Quantcast
Channel: Essence Sharing | 干货分享 - iOSRE
Viewing all articles
Browse latest Browse all 301
↧

手把手教你编译Simulatetouch

September 20, 2018, 10:39 pm
$
0
0

@yuzhouheike wrote:

写在前面的话.为什么要编译这个?因为想做个模拟点击,提供给做测试岗位的未来女朋友使用,解放测试小姑娘们的双手,但是自己很菜又搞不懂苹果底层的点击是怎做的.搜索了一下发现韩国人写的这个simulatetouch可以达到要求,但是人家已经不维护了.所以需要修改他的代码.目前只发现了这一个开源代码,可以直接手机上每一个角落,所以需要在这个基础上开发自己的模拟点击,也看到了其他人的模拟点击比如PTFaketouch,ZSFaketouch但是这两个都需要注入别人的App才能点击,考虑到大多数厉害点儿的App都会做防注入,所以放弃,继续研读simulatetouch源码.期望与有共同需求的爱好者一起讨论

开发环境

  1. Xcode9.4.1
  2. iOS8
  3. macOS10.13.6

接下来做好不断失败的准备,因为在论坛搜了一下大多数都是求助无果的帖子

image
image.png1684×1384 472 KB

0x1 下载源代码 

git clone git@github.com:iolate/SimulateTouch.git

git submodule init

git submodule update

0x02 tree一下

165f62a86c0751d6?w=1788&h=1056&f=png&s=12194901788×1056

0x03 编译

make

165f63465205d925?w=2272&h=538&f=png&s=8041832272×538

0x04 在电脑找一下这个文件,发现找不到

sudo find / -name IOKit/hid/IOHIDEvent.h

165f6384c9496f15?w=2126&h=522&f=png&s=8565362126×522

0x05 去github找找

165f9c64ee35a460?w=2462&h=790&f=png&s=20399532462×790
  • 解决方式就是注释代码STLibrary的这些代码
// typedef enum {
//     UIInterfaceOrientationPortrait           = 1,//UIDeviceOrientationPortrait,
//     UIInterfaceOrientationPortraitUpsideDown = 2,//UIDeviceOrientationPortraitUpsideDown,
//     UIInterfaceOrientationLandscapeLeft      = 4,//UIDeviceOrientationLandscapeRight,
//     UIInterfaceOrientationLandscapeRight     = 3,//UIDeviceOrientationLandscapeLeft
// } UIInterfaceOrientation;
//
// @interface UIScreen
// +(id)mainScreen;
// -(CGRect)bounds;
// @end

0x06 去theos的git下载他们的SDK放在/opt/theos/sdk目录下修改Makefile 为9.3的SDK

include ${THEOS}/makefiles/common.mk

export TARGET = iphone:clang:9.3:8.0
# export SDKVERSION=5.1
# export CURRENT_VERSION = 0800
# TARGET = iphone:11.0:8.0
TWEAK_NAME = SimulateTouch
SimulateTouch_FILES = SimulateTouch.mm
SimulateTouch_PRIVATE_FRAMEWORKS = IOKit
SimulateTouch_LDFLAGS = -lsubstrate -lrocketbootstrap

LIBRARY_NAME = libsimulatetouch
libsimulatetouch_FILES = STLibrary.mm
libsimulatetouch_LDFLAGS = -lrocketbootstrap
libsimulatetouch_INSTALL_PATH = /usr/lib/
libsimulatetouch_FRAMEWORKS = UIKit CoreGraphics

TOOL_NAME = stouch
stouch_FILES = main.mm
stouch_FRAMEWORKS = UIKit
stouch_INSTALL_PATH = /usr/bin/
stouch_LDFLAGS = -lsimulatetouch

include $(THEOS_MAKE_PATH)/tweak.mk
include $(THEOS_MAKE_PATH)/library.mk
include $(THEOS_MAKE_PATH)/tool.mk

3006FA169981E8CE97D8ABCF43347953
3006FA169981E8CE97D8ABCF43347953.jpg1122×126 52.3 KB
  • 这里的解决方案是把Makefile文件换成第7步的Makefile文件内容SDK版本用11.2的

