraries/
Library/MobileSubstrate/DynamicLibraries/MiYou.plist
Library/MobileSubstrate/DynamicLibraries/MiYou.dylib
[lookback@DT_LookBack_MacBookPro ~/Desktop/WetChat/deb]$ dpkg -X com.25mao.msgfilt_1.0-2_iphoneos-arm.deb com.25mao.msgfilt_1.0-2_iphoneos-arm
Library/
Library/MobileSubstrate/
Library/MobileSubstrate/DynamicLibraries/
Library/MobileSubstrate/DynamicLibraries/MsgFilt.plist
Library/MobileSubstrate/DynamicLibraries/MsgFilt.dylib
[lookback@DT_LookBack_MacBookPro ~/Desktop/WetChat/deb]$ dpkg -X netskao.wechatpurification_2.1-7.6_iphoneos-arm.deb netskao.wechatpurification_2.1-7.6_iphoneos-arm
./
./Library/
./Library/MobileSubstrate/
./Library/MobileSubstrate/DynamicLibraries/
./Library/MobileSubstrate/DynamicLibraries/WeChatPure.dylib
./Library/MobileSubstrate/DynamicLibraries/WeChatPure.plist
[lookback@DT_LookBack_MacBookPro ~/Desktop/WetChat/deb]$ tree
.
├── cn.yttxcs.voice_1.4.6_iphoneos-arm
│   └── Library
│       └── MobileSubstrate
│           └── DynamicLibraries
│               ├── Voice.dylib
│               └── Voice.plist
├── cn.yttxcs.voice_1.4.6_iphoneos-arm.deb
├── cn.yttxcs.wechat.fzye_1.1.5_iphoneos-arm
│   └── Library
│       └── MobileSubstrate
│           └── DynamicLibraries
│               ├── wechat.dylib
│               └── wechat.plist
├── cn.yttxcs.wechat.fzye_1.1.5_iphoneos-arm.deb
├── cn.yttxcs.wechatmsgtime_1.0_iphoneos-arm
│   └── Library
│       └── MobileSubstrate
│           └── DynamicLibraries
│               ├── WeChatMsgTime.dylib
│               └── WeChatMsgTime.plist
├── cn.yttxcs.wechatmsgtime_1.0_iphoneos-arm.deb
├── com.25mao.doutu_3.0-5_iphoneos-arm
│   └── Library
│       ├── MobileSubstrate
│       │   └── DynamicLibraries
│       │       ├── DouTu.dylib
│       │       └── DouTu.plist
│       └── PreferenceLoader
│           └── Preferences
│               ├── dt_icon.png
│               └── dt_icon_dark.png
├── com.25mao.doutu_3.0-5_iphoneos-arm.deb
├── com.25mao.gamelogin_0.1-3_iphoneos-arm
│   └── Library
│       └── MobileSubstrate
│           └── DynamicLibraries
│               ├── GameLogin.dylib
│               └── GameLogin.plist
├── com.25mao.gamelogin_0.1-3_iphoneos-arm.deb
├── com.25mao.miyou_3.2-4_iphoneos-arm
│   └── Library
│       ├── MobileSubstrate
│       │   └── DynamicLibraries
│       │       ├── MiYou.dylib
│       │       └── MiYou.plist
│       └── PreferenceLoader
│           └── Preferences
│               └── friend_icon.png
├── com.25mao.miyou_3.2-4_iphoneos-arm.deb
├── com.25mao.msgfilt_1.0-2_iphoneos-arm
│   └── Library
│       └── MobileSubstrate
│           └── DynamicLibraries
│               ├── MsgFilt.dylib
│               └── MsgFilt.plist
├── com.25mao.msgfilt_1.0-2_iphoneos-arm.deb
├── netskao.wechatpurification_2.1-7.6_iphoneos-arm
│   └── Library
│       └── MobileSubstrate
│           └── DynamicLibraries
│               ├── WeChatPure.dylib
│               └── WeChatPure.plist
└── netskao.wechatpurification_2.1-7.6_iphoneos-arm.deb

36 directories, 27 files
[lookback@DT_LookBack_MacBookPro ~/Desktop/WetChat/deb]$ 

找一个脱了壳的IPA包，我这里直接使用砸壳的微信测试

mv 微信_8.0.18砸壳原包.ipa  微信_8.0.18砸壳原包.zip #修改砸壳后的微信包为zip后缀
unzip 微信_8.0.18砸壳原包.zip #解压微信包
cd Payload/WeChat.app/

开始注入

[lookback@DT_LookBack_MacBookPro ~/Desktop/WetChat/Payload/WeChat.app]$ yololib . ../../deb/cn.yttxcs.voice_1.4.6_iphoneos-arm/Library/MobileSubstrate/DynamicLibraries/Voice.dylib 
2022-03-18 15:54:52.215 yololib[57407:18981966] dylib path @executable_path/../../deb/cn.yttxcs.voice_1.4.6_iphoneos-arm/Library/MobileSubstrate/DynamicLibraries/Voice.dylib
2022-03-18 15:54:52.217 yololib[57407:18981966] dylib path @executable_path/../../deb/cn.yttxcs.voice_1.4.6_iphoneos-arm/Library/MobileSubstrate/DynamicLibraries/Voice.dylib
Reading binary: .

Segmentation fault: 11 (核心已转储)
[lookback@DT_LookBack_MacBookPro ~/Desktop/WetChat/Payload/WeChat.app]$ yololib . ../../deb/cn.yttxcs.wechat.fzye_1.1.5_iphoneos-arm/Library/MobileSubstrate/DynamicLibraries/wechat.dylib 
2022-03-18 16:08:34.495 yololib[62895:19042864] dylib path @executable_path/../../deb/cn.yttxcs.wechat.fzye_1.1.5_iphoneos-arm/Library/MobileSubstrate/DynamicLibraries/wechat.dylib
2022-03-18 16:08:34.496 yololib[62895:19042864] dylib path @executable_path/../../deb/cn.yttxcs.wechat.fzye_1.1.5_iphoneos-arm/Library/MobileSubstrate/DynamicLibraries/wechat.dylib
Reading binary: .

Segmentation fault: 11 (核心已转储)
[lookback@DT_LookBack_MacBookPro ~/Desktop/WetChat/Payload/WeChat.app]$ yololib . ../../deb/cn.yttxcs.wechatmsgtime_1.0_iphoneos-arm/Library/MobileSubstrate/DynamicLibraries/WeChatMsgTime.dylib 
2022-03-18 16:09:08.759 yololib[63134:19045362] dylib path @executable_path/../../deb/cn.yttxcs.wechatmsgtime_1.0_iphoneos-arm/Library/MobileSubstrate/DynamicLibraries/WeChatMsgTime.dylib
2022-03-18 16:09:08.760 yololib[63134:19045362] dylib path @executable_path/../../deb/cn.yttxcs.wechatmsgtime_1.0_iphoneos-arm/Library/MobileSubstrate/DynamicLibraries/WeChatMsgTime.dylib
Reading binary: .

Segmentation fault: 11 (核心已转储)
[lookback@DT_LookBack_MacBookPro ~/Desktop/WetChat/Payload/WeChat.app]$ 

压缩文件ipa文件

zip -qrmn -o 微信_8.0.18.ipa Payload