在 frida 中调用 Foundation框架的函数

先说使用 OC 函数
简单粗暴丢上来我的工具代码

//打印 NSDictionary
function printNSDictionary(dic) {
    // body...
      var dictionary = new ObjC.Object(dic);
        var allKeys = dictionary.allKeys();
        for (var i = 0; i < allKeys.count(); i++) {
            var key = allKeys.objectAtIndex_(i);
            var value = dictionary.objectForKey_(key);
            console.log(key.toString() + ": " + value.toString());
        }
}


//获取沙盒目录
function getHomeDir(){
    var NSHomeDirectory = new NativeFunction(ptr(Module.findExportByName("Foundation", "NSHomeDirectory")), 'pointer', []);
    var path = new ObjC.Object(NSHomeDirectory());
    console.log('homeDir: ' + path);
    return path;
}

//获取App目录
function getAppDir(){
  var bundle = ObjC.classes.NSBundle;
  var mainBundle = bundle.mainBundle();
        var appDir =  mainBundle.bundlePath();
        console.log('appDir: ' + appDir);
        return appDir;
}

function getLibraryCacheDir() {
    // body...
    var address = Module.findExportByName('Foundation', 'NSSearchPathForDirectoriesInDomains')
    var NSSearchPathForDirectoriesInDomains = new NativeFunction(address, 'pointer', ['int', 'int', 'int'])
    var dirs = ObjC.Object(NSSearchPathForDirectoriesInDomains(13, 1, 1))
    console.log(dirs.objectAtIndex_(0).toString())
    return dirs.objectAtIndex_(0).toString()
}

function fileMove(source,target) {
    // body...

   
     // [[NSFileManager defaultManager] moveItemAtPath:@"" toPath:@"" error:nil]; 等价
    const NSFileManager = ObjC.classes.NSFileManager.defaultManager();

    var m = NSFileManager.moveItemAtPath_toPath_error_(source,target,NULL)//oc函数 直接转化 :转下划线
    // console.log(m)
    if(!m){
        console.log("move success")
    }else{
         console.log("move fail")
    }
    // console.log(b.localizedDescription())
}

function getBundleId() {
    // body...
   var bundleid = ObjC.classes.NSBundle.mainBundle().bundleIdentifier().toString()
   console.log(bundleid)
  return bundleid
}

frida 中如何 hook OC 函数的调用

比如 目标函数是 bugly 框架的函数 +[JCOREUtilities isJailbroken]

    Interceptor.attach(ObjC.classes.JCOREUtilities['+ isJailbroken'].implementation, {
    onEnter: function (args) {
        console.log("is jailbroken")
    }
});

或者找到目标函数的偏移进行 replace

var didDownLoadFinish = new NativeFunction(tfd2 , 'pointer', ['pointer', 'pointer']);

var loaderror = new NativeFunction(tfd6 , 'pointer', ['pointer','pointer', 'pointer']);

var downloadTaskInstance 
 Interceptor.replace(didDownLoadFinish, new NativeCallback(function (a, b,c,d,e) {
           //h不论是什么参数都返回123
        
         // console.log("download success")
       downloadTaskInstance =   ObjC.Object(a)
       console.log(downloadTaskInstance.filePath().toString())
        console.log(downloadTaskInstance.fileName().toString())
        console.log(downloadTaskInstance.speed().toString())
        

        const myNSURL = new ObjC.Object(e);
    // Convert it to a JS string

    const myJSURL = myNSURL.absoluteString().toString();//需要了解 apple framework 这是 [NSURL absoluteString] 

    // console.log(myJSURL)

       }, 'pointer', ['pointer', 'pointer', 'pointer', 'pointer', 'pointer']));

总结

上面的frida 代码能看懂并且能灵活修改成自己的需求，那你的 iOS 逆向就算入门了