0x07 修改下Makefile文件 先编译lib因为编译其他两个要用到它.编译成功后放大到/opt/theos/lib目录下

include ${THEOS}/makefiles/common.mk

export TARGET = iphone:clang:11.2:8.0
# export SDKVERSION=5.1
# export CURRENT_VERSION = 0800
# TARGET = iphone:11.0:8.0
# TWEAK_NAME = SimulateTouch
# SimulateTouch_FILES = SimulateTouch.mm
# SimulateTouch_PRIVATE_FRAMEWORKS = IOKit
# SimulateTouch_LDFLAGS = -lsubstrate -lrocketbootstrap

LIBRARY_NAME = libsimulatetouch
libsimulatetouch_FILES = STLibrary.mm
libsimulatetouch_LDFLAGS = -lrocketbootstrap
libsimulatetouch_INSTALL_PATH = /usr/lib/
libsimulatetouch_FRAMEWORKS = UIKit CoreGraphics

# TOOL_NAME = stouch
# stouch_FILES = main.mm
# stouch_FRAMEWORKS = UIKit
# stouch_INSTALL_PATH = /usr/bin/
# stouch_LDFLAGS = -lsimulatetouch

include $(THEOS_MAKE_PATH)/tweak.mk
include $(THEOS_MAKE_PATH)/library.mk
include $(THEOS_MAKE_PATH)/tool.mk

165fa8e16a9413c7?w=2564&h=1114&f=png&s=30769922564×1114

0x08 这样不就成功了.此刻觉得大佬们不分享可能因为觉得太简单了

165fa96b182ace1d?w=2396&h=1100&f=png&s=18020482396×1100

0x09 接下来继续编译完整的项目

include ${THEOS}/makefiles/common.mk

export TARGET = iphone:clang:11.2:8.0
# export SDKVERSION=5.1
# export CURRENT_VERSION = 0800
# TARGET = iphone:11.0:8.0
TWEAK_NAME = SimulateTouch
SimulateTouch_FILES = SimulateTouch.mm
SimulateTouch_PRIVATE_FRAMEWORKS = IOKit
SimulateTouch_LDFLAGS = -lsubstrate -lrocketbootstrap

LIBRARY_NAME = libsimulatetouch
libsimulatetouch_FILES = STLibrary.mm
libsimulatetouch_LDFLAGS = -lrocketbootstrap
libsimulatetouch_INSTALL_PATH = /usr/lib/
libsimulatetouch_FRAMEWORKS = UIKit CoreGraphics

TOOL_NAME = stouch
stouch_FILES = main.mm
stouch_FRAMEWORKS = UIKit
stouch_INSTALL_PATH = /usr/bin/
stouch_LDFLAGS = -lsimulatetouch

include $(THEOS_MAKE_PATH)/tweak.mk
include $(THEOS_MAKE_PATH)/library.mk
include $(THEOS_MAKE_PATH)/tool.mk

