您的位置：首页 > 产品设计 > UI/UE

【砸壳STEP2】使用cycript查看并修改微信UI界面

2017-09-28 15:03 465 查看

z继续上次的讲，我们显示如下

cy# [alertView show]

我们使用

control + d

来退出当前进程。

言归正传。

我们首先关闭全部后台程序，然后打开微信的app。

为了防止数据看起来混乱、你不清理也是可以的老铁。

【1】找到微信

在终端输入

ps -e

可以看到当前所有的进程。

wiki:~ root# ps -e
PID TTY           TIME CMD
1 ??         0:22.42 /sbin/launchd
26 ??         1:26.53 /usr/libexec/UserEventAgent (System)
27 ??         0:07.99 /usr/sbin/syslogd
28 ??         0:18.55 /usr/sbin/wifid
34 ??         0:04.56 /System/Library/CoreServices/powerd.bundle/powerd
42 ??         0:07.36 /usr/libexec/lockdownd
50 ??         0:02.88 /usr/sbin/mediaserverd
52 ??         0:03.64 /usr/sbin/mDNSResponder -launchd
54 ??         0:25.11 /usr/libexec/locationd
56 ??         0:01.22 /System/Library/PrivateFrameworks/IMCore.framework/ima
57 ??         0:03.16 /System/Library/PrivateFrameworks/IAP.framework/Suppor
59 ??         0:06.36 /usr/libexec/fseventsd
60 ??         0:02.62 /usr/sbin/fairplayd.N94
63 ??         0:13.13 /usr/libexec/configd
70 ??         0:00.51 /Applications/kbd.app/kbd
72 ??         0:00.35 /usr/libexec/misd -d
75 ??         0:13.28 /System/Library/Frameworks/CoreTelephony.framework/Sup
76 ??         0:01.04 /usr/sbin/BTServer
77 ??         0:03.32 /usr/libexec/sogou/imed
113 ??         0:14.66 /usr/sbin/notifyd
134 ??         0:04.20 /usr/libexec/networkd
138 ??         0:02.89 /System/Library/PrivateFrameworks/AggregateDictionary.
151 ??         0:05.32 /System/Library/PrivateFrameworks/ApplePushService.fra
153 ??         0:00.05 /usr/sbin/distnoted daemon
157 ??         0:01.96 /System/Library/Frameworks/SystemConfiguration.framewo
295 ??         0:00.32 /System/Library/PrivateFrameworks/TCC.framework/tccd
348 ??         0:00.08 /usr/sbin/filecoordinationd
2061 ??         0:02.98 /System/Library/CoreServices/AppleIDAuthAgent
2069 ??         0:00.14 /usr/libexec/networkd_privileged
2092 ??         0:05.49 /System/Library/PrivateFrameworks/iTunesStore.framewor
2094 ??         0:00.83 /usr/libexec/installd --idleExit
2096 ??         0:01.82 /usr/libexec/lsd
2228 ??         0:00.05 /usr/libexec/xpcd
2244 ??         0:00.66 /usr/libexec/timed
3018 ??        12:52.48 /usr/libexec/backboardd
3022 ??        15:27.81 /System/Library/CoreServices/SpringBoard.app/SpringBoa
3041 ??         0:01.51 /Applications/MobilePhone.app/MobilePhone
3042 ??         0:01.50 /Applications/MobileMail.app/MobileMail
3044 ??         0:00.19 /System/Library/Frameworks/Accounts.framework/accounts
3055 ??         0:04.68 /System/Library/Frameworks/AssetsLibrary.framework/Sup
3413 ??         0:00.12 /usr/libexec/notification_proxy
3437 ??         0:00.10 /usr/libexec/afcd --xpc -d /private/var/mobile/Media
4246 ??         0:02.57 /usr/libexec/ptpd -t usb
4558 ??         0:00.40 sshd: root@ttys001
6373 ??         0:00.07 /usr/libexec/afcd --lockdown -d /
6457 ??         0:00.17 /System/Library/PrivateFrameworks/Ubiquity.framework/V
4561 ttys001    0:00.06 -sh
