Posted by kunnan on June 6, 2018

Using nm, we can dump the Swift symbols

  • nm HookExampleApp
  • the symbols look unmangled:
 nm /Users/devzkn/decrypted/NoName/Payload/Name.app/Name | xcrun swift-demangle

swift 进行swiftOCclass-dump 之后的分析

  • _Ttappname19NNTabViewController 对应 hopper 中的appname.NNTabViewController

I 、 hooking-swift-methods

%hook AnyRandomNameHere
- (void)isjailbroken {
return nil;
%ctor {
%init(AnyRandomNameHere = objc_getClass("mobile.AppDelegate"));

II、 Calling a Swift method

2.1 Adding a test Swift method

func randomFunction() {
    print("randomFunction called")
nm <AppName>
T __T014HookExampleApp14ViewControllerC14randomFunctionyyF
nm <AppName> | xcrun swift-demangle
T _HookExampleApp.ViewController.randomFunction() -> ()

2.2 Using MSFindSymbol we can find the function pointer to the Swift method, and call it.

  • MSFindSymbol
    void *MSFindSymbol(MSImageRef image, const char *name);
  • Calling a Swift method
- (void)viewDidLoad {
    NSLog(@"VIEW DID LOAD");
    void *symbol = MSFindSymbol(NULL, "__T014HookExampleApp14ViewControllerC14randomFunctionyyF");
   ((void (*)(void)) symbol)();

III、 Hooking a Swift method

After finding the function pointer to a Swift method;use MSHookFunction to hook it

  • MSHookFunction
    void MSHookFunction(void *symbol, void *hook, void **old);
  • Hooking a Swift method
static void (*orig_ViewController_randomFunction)(void) = NULL;

void hook_ViewController_randomFunction() {
   NSLog(@"Hooked random function");

%ctor {
    %init(ViewController = objc_getClass("HookExampleApp.ViewController"));
    MSHookFunction(MSFindSymbol(NULL, "__T014HookExampleApp14ViewControllerC14randomFunctionyyF"),



__attribute__((constructor)) static void before1(){
  [KNHook hookClass:@"appName.AppDelegate"];

See Also

/Users/devzkn/bin/knpost hooking-swift-methods 利用theos、MSHookFunction、MSFindSymbol进行实现 -t iosre

转载请注明: > hooking-swift-methods