165fa9d33b3f640d?w=2500&h=1202&f=png&s=32308492500×1202

0x10 重启手机 然后执行stouch 就可以了

由与SDK版本等各种环境问题你可能会遇到以下问题

  • 估计不会遇到问题。但是遇到的话评论区评论就好了

虽然说是手把手,但是好多细节我也忘记了,因为编译这个花费了两三天时间了,如果您在编译的过程中遇到什么其他问题,可以在评论里面问我,

从这里开始讲iOS11遇到问题的解决办法

iOS11的解决办法

0x01 首先解决killed:9问题


yuzhouheike1haoji:~ root# exit
logout
Connection to 192.168.31.149 closed.
 ✘ hacker_hades@HadesdeMacBook-Pro  ~/Desktop/SimulateTouch/SimulateTouch   master ●  cd ~/Desktop
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  !code
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  codesign -s "A2F872A1D9483EA7E16E6836CDF73B7917010A20" --entitlements demo.entitlements -f stouch
stouch: replacing existing signature
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  scp stouch root@192.168.31.149:/var
stouch                                                                                    100%  165KB   4.9MB/s   00:00
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  !ssh
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  ssh root@192.168.31.149
Last login: Sat Sep 22 13:32:21 2018 from 192.168.31.217
yuzhouheike1haoji:~ root# mv /var/stouch /usr/bin/
yuzhouheike1haoji:~ root# stouch
dyld: Library not loaded: /usr/lib//libsimulatetouch.dylib
  Referenced from: /usr/bin/stouch
  Reason: no suitable image found.  Did find:
	/usr/lib//libsimulatetouch.dylib: code signing blocked mmap() of '/usr/lib//libsimulatetouch.dylib'
	/usr/lib/libsimulatetouch.dylib: code signing blocked mmap() of '/usr/lib/libsimulatetouch.dylib'
Abort trap: 6
  • 0x02 根据提示这个/usr/lib//libsimulatetouch.dylib动态库没有签名
yuzhouheike1haoji:~ root# exit
logout
Connection to 192.168.31.149 closed.

 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  scp root@192.168.31.149:/usr/bin/stouch ./
stouch                                                                                    100%  130KB   4.7MB/s   00:00
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  !code
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  codesign -s "A2F872A1D9483EA7E16E6836CDF73B7917010A20" --entitlements demo.entitlements -f stouch
stouch: replacing existing signature
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  scp stouch root@192.168.31.149:/var
stouch                                                                                    100%  165KB   4.8MB/s   00:00

0x02 解决libsimulatetouch.dylib签名

 ✘ hacker_hades@HadesdeMacBook-Pro  ~/Desktop  scp root@192.168.31.149:/usr/lib//libsimulatetouch.dylib ./
libsimulatetouch.dylib                                                                    100%  134KB   4.3MB/s   00:00
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  codesign -s "A2F872A1D9483EA7E16E6836CDF73B7917010A20" --entitlements demo.entitlements -f libsimulatetouch.dylib
libsimulatetouch.dylib: replacing existing signature
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  scp libsimulatetouch.dylib root@192.168.31.149:/var
libsimulatetouch.dylib                                                                    100%  169KB   4.5MB/s   00:00
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  !ssh
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  ssh root@192.168.31.149
Last login: Sat Sep 22 14:22:28 2018 from 192.168.31.217
yuzhouheike1haoji:~ root# mv /var/lib
lib/                    libsimulatetouch.dylib
yuzhouheike1haoji:~ root# mv /var/libsimulatetouch.dylib /usr/lib//
yuzhouheike1haoji:~ root# stouch
dyld: Library not loaded: /usr/lib/librocketbootstrap.dylib
  Referenced from: /usr/lib//libsimulatetouch.dylib
  Reason: no suitable image found.  Did find:
	/usr/lib/librocketbootstrap.dylib: code signing blocked mmap() of '/usr/lib/librocketbootstrap.dylib'
	/usr/lib/librocketbootstrap.dylib: code signing blocked mmap() of '/usr/lib/librocketbootstrap.dylib'
Abort trap: 6

0x03 解决librocketbootstrap.dylib签名


 ✘ hacker_hades@HadesdeMacBook-Pro  ~/Desktop  scp root@192.168.31.149:/usr/lib/librocketbootstrap.dylib ./
librocketbootstrap.dylib                                                                  100%  217KB   6.1MB/s   00:00
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  codesign -s "A2F872A1D9483EA7E16E6836CDF73B7917010A20" --entitlements demo.entitlements -f librocketbootstrap.dylib
librocketbootstrap.dylib: replacing existing signature
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  scp librocketbootstrap.dylib root@192.168.31.149:/var
librocketbootstrap.dylib                                                                  100%  284KB   6.5MB/s   00:00
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  !ssh
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  ssh root@192.168.31.149
Last login: Sat Sep 22 14:24:01 2018 from 192.168.31.217
yuzhouheike1haoji:~ root# mv /var/librocketbootstrap.dylib /usr/lib/librocketbootstrap.dylib
yuzhouheike1haoji:~ root# stouch
dyld: Library not loaded: /usr/lib/libsubstrate.dylib
  Referenced from: /usr/lib/librocketbootstrap.dylib
  Reason: no suitable image found.  Did find:
	/usr/lib/libsubstrate.dylib: code signing blocked mmap() of '/usr/lib/libsubstrate.dylib'
	/usr/lib/libsubstrate.dylib: code signing blocked mmap() of '/usr/lib/libsubstrate.dylib'
Abort trap: 6