6459 ttys001    0:00.01 ps -e
wiki:~ root# ps -e
PID TTY           TIME CMD
1 ??         0:22.55 /sbin/launchd
26 ??         1:26.94 /usr/libexec/UserEventAgent (System)
27 ??         0:08.03 /usr/sbin/syslogd
28 ??         0:18.66 /usr/sbin/wifid
34 ??         0:04.58 /System/Library/CoreServices/powerd.bundle/powerd
42 ??         0:07.36 /usr/libexec/lockdownd
50 ??         0:02.91 /usr/sbin/mediaserverd
52 ??         0:03.65 /usr/sbin/mDNSResponder -launchd
54 ??         0:25.18 /usr/libexec/locationd
56 ??         0:01.22 /System/Library/PrivateFrameworks/IMCore.framework/ima
57 ??         0:03.18 /System/Library/PrivateFrameworks/IAP.framework/Suppor
59 ??         0:06.40 /usr/libexec/fseventsd
60 ??         0:02.63 /usr/sbin/fairplayd.N94
63 ??         0:13.18 /usr/libexec/configd
70 ??         0:00.51 /Applications/kbd.app/kbd
72 ??         0:00.35 /usr/libexec/misd -d
75 ??         0:13.31 /System/Library/Frameworks/CoreTelephony.framework/Sup
76 ??         0:01.05 /usr/sbin/BTServer
77 ??         0:03.33 /usr/libexec/sogou/imed
113 ??         0:14.74 /usr/sbin/notifyd
134 ??         0:04.21 /usr/libexec/networkd
138 ??         0:02.90 /System/Library/PrivateFrameworks/AggregateDictionary.
151 ??         0:05.32 /System/Library/PrivateFrameworks/ApplePushService.fra
153 ??         0:00.05 /usr/sbin/distnoted daemon
157 ??         0:01.96 /System/Library/Frameworks/SystemConfiguration.framewo
295 ??         0:00.32 /System/Library/PrivateFrameworks/TCC.framework/tccd
348 ??         0:00.08 /usr/sbin/filecoordinationd
2061 ??         0:03.00 /System/Library/CoreServices/AppleIDAuthAgent
2069 ??         0:00.14 /usr/libexec/networkd_privileged
2092 ??         0:05.52 /System/Library/PrivateFrameworks/iTunesStore.framewor
2094 ??         0:00.85 /usr/libexec/installd --idleExit
2096 ??         0:01.82 /usr/libexec/lsd
2228 ??         0:00.05 /usr/libexec/xpcd
2244 ??         0:00.66 /usr/libexec/timed
3018 ??        12:54.49 /usr/libexec/backboardd
3022 ??        15:35.95 /System/Library/CoreServices/SpringBoard.app/SpringBoa
3041 ??         0:01.51 /Applications/MobilePhone.app/MobilePhone
3042 ??         0:01.50 /Applications/MobileMail.app/MobileMail
3044 ??         0:00.19 /System/Library/Frameworks/Accounts.framework/accounts
3055 ??         0:04.69 /System/Library/Frameworks/AssetsLibrary.framework/Sup
3413 ??         0:00.12 /usr/libexec/notification_proxy
3437 ??         0:00.10 /usr/libexec/afcd --xpc -d /private/var/mobile/Media
4246 ??         0:02.59 /usr/libexec/ptpd -t usb
4558 ??         0:00.41 sshd: root@ttys001
6373 ??         0:00.07 /usr/libexec/afcd --lockdown -d /
6492 ??         0:03.30 /var/mobile/Applications/89D9C604-7992-4144-9B7F-03603
6493 ??         0:00.06 /usr/libexec/securityd
6496 ??         0:00.08 /System/Library/Frameworks/UIKit.framework/Support/pas
6498 ??         0:00.17 /System/Library/PrivateFrameworks/Ubiquity.framework/V
4561 ttys001    0:00.06 -sh
6500 ttys001    0:00.01 ps -e

