好想用 doxygen 畫(huà) iOS app 的 class 繼承關(guān)系。
有沒(méi)有比 class-dump-z 更直觀的分析工具? 利器 iNalyzer 隆重登場(chǎng)~
在 iPhone 端:
1)進(jìn)入 cydia 添加源 http://appsec-labs.com/cydia/
2)搜索 iNalyzer 并安裝
在 Mac 端:
brew install oxygen graphviz
cd /Applications/iNalyzer5.app
./iNalyzer5
usage: ./iNalyzer5 [application name] [...]
Applications available: Portal Tenpay
./iNalyzer5 Portal
got params /var/mobile/Applications/4763A8A5-2E1D-4DC2-8376-6CB7A8B98728/Portal.app/ Portal.app 800 iNalyzer is iNalyzing Portal...
iNalyzer:crack_binary got /var/mobile/Applications/4763A8A5-2E1D-4DC2-8376-6CB7A8B98728/Portal.app/Portal /tmp/iNalyzer5_3f0d8773/Payload/Portal.app/Portal Dumping binary...helloooo polis?
helloooo polis?
iNalyzer:Creating SnapShot into ClientFiles
iNalyzer:SnapShot Done
iNalyzer:Population Done
iNalyzer:Dumping Headers
iNalyzer:Patching Headers
/bin/sh: /bin/ls: Argument list too long
ls: cannot access *_fixed: No such file or directory
/var/root/Documents/iNalyzer/支付寶錢包-v8.0.0.ipa
將解密后的 ipa 拷貝到本地
解壓 ipa, cd 到 /支付寶錢包-v8.0.0/Payload/Doxygen
下找到 doxMe.sh
#!/bin/sh
/Applications/Doxygen.app/Contents/Resources/doxygen dox.template && open ./html/index.html
我們是通過(guò) brew 安裝的 doxygen,所以修改腳本為:
#!/bin/sh
doxygen dox.template && open ./html/index.html
./doxMe.sh
完成后瀏覽器會(huì)自動(dòng) open 生成的html
文件
通過(guò) index.html 我們可以直觀的查看到 Strings analysis , ViewControllers,Classes 等幾大類的信息。
http://wiki.jikexueyuan.com/project/ios-security-defense/images/inalyzer1.png" alt="inalyzer1" />
在 Classes->Class Hierarchy 可以查看到類繼承圖示。 支付寶 app class Hierarchy 結(jié)果冰山一角:
http://wiki.jikexueyuan.com/project/ios-security-defense/images/inalyzer2.png" alt="inalyzer2" />