iOS ASO【Inter process Communication】之去掉rocketbootstrap的Depends依赖

公众号iOS逆向

发布于 2021-03-24 16:00:21

7160

发布于 2021-03-24 16:00:21

文章被收录于专栏：iOS逆向与安全iOS逆向与安全

点击上方蓝字关注我们

引言

接下来的几篇文章都是关于进程通信的，今天先来篇预热

本文的目的，是想在自己的deb 自带rocketbootstrapd，避免每次部署都从bigBoss 源更新。

deb包的执行脚本

debian/preinst 安装前执行脚本
debian/postinst 安装后执行脚本
debian/prerm 卸载前执行脚本
debian/postrm 卸载后执行脚本

———————————————— 版权声明：本文为CSDN博主「#公众号：iOS逆向」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。原文链接：https://blog.csdn.net/z929118967/article/details/114693546

I、去掉对rocketbootstrap的Depends依赖

1.1 研究 rocketbootstrap的deb包的脚本 postinst、prerm

https://github.com/rpetrich/RocketBootstrap/blob/54cdad74cc532ceeb4e7239d201c218bb7dfe346/layout/DEBIAN/postinst

#!/bin/sh
if [ "$1" = "upgrade" ] || [ "$1" = "install" ];then
  # 需要执行的脚本
fi

安装rocketbootstrapd后执行脚本

#!/bin/sh
launchctl load /Library/LaunchDaemons/com.rpetrich.rocketbootstrapd.plist || true
launchctl stop com.apple.ReportCrash.SimulateCrash || true
mv /System/Library/LaunchDaemons{BAK,}/com.apple.ReportCrash.SimulateCrash.plist 2> /dev/null || true
launchctl load /System/Library/LaunchDaemons/com.apple.ReportCrash.SimulateCrash.plist 2> /dev/null || true

卸载rocketbootstrapd的时候执行的脚本：停止 RocketBootstrap

launchctl unload /Library/LaunchDaemons/com.rpetrich.rocketbootstrapd.plist || true
launchctl stop com.apple.ReportCrash.SimulateCrash || true

1.2 方案

将以下内容mv copy 一份到自己的deb 包对应的位置

RocketBootstrap/layout/DEBIAN/prerm RocketBootstrap/layout/Library/LaunchDaemons/ /Library/LaunchDaemons/ /layout/DEBIAN/prerm

整体操作的文件清单

 knPackage/Library/LaunchDaemons/com.rpetrich.rocketbootstrapd.plist
 knPackage/Library/MobileSubstrate/DynamicLibraries/RocketBootstrap.dylib
 knPackage/Library/MobileSubstrate/DynamicLibraries/RocketBootstrap.plist
 knPackage/usr/bin/reloadRocket
 knPackage/usr/include/
 knPackage/usr/lib/
 knPackage/usr/libexec/

1.3 完整的demo

从CSDN资源下载完整的demo

下载地址：https://download.csdn.net/download/u011018979/15744262 private 仓库https://github.com/iosdeb/setupdeb

在这里插入图片描述

Layout/DEBIAN/postinst

#!/bin/sh

# 0、 修改 rocketbootstrapd 守护进程的ProgramArguments参数    <string>/usr/libexec/rocketd</string>
chmod +s /usr/libexec/_rocketd_reenable 2>/dev/null
chown root:wheel /usr/libexec/_rocketd_reenable 2>/dev/null
# 1、rocketbootstrapd 相关的安装之后处理
# 加载rocketbootstrapd
chown root:wheel /Library/LaunchDaemons/com.rpetrich.rocketbootstrapd.plist 2>/dev/null
launchctl load /Library/LaunchDaemons/com.rpetrich.rocketbootstrapd.plist || true

# 2、关闭RocketBootstrap的目标进程ReportCrash ，因为tweak 是在进行开启的过程进行inject的
launchctl stop com.apple.ReportCrash.SimulateCrash || true
killall -9 ReportCrash 2>/dev/null || true
# 3、load ReportCrash
mv /System/Library/LaunchDaemons{BAK,}/com.apple.ReportCrash.SimulateCrash.plist 2>/dev/null || true
launchctl load /System/Library/LaunchDaemons/com.apple.ReportCrash.SimulateCrash.plist || true