[iOS] 《PV 私密相册》优雅破解 初学教程

var hook = ObjC.classes['PV.IapReceiptManager']["- init"];
        Interceptor.attach(hook.implementation, {
                onEnter: function(args) {
                        console.log('\n【++++++++++++++++】：\n')
                        },
                onLeave: function(retval) {
                        var IapReceiptManager = ObjC.chooseSync(ObjC.classes['PV.IapReceiptManager'])[0];
                        console.log('log:'+IapReceiptManager+"\n")
                        IapReceiptManager["- setIsPermanentMember:"](0x1)
                }
});

Interceptor.attach(Module.findBaseAddress('PV').add(0x2B645C), {
        onEnter: function(args) {
            console.log(Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join("\n"))
        },
        onLeave: function(retval) {
            retval.replace(0);
        }
    });

@interface IapReceiptManager : NSObject
- (void)setIsPermanentMember:(bool)arg1;
@end

%hook IapReceiptManager
- (id)init {
        id iapReceiptManager = %orig;
        [iapReceiptManager setIsPermanentMember:YES];
        return iapReceiptManager;

}
%end

%ctor {
        NSLog(@"[+] PV Hooked");
        %init(IapReceiptManager = objc_getClass("PV.IapReceiptManager"));
}