0x04 解决/usr/lib/libsubstrate.dylib签名

yuzhouheike1haoji:~ root# exit
logout
Connection to 192.168.31.149 closed.
 ✘ hacker_hades@HadesdeMacBook-Pro  ~/Desktop  scp root@192.168.31.149:/usr/lib/libsubstrate.dylib ./
libsubstrate.dylib                                                                        100%   66KB   2.8MB/s   00:00
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  codesign -s "A2F872A1D9483EA7E16E6836CDF73B7917010A20" --entitlements demo.entitlements -f libsubstrate.dylib
libsubstrate.dylib: replacing existing signature
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  scp libsubstrate.dylib root@192.168.31.149:/var
libsubstrate.dylib                                                                        100%   85KB   3.3MB/s   00:00
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  !ssh
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  ssh root@192.168.31.149
Last login: Sat Sep 22 14:26:20 2018 from 192.168.31.217
yuzhouheike1haoji:~ root# mv /var/libsubstrate.dylib /usr/lib/libsubstrate.dylib
yuzhouheike1haoji:~ root# stouch
dyld: Library not loaded: /usr/lib/libsubstitute.0.dylib
  Referenced from: /usr/lib/libsubstrate.dylib
  Reason: no suitable image found.  Did find:
	/usr/lib/libsubstitute.0.dylib: code signing blocked mmap() of '/usr/lib/libsubstitute.0.dylib'
	/usr/lib/libsubstitute.0.dylib: code signing blocked mmap() of '/usr/lib/libsubstitute.0.dylib'
Abort trap: 6

0x05 解决/usr/lib/libsubstitute.0.dylib签名问题

yuzhouheike1haoji:~ root# exit
logout
Connection to 192.168.31.149 closed.
 ✘ hacker_hades@HadesdeMacBook-Pro  ~/Desktop  scp root@192.168.31.149:/usr/lib/libsubstitute.0.dylib ./
libsubstitute.0.dylib                                                                     100%  104KB   4.1MB/s   00:00
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  codesign -s "A2F872A1D9483EA7E16E6836CDF73B7917010A20" --entitlements demo.entitlements -f libsubstitute.0.dylib
libsubstitute.0.dylib: replacing existing signature
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  scp libsubstitute.0.dylib root@192.168.31.149:/var
libsubstitute.0.dylib                                                                     100%  124KB   1.9MB/s   00:00
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  !ssh
 hacker_hades@HadesdeMacBook-Pro  ~/Desktop  ssh root@192.168.31.149
Last login: Sat Sep 22 14:29:17 2018 from 192.168.31.217
yuzhouheike1haoji:~ root# mv /var/libsubstitute.0.dylib /usr/lib/libsubstitute.0.dylib
yuzhouheike1haoji:~ root# stouch
[Usage]
 1. Touch:
    stouch touch x y [orientation]

 2. Swipe:
   stouch swipe fromX fromY toX toY [duration(0.3)] [orientation]

 3. Button:
    stouch button Type State

[Example]
   # stouch touch 50 100
   # stouch swipe 50 100 100 200 0.5
   # stouch button 0 1
   # stouch button 1 0