从这可以看到，我们的手机只要运行。就会有很多的进程在跑。

我们可以看到微信的app在这运动，

6492 ??         0:03.30 /var/mobile/Applications/89D9C604-7992-4144-9B7F-03603

【2】进入App查看view

我们使用进入此app

wiki:~ root# cycript -p 6492

然后请开始你的表演

cy# UIApp
#"<UIApplication: 0x1c5dbb80>"

cy# #0x1c5dbb80.keyWindow
#"<iConsoleWindow: 0x1c5f3320; baseClass = UIWindow; frame = (0 0; 320 480); layer = <UIWindowLayer: 0x1c5f3500>>"

cy# #0x1c5f3320.rootViewController
#"<MMUINavigationController: 0x1d1eca10>"

cy# #0x1d1eca10.view
#"<UILayoutContainerView: 0x1d1ece90; frame = (0 0; 320 480); autoresize = W+H; layer = <CALayer: 0x1d1ecf50>>"

cy# #0x1d1eca10.visibleViewController
#"<WCAccountLoginLastUserViewController: 0x1d1ec390>"

cy# #0x1d1ec390.view
#"<UIView: 0x1d0da930; frame = (0 0; 320 460); autoresize = W+H; layer = <CALayer: 0x1d0da8c0>>"

cy# view = #0x1d0da930
#"<UIView: 0x1d0da930; frame = (0 0; 320 460); autoresize = W+H; layer = <CALayer: 0x1d0da8c0>>"

cy# *view
{isa:UIView,_layer:#"<CALayer: 0x1d0da8c0>",_tapInfo:null,_gestureInfo:null,_gestureRecognizers:null,_subviewCache:@[#"<MMTableView: 0x1cadd200; baseClass = UITableView; frame = (0 0; 320 460); clipsToBounds = YES; autoresize = W+H; gestureRecognizers = <NSArray: 0x1d0db020>; layer = <CALayer: 0x1d0daba0>; contentOffset: {-0, -44}>",#"<UIButton: 0x1d1129e0; frame = (134.5 409; 51 41); opaque = NO; autoresize = LM+RM+TM; tag = 2222; layer = <CALayer: 0x1d1129b0>>"],_charge:0,_tag:0,_viewDelegate:#"<WCAccountLoginLastUserViewController: 0x1d1ec390>",_backgroundColorSystemColorName:null,_viewFlags:@error,_retainCount:6,_boundsWidthVariable:null,_boundsHeightVariable:null,_minXVariable:null,_minYVariable:null,_internalConstraints:null,_constraintsExceptingSubviewAutoresizingConstraints:null,_dependentConstraints:null,_shouldArchiveUIAppearanceTags:0}
cy#

我们可以看到

_subviewCache

里面的内容，就是此页面的图层结构。

我们可以看到微信的登陆界面用的是UITabelView。。。。

【3】修改UI界面

我们把TableView和UIButton拿出来。

cy# #0x1cadd200
#"<MMTableView: 0x1cadd200; baseClass = UITableView; frame = (0 0; 320 460); clipsToBounds = YES; autoresize = W+H; gestureRecognizers = <NSArray: 0x1d0db020>; layer = <CALayer: 0x1d0daba0>; contentOffset: {-0, -44}>"

cy# #0x1d1129e0
#"<UIButton: 0x1d1129e0; frame = (134.5 409; 51 41); opaque = NO; autoresize = LM+RM+TM; tag = 2222; layer = <CALayer: 0x1d1129b0>>"

修改TableView的背景颜色

cy# tb = #0x1cadd200
#"<MMTableView: 0x1cadd200; baseClass = UITableView; frame = (0 0; 320 460); clipsToBounds = YES; autoresize = W+H; gestureRecognizers = <NSArray: 0x1d0db020>; layer = <CALayer: 0x1d0daba0>; contentOffset: {-0, -44}>"

cy# tb.backgroundColor = [UIColor blueColor]
#"UIDeviceRGBColorSpace 0 0 1 1"

不得不说，蓝色好丑。我们还是改回去吧。

cy# tb.backgroundColor = [UIColor whiteColor]
#"UIDeviceWhiteColorSpace 1 1"

