Cycript基本语法与使用-iOS逆向工程

Cycript基本语法与使用-iOS逆向工程

设备连接方式见上篇：http://blog.youkuaiyun.com/glt_code/article/details/65444592

1.常用数据类型（字符串、数组、字典、Bool， NSNumber）


cy# @"Hello Gao Liutong"
@"Hello Gao Liutong"
cy# @[1, 2, 3]
@[1,2,3]
cy# @{"key":"value"}
@{"key":"value"}
cy# @YES
@true
cy# @(5+7)
@12


2.instanceof 判断是什么类型


cy# @"Hello Gao Liutong" instanceof String
true
cy# @[1, 2, 3] instanceof Array
true
cy# @"Hello Gao Liutong" instanceof Array
false


3.substr字符串截取，slice数组截取（slice(0,2)从0下标长度为2，即下标0和1）


cy# @"Hello Gao Liutong".substr(0, 5)
"Hello"
cy# @[1,2,3,"hello"].slice(0, 2)
[@1,@2]


4.数组与字典的一些操作


cy# var array = [NSMutableArray arrayWithObjects:@"1",@"2", nil]; 
@["1","2"]
cy# array.length
2
cy# array.count
2
cy# array[5] = 6; array;
@["1","2",,,,6]
cy# array.length = 3; array;
@["1","2",,]
cy# array[0]
@"1"
cy# @{@"key":@"55555"}["key"]
@"55555"


5.js转换为oc类型


cy# ?debug
debug == true
cy# @(2+7)
cy= Instance.box((9))
@9
cy# @"test"
cy= Instance.box("test")
@"test"

6.调用方法，实际上是oc中的函数 objc_msgSend(receiver, selector, arg1, arg2, …);


cy# [@"hello world" stringByReplacingOccurrencesOfString:@"hello" withString:@"niho"]
cy= objc_msgSend(Instance.box("hello world"),"stringByReplacingOccurrencesOfString:withString:",Instance.box("hello"),Instance.box("nihao"))
@"nihao world"


7.字典与数组操作


cy# var a = [1, 2, 3]
[1,2,3]
cy# [a objectAtIndex:0]
@1
cy# [a setObject:@"123" atIndex:2]; a
[1,2,@"123"]
cy# var dict = {"key":"value"}
{key:"value"}
cy# [dict setObject:a forKey:"array"]
cy# dict
{key:"value",array:[1,2,@"123"]}


8.初始化一个对象


cy# [[NSObject alloc] init]
#"<NSObject: 0x16f7c590>"
cy# [new NSObject init]
#"<NSObject: 0x182e5cb0>"


9.#+内存地址 代表了一个对象


cy# UIApp
#"<SpringBoard: 0x17af0400>"
cy# #0x17af0400
#"<SpringBoard: 0x17af0400>"


10. 获取window的子view


cy# UIApplication.sharedApplication()
#"<SpringBoard: 0x17af0400>"
cy# UIApplication.sharedApplication().windows[0]
#"<SBSecureWindow: 0x16fb81f0; baseClass = UIWindow; frame = (0 0; 320 568); userInteractionEnabled = NO; gestureRecognizers = <NSArray: 0x16fb8ee0>; layer = <UIWindowLayer: 0x16fb8600>>"
cy# UIApplication.sharedApplication().windows[0].contentView()
#"<UIView: 0x18075620; frame = (0 0; 320 568); clipsToBounds = YES; layer = <CALayer: 0x180757c0>>"
cy# UIApplication.sharedApplication().windows[0].contentView().subviews[0]
cy# UIApplication.sharedApplication().windows[0].contentView().subviews()[0]
#"<SBFStaticWallpaperView: 0x16fcb4b0; frame = (0 0; 320 568); autoresize = W+H; layer = <CALayer: 0x16fcb740>>"



11.打印视图的层次


cy# UIApp.keyWindow.recursiveDescription().toString()


12.获取所有的framworks


cy# function loadFramework(fw)
 { 
       var h="/System/Library/",t="Frameworks/"+fw+".framework";
          [[NSBundle bundleWithPath:h+t]||
         [NSBundle bundleWithPath:h+"Private"+t] load];
            
 }


13.CG...Make函数


cy# function CGPointMake(x, y) { return {x:x, y:y}; }
cy# function CGSizeMake(w, h) { return {width:w, height:h}; }
cy# function CGRectMake(x, y, w, h) { return {origin:CGPointMake(x,y), size:CGSizeake(w, h)}; }


14.获取对象的属性


方法一、

cy# [i for (i in *UIApp)]


方法二、

cy# function tryPrintIvars(a){ var x={}; for(i in *a){ try{ x[i] = (*a)[i]; } catc(e){} } return x; }