[Orientation]
    Portrait:1 UpsideDown:2 Right:3 Left:4

[Button]
    Power:0 Home:1

[State]
    Up/Raise:0 Down/Press:1

yuzhouheike1haoji:~ root#

0x06 问题解决了那么问题来了就没有简单点儿的解决办法吗。。

0x07 然而事情还是没有完

image
image.jpg1118×110 39.8 KB

0x08 使用YZHK提权: YZHK stouch touch 50 100 

#include <spawn.h>

int  main(int argc, char *argv[], char *envp[])
{
    if (argc < 2)
    {
   fprintf(stderr, "usage: %s program args...\n", argv[0]);
       
       return EXIT_FAILURE;
    }
    
    int ret, status;
    pid_t pid;
    posix_spawnattr_t attr;
    
    posix_spawnattr_init(&attr);
    posix_spawnattr_setflags(&attr, POSIX_SPAWN_START_SUSPENDED);
    
    ret = posix_spawnp(&pid, argv[1], NULL, &attr, &argv[1], envp);
    
    posix_spawnattr_destroy(&attr);
    
    if (ret != 0)
    {
        printf("posix_spawnp failed with %d: %s\n", ret, strerror(ret));
        return ret;
    }
    
    char buf[200];
    
    snprintf(buf, sizeof(buf), "/electra/jailbreakd_client %d 1", pid);
    system(buf);
    
    kill(pid, SIGCONT);
    waitpid(pid, &status, 0);
    
    return 0;
}

pic_hd
591537607039_.pic_hd.png1986×192 127 KB

0x09 解决MessagePort is invalid问题

  • reboot即可

0x10 好了做完上面的,发现手机并没有被点击…

image
image.jpg1982×312 189 KB

0x11 查看日志,

3CC8A569-C03F-48F4-B76B-A202D0B3BE20
3CC8A569-C03F-48F4-B76B-A202D0B3BE20.jpg1140×562 166 KB

Posts: 44

Participants: 12

Read full topic

↧
Search
Viewing all articles
Browse latest Browse all 301

Trending Articles

Scuffham Amps - S-GEAR 2.6.0 VST, AAX, STANDALONE x86 x64 (R2R NO iLok2, +NO...

November 19, 2017, 7:24 am

Practice Sheet of Right form of verbs for HSC Students

September 22, 2019, 11:40 pm

VHSE First (1st) Allotment 2025 - vhscap.kerala.gov.in

May 24, 2025, 11:58 pm

UNIVERSE LEAGUE – UNIVERSE LEAGUE – WAR (We Are Ready) – EP [iTunes Plus M4A]

January 26, 2025, 11:12 am

City Hunter Teledrama – Episode 18 – 07th May 2016

May 6, 2016, 2:05 pm

Comment on Proposed Criteria for Identifying Predatory Conferences by Luke...

July 4, 2016, 3:53 am

Bureau of Internal Revenue: Regional Offices (Directory)

January 9, 2014, 11:06 pm

Kendrick Lamar – Not Like Us (2024) [24Bit-88.2kHz] [PMEDIA] ⭐️

May 14, 2024, 7:14 pm

Inception 2010 Hindi Dual Audio 650MB BRRip 720p ESubs HEVC

December 27, 2016, 4:23 pm

East Hull MD admits sexual assaults after another victim comes forward

January 14, 2013, 12:20 am

Download: FK ft Shenky – Nakuyewa ”Prod by: Shenky”

February 16, 2017, 4:24 pm

R. v. Sargeant, 2023 ONSC 6406 (CanLII)

November 13, 2023, 9:00 pm

Rajasthan Board 10th Result 2016 Roll No wise & Name Wise

August 20, 2016, 5:13 pm

Who’s been sentenced at Northampton Magistrates’ Court

March 30, 2019, 10:00 pm

मतलबी दोस्त स्टेट्स | Matlabi Dost Status in Hindi – Selfish Friends Status

February 13, 2020, 3:12 am

Family cries out as traditional ruler allegedly abducts brother, extorts N2.5m

September 15, 2024, 1:15 am

Long-Running Conflict In Springfield (MA) Gangland Sphere Has Manzi Family &...

December 26, 2017, 3:59 pm

Wondershare Filmora X v10.1.20.16 x64

February 8, 2021, 5:34 am

Man arrested after fracas in flat

January 16, 2017, 10:10 pm

Man charged in ongoing Sexual Assault Investigation Derek Nyilas, 46, Faces...

May 27, 2019, 8:00 am
Search