隐藏这个Button和更改title

cy# btn = #0x1d1129e0
#"<UIButton: 0x1d1129e0; frame = (134.5 409; 51 41); opaque = NO; autoresize = LM+RM+TM; tag = 2222; layer = <CALayer: 0x1d1129b0>>"
cy# btn.frame
{0:{0:134.5,1:409},1:{0:51,1:41}}
cy# [btn frame]
{0:{0:134.5,1:409},1:{0:51,1:41}}
cy# btn.hidden = YES
true

我们会发现，微信登陆界面 “更多”按钮消失了。

所以这个

button

就是更多按钮！

如果输入

btn.frame

，有错误提示，这个一个C语言的结构体的话，那么就用

[btn frame]

cy# btn.titleLabel.text = "hahahhahaahaha"
"hahahhahaahaha"

我们发现这个更多按钮变成了

h...

咳咳，原来老版本的微信这块的

frame

是写死的噢，嘎嘎~~

查看UI的层级结构，一目了然

cy# UIApp.keyWindow.recursiveDescription()
throw new TypeError(`'<iConsoleWindow: 0x1c5f3320; baseClass = UIWindow; frame = (0 0; 320 480); layer = <UIWindowLayer: 0x1c5f3500>>
| <UILayoutContainerView: 0x1d1ece90; frame = (0 0; 320 480); autoresize = W+H; layer = <CALayer: 0x1d1ecf50>>
|    | <UINavigationTransitionView: 0x1d0d97f0; frame = (0 0; 320 480); clipsToBounds = YES; autoresize = W+H; layer = <CALayer: 0x1d0d98c0>>
|    |    | <UIViewControllerWrapperView: 0x1d111d50; frame = (0 20; 320 460); autoresize = W+H; layer = <CALayer: 0x1d111cd0>>
|    |    |    | <UIView: 0x1d0da930; frame = (0 0; 320 460); autoresize = W+H; layer = <CALayer: 0x1d0da8c0>>
|    |    |    |    | <MMTableView: 0x1cadd200; baseClass = UITableView; frame = (0 0; 320 460); clipsToBounds = YES; autoresize = W+H; gestureRecognizers = <NSArray: 0x1d0db020>; layer = <CALayer: 0x1d0daba0>; contentOffset: {-0, -44}>
|    |    |    |    |    | <UIView: 0x1d112190; frame = (0 0; 320 348); layer = <CALayer: 0x1d112160>>
|    |    |    |    |    |    | <UIView: 0x1d11ac70; frame = (0 0; 320 348); autoresize = LM+RM; layer = <CALayer: 0x1d11acd0>>
|    |    |    |    |    |    |    | <UIImageView: 0x1d22b5d0; frame = (120 44; 80 80); clipsToBounds = YES; opaque = NO; autoresize = LM+RM; userInteractionEnabled = NO; layer = <CALayer: 0x1d22b630>>
|    |    |    |    |    |    |    | <MMUILabel: 0x1d22c0e0; baseClass = UILabel; frame = (118 139; 84 20); text = '1548388802'; clipsToBounds = YES; autoresize = LM+RM; userInteractionEnabled = NO; layer = <CALayer: 0x1d22c010>>
|    |    |    |    |    |    |    | <UIView: 0x1d119390; frame = (0 189; 320 44); layer = <CALayer: 0x1d1193f0>>
|    |    |    |    |    |    |    |    | <WCUITextField: 0x1d118e80; baseClass = UITextField; frame = (15 0; 295 44); clipsToBounds = YES; opaque = NO; gestureRecognizers = <NSArray: 0x1d117810>; layer = <CALayer: 0x1d118e00>>
|    |    |    |    |    |    |    |    |    | <MMUILabel: 0x1d232ba0; baseClass = UILabel; frame = (0 0; 93 44); text = '\u5bc6\u7801'; clips
cy#

内容来自用户分享和网络整理，不保证内容的准确性，如有侵权内容，可联系管理员处理

标签： 微信 cycript root

相关文章推荐

新的分享

章节导航