15.根据类获取方法


cy# function printMethods(className, isa) { 
        var count = new new Type("I");
            var classObj = (isa != undefined) ? objc_getClass(className)->isa :    
                objc_getClass(className); 
                    var methods = class_copyMethodList(classObj, count); 
                        var methodsArray = [];
                            for(var i = 0; i < *count; i++) { 
                                    var method = methods[i]; 
                                            methodsArray.push({selector:method_getame(method),     
                                                    implementation:method_getImpleentation(method)});
                                                        }
                                                                free(methods); 
                                                                        return metodsArray;


16.获取当前的控制器


cy# function currentVC() {
        var app = [UIApplication sharedApplication]  
            var keyWindow = app.keyWindow  
                var rootController = keyWindow.rootViewController  
                    var visibleController = rootController.visibleViewController  
                        if (!visibleController){
                               return rootController
                                   }
                                       return visibleController.childViewControlles[0]
                                       }



17.choose(类)，可以查看这个类的所有对象


cy# choose(UIView)
[#"<UIStatusBarDataNetworkItemView: 0x15c118e0; frame = (25 0; 13 20); autoresize = RM+BM; userInteractionEnabled = NO; layer = <CALayer: 0x15c11a80>> [Item = <UIStatusBarItem: 0x15c11480> [DataNetwork (Left)]]",#"<UIStatusBarBatteryItemView: 0x15c120c0; frame = (282 0; 33 20); autoresize = LM+BM; userInteractionEnabled = NO; layer = <CALayer: 0x15c110c0>> [Item = <UIStatusBarItem: 0x14762a10> [Battery (Right)]]",#"<UIImageView: 0x15c121e0; frame = (27.5 0; 5.5 20); opaque = NO; autoresize = LM+TM+BM; userInteractionEnabled = NO; layer = <CALayer: 0x15ac6b30>>",#"<UIStatusBarBatteryPercentItemView: 0x15c123f0; frame = (248 0; 31 20); autoresize = LM+BM; userInteractionEnabled = NO; layer = <CALayer: 0x147bb8a0>> [Item = <UIStatusBarItem: 0x15ae59f0> [BatteryPercent (Right)]]",#"<UIStatusBarTimeItemView: 0x15c124b0; frame = (144 0; 32 20); autoresize = LM+RM+BM; userInteractionEnabled = NO; layer = <CALayer: 0x14683410>> [Item = <UIStatusBarItem: 0x159f21c0> [Time (Center)]]",#"<UISegment: 0x15c14d40; frame = (0 0; 155 29); opaque = NO; layer = <CALayer: 0x15c14f80>>",#"<UISegmentLabel: 0x15c15150; frame = (64.5 6.5; 26 16); text = '\xe4\xbb\x8a\xe5\xa4\xa9'; opaque = NO; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x15c153a0>>",#"<UISegment: 0x15c15a10; frame = (156 0; 156 29); opaque = NO; layer = <CALayer: 0x15c16cc0>>",#"<UIImageView: 0x15c15bc0; frame = (156 0; 1 29); alpha = 0; opaque = NO; autoresize = LM; userInteractionEnabled = NO; tag = -1030; layer = <CALayer: 0x15c16050>>",#"<UILabel: 0x15c15cb0; frame = (48 20.5; 272 40); text = '3\xe6\x9c\x8824\xe6\x97\xa5 \xe6\x98\x9f\xe6\x9c\x9f\xe4\xba\x94'; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x15c17e70>>",#"<UIImageView: 0x15c160b0; frame = (155 0; 1 29); opaque = NO; autoresize = LM; userInteractionEnabled = NO; tag = -1030; layer = <CALayer: 0x15c16160>>",#"<UISegment: 0x15c16320; frame = (156 0; 156 29); opaque = NO; layer = <CALayer: 0x15c162d0>>",#"<UISegment: 0x15c164f0; frame = (0 0; 155 29); opaque = NO; layer = <CALayer: 0x1


18.分类


cy# @implementation NSObject (TestCategory)
    -description {return "test"}
    -(double)calculate:(float)num {return num * 10;}
    @end
cy# test = [new NSObject init]
#"test"
cy# [test calculate:10]
100


19.类与方法的调用注意用的是@implementation


cy# @implementation MyClass : NSObject 
    {
        int num;
    }
    -(int)returnNum {return this -> num;}
    @end
MyClass
cy# var aNum = [new MyClass init]
#"<MyClass: 0x159279e0>"
cy# aNum->num = 10;
10
cy# [aNum returnNum]
10


20.Block用法


cy# testBlock = ^ int (int value) {return value * 10}
^int(int){}
cy# testBlock(10)
100

参考地址： http://www.cycript.org/manual/