【砸殼STEP2】使用cycript查看並修改微信UI界面

z繼續上次的講，我們顯示如下

cy# [alertView show]

我們使用 control + d來退出當前進程。

---

言歸正傳。

我們首先關閉全部後臺程序，然後打開微信的app。

爲了防止數據看起來混亂、你不清理也是可以的老鐵。

---

【1】找到微信

在終端輸入 ps -e

可以看到當前所有的進程。

wiki:~ root# ps -e
  PID TTY           TIME CMD
    1 ??         0:22.42 /sbin/launchd
   26 ??         1:26.53 /usr/libexec/UserEventAgent (System)
   27 ??         0:07.99 /usr/sbin/syslogd
   28 ??         0:18.55 /usr/sbin/wifid
   34 ??         0:04.56 /System/Library/CoreServices/powerd.bundle/powerd
   42 ??         0:07.36 /usr/libexec/lockdownd
   50 ??         0:02.88 /usr/sbin/mediaserverd
   52 ??         0:03.64 /usr/sbin/mDNSResponder -launchd
   54 ??         0:25.11 /usr/libexec/locationd
   56 ??         0:01.22 /System/Library/PrivateFrameworks/IMCore.framework/ima
   57 ??         0:03.16 /System/Library/PrivateFrameworks/IAP.framework/Suppor
   59 ??         0:06.36 /usr/libexec/fseventsd
   60 ??         0:02.62 /usr/sbin/fairplayd.N94
   63 ??         0:13.13 /usr/libexec/configd
   70 ??         0:00.51 /Applications/kbd.app/kbd
   72 ??         0:00.35 /usr/libexec/misd -d
   75 ??         0:13.28 /System/Library/Frameworks/CoreTelephony.framework/Sup
   76 ??         0:01.04 /usr/sbin/BTServer
   77 ??         0:03.32 /usr/libexec/sogou/imed
  113 ??         0:14.66 /usr/sbin/notifyd
  134 ??         0:04.20 /usr/libexec/networkd
  138 ??         0:02.89 /System/Library/PrivateFrameworks/AggregateDictionary.
  151 ??         0:05.32 /System/Library/PrivateFrameworks/ApplePushService.fra
  153 ??         0:00.05 /usr/sbin/distnoted daemon
  157 ??         0:01.96 /System/Library/Frameworks/SystemConfiguration.framewo
  295 ??         0:00.32 /System/Library/PrivateFrameworks/TCC.framework/tccd
  348 ??         0:00.08 /usr/sbin/filecoordinationd
 2061 ??         0:02.98 /System/Library/CoreServices/AppleIDAuthAgent
 2069 ??         0:00.14 /usr/libexec/networkd_privileged
 2092 ??         0:05.49 /System/Library/PrivateFrameworks/iTunesStore.framewor
 2094 ??         0:00.83 /usr/libexec/installd --idleExit
 2096 ??         0:01.82 /usr/libexec/lsd
 2228 ??         0:00.05 /usr/libexec/xpcd
 2244 ??         0:00.66 /usr/libexec/timed
 3018 ??        12:52.48 /usr/libexec/backboardd
 3022 ??        15:27.81 /System/Library/CoreServices/SpringBoard.app/SpringBoa
 3041 ??         0:01.51 /Applications/MobilePhone.app/MobilePhone
 3042 ??         0:01.50 /Applications/MobileMail.app/MobileMail
 3044 ??         0:00.19 /System/Library/Frameworks/Accounts.framework/accounts
 3055 ??         0:04.68 /System/Library/Frameworks/AssetsLibrary.framework/Sup
 3413 ??         0:00.12 /usr/libexec/notification_proxy
 3437 ??         0:00.10 /usr/libexec/afcd --xpc -d /private/var/mobile/Media
 4246 ??         0:02.57 /usr/libexec/ptpd -t usb
 4558 ??         0:00.40 sshd: root@ttys001 
 6373 ??         0:00.07 /usr/libexec/afcd --lockdown -d /
 6457 ??         0:00.17 /System/Library/PrivateFrameworks/Ubiquity.framework/V
 4561 ttys001    0:00.06 -sh
 6459 ttys001    0:00.01 ps -e
wiki:~ root# ps -e
  PID TTY           TIME CMD
    1 ??         0:22.55 /sbin/launchd
   26 ??         1:26.94 /usr/libexec/UserEventAgent (System)
   27 ??         0:08.03 /usr/sbin/syslogd
   28 ??         0:18.66 /usr/sbin/wifid
   34 ??         0:04.58 /System/Library/CoreServices/powerd.bundle/powerd
   42 ??         0:07.36 /usr/libexec/lockdownd
   50 ??         0:02.91 /usr/sbin/mediaserverd
   52 ??         0:03.65 /usr/sbin/mDNSResponder -launchd
   54 ??         0:25.18 /usr/libexec/locationd
   56 ??         0:01.22 /System/Library/PrivateFrameworks/IMCore.framework/ima
   57 ??         0:03.18 /System/Library/PrivateFrameworks/IAP.framework/Suppor
   59 ??         0:06.40 /usr/libexec/fseventsd
   60 ??         0:02.63 /usr/sbin/fairplayd.N94
   63 ??         0:13.18 /usr/libexec/configd
   70 ??         0:00.51 /Applications/kbd.app/kbd
   72 ??         0:00.35 /usr/libexec/misd -d
   75 ??         0:13.31 /System/Library/Frameworks/CoreTelephony.framework/Sup
   76 ??         0:01.05 /usr/sbin/BTServer
   77 ??         0:03.33 /usr/libexec/sogou/imed
  113 ??         0:14.74 /usr/sbin/notifyd
  134 ??         0:04.21 /usr/libexec/networkd
  138 ??         0:02.90 /System/Library/PrivateFrameworks/AggregateDictionary.
  151 ??         0:05.32 /System/Library/PrivateFrameworks/ApplePushService.fra
  153 ??         0:00.05 /usr/sbin/distnoted daemon
  157 ??         0:01.96 /System/Library/Frameworks/SystemConfiguration.framewo
  295 ??         0:00.32 /System/Library/PrivateFrameworks/TCC.framework/tccd
  348 ??         0:00.08 /usr/sbin/filecoordinationd
 2061 ??         0:03.00 /System/Library/CoreServices/AppleIDAuthAgent
 2069 ??         0:00.14 /usr/libexec/networkd_privileged
 2092 ??         0:05.52 /System/Library/PrivateFrameworks/iTunesStore.framewor
 2094 ??         0:00.85 /usr/libexec/installd --idleExit
 2096 ??         0:01.82 /usr/libexec/lsd
 2228 ??         0:00.05 /usr/libexec/xpcd
 2244 ??         0:00.66 /usr/libexec/timed
 3018 ??        12:54.49 /usr/libexec/backboardd
 3022 ??        15:35.95 /System/Library/CoreServices/SpringBoard.app/SpringBoa
 3041 ??         0:01.51 /Applications/MobilePhone.app/MobilePhone
 3042 ??         0:01.50 /Applications/MobileMail.app/MobileMail
 3044 ??         0:00.19 /System/Library/Frameworks/Accounts.framework/accounts
 3055 ??         0:04.69 /System/Library/Frameworks/AssetsLibrary.framework/Sup
 3413 ??         0:00.12 /usr/libexec/notification_proxy
 3437 ??         0:00.10 /usr/libexec/afcd --xpc -d /private/var/mobile/Media
 4246 ??         0:02.59 /usr/libexec/ptpd -t usb
 4558 ??         0:00.41 sshd: root@ttys001 
 6373 ??         0:00.07 /usr/libexec/afcd --lockdown -d /
 6492 ??         0:03.30 /var/mobile/Applications/89D9C604-7992-4144-9B7F-03603
 6493 ??         0:00.06 /usr/libexec/securityd
 6496 ??         0:00.08 /System/Library/Frameworks/UIKit.framework/Support/pas
 6498 ??         0:00.17 /System/Library/PrivateFrameworks/Ubiquity.framework/V
 4561 ttys001    0:00.06 -sh
 6500 ttys001    0:00.01 ps -e

從這可以看到，我們的手機只要運行。就會有很多的進程在跑。

我們可以看到微信的app在這運動，

6492 ??         0:03.30 /var/mobile/Applications/89D9C604-7992-4144-9B7F-03603

【2】進入App查看view

我們使用進入此app

wiki:~ root# cycript -p 6492

然後請開始你的表演

cy# UIApp
#"<UIApplication: 0x1c5dbb80>"

cy# #0x1c5dbb80.keyWindow
#"<iConsoleWindow: 0x1c5f3320; baseClass = UIWindow; frame = (0 0; 320 480); layer = <UIWindowLayer: 0x1c5f3500>>"

cy# #0x1c5f3320.rootViewController
#"<MMUINavigationController