震惊! 99%的人都不知道MacQQ竟然可以这样防撤回!

@daviyang35 wrote:

iOSRe论坛一直很友好，没有屏蔽无帐号的用户。对于知识传播这是非常利好的。
作为一个站在众多前辈无私分险干货的肩膀上的菜鸟，分享此基础教程混个脸熟。

感谢列表：
@Aimer
@0xBBC
iOSRE官方交流群的众多热心人士

---

概述:
MacQQ防消息撤回 源自BlueCocoa分享的干货代码。官方链接在此：
https://blog.0xbbc.com/2017/04/prevent-qq-message-recall-in-macos/

因之前正好问过张总，在macOS下有啥好的Hook框架，张总介绍过一款神器。
因为没有应用场景，就一直没有玩儿过。
正好BlueCocoa在官方交流群分享了代码，借着BlueCocoa的代码
来完成一次动手实践活动，学习技术，顺便分享技能骗个TL2帐号

1. substitute 下载，解决问题，编译
2. 创建macOS dylib工程，抄袭BlueCocoa的工作成果
3. DYLD_INSERT_LIBRARIES 与 load command
4. insert_dylib 下载，编译
5. 注入QQ
6. @executable_path @loader_path @rpath
7. install_name_tool 修复路径
8. 完结撒花

---

0x01

开发环境

   CocoaPods : 1.2.0
        Ruby : ruby 2.2.6p396 (2016-11-15 revision 56800) [x86_64-darwin16]
    RubyGems : 2.6.11
        Host : Mac OS X 10.12.4 (16E195)
       Xcode : 8.3.1 (8E1000a)
         Git : git version 2.11.0 (Apple Git-81)
          QQ : QQ for Mac V5.5.1(25725)

张总介绍的macOS上面的Hook神器为：substitute
下载并查看readme.md，发现只有 To compile for iOS 描述，没有for macOS。。。
先执行一次万能的make试试水深。

davis-MBP:substitute-master daviyang$ ./configure
Xcode SDK platform path: u'/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform'
Using architectures for 'host': (native)
Found cpp for 'host': /usr/bin/xcrun --sdk macosx cc -E
Xcode SDK platform path: u'/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform'
Using architectures for 'asm-x86_64': ['x86_64']
Xcode SDK platform path: u'/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform'
Using architectures for 'asm-i386': ['i386']
Xcode SDK platform path: u'/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform'
Using architectures for 'asm-arm': ['armv7']
Xcode SDK platform path: u'/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform'
Using architectures for 'asm-arm64': ['arm64']
Found cc for 'host': /usr/bin/xcrun --sdk macosx cc
Found dsymutil for 'host': /usr/bin/xcrun --sdk macosx dsymutil
Found cc for 'asm-x86_64': /usr/bin/xcrun --sdk macosx cc -arch x86_64
Found cc for 'asm-i386': /usr/bin/xcrun --sdk macosx cc -arch i386
Found cc for 'asm-arm': /usr/bin/xcrun --sdk iphoneos cc -arch armv7
Found cc for 'asm-arm64': /usr/bin/xcrun --sdk iphoneos cc -arch arm64
Writing out/main.mk
Writing Makefile
Writing config.status

接下来就是make。这命令不要笑，是readme.md推荐的，跟我没关系

davis-MBP:substitute-master daviyang$ make -j8
··· 省略一些内容
./lib/darwin/find-syms.c:157:13: error: 'syscall' is deprecated: first deprecated in macOS 10.12 - syscall(2) is unsupported; please switch to a supported interface. For
      SYS_kdebug_trace use kdebug_signpost(). [-Werror,-Wdeprecated-declarations]
        if (syscall(294, &start_address)) /* shared_region_check_np */
            ^
/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.12.sdk/usr/include/unistd.h:733:6: note: 'syscall' has been explicitly marked
      deprecated here
int      syscall(int, ...);
         ^
1 error generated.
make: *** [out/lib/darwin/find-syms.o] Error 1
make: *** Waiting for unfinished jobs....

出错了，但是平台确实选择了macOS，有得有失。
通过咨询一个不存在的网站找到一个解决方案。
到这里下载老的MacOSX10.11.sdk，放入 /Applications/XCode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs

友情提醒，仓库的Release中有独立的下载压缩包。

再次make -j8 ，得到相同的错误，这肯定得改编译参数了。

davis-MBP:substitute-master daviyang$ ./configure --help
*省略版面

  Xcode SDK options (host):

  --xcode-sdk ...       Use Xcode SDK - `xcodebuild -showsdks` lists; typical
                        values: macosx, iphoneos, iphonesimulator, watchos,
                        watchsimulator
*省略版面

找到了--xcode-sdk改变编译SDK，并且提示了 xcodebuild -showsdks 命令可以查看列表。

davis-MBP:substitute-master daviyang$ xcodebuild -showsdks
iOS SDKs:
	iOS 10.3                      	-sdk iphoneos10.3

iOS Simulator SDKs:
	Simulator - iOS 10.3          	-sdk iphonesimulator10.3

macOS SDKs:
	OS X 10.11                    	-sdk macosx10.11
	macOS 10.12                   	-sdk macosx10.12

tvOS SDKs:
	tvOS 10.2                     	-sdk appletvos10.2

tvOS Simulator SDKs:
	Simulator - tvOS 10.2         	-sdk appletvsimulator10.2

watchOS SDKs:
	watchOS 3.2                   	-sdk watchos3.2

watchOS Simulator SDKs:
	Simulator - watchOS 3.2       	-sdk watchsimulator3.2

重建正确的编译环境并编译。

davis-MBP:substitute-master daviyang$ ./configure --xcode-sdk macosx10.11 && make -j8
davis-MBP:substitute-master daviyang$ ls out/
_calc_darwin_target_conditionals.c	lib					libsubstitute.dylib			mconfig-hashes.txt
generated				libsubstitute.0.dylib			main.mk
davis-MBP:substitute-master daviyang$ file out/libsubstitute.dylib
out/libsubstitute.dylib: Mach-O 64-bit dynamically linked shared library x86_64

我们成功编译出了x86_64平台的libsubstitute.dylib，同时把substrate目录下的头文件拷贝备用。

Posts: 10

Participants: 5

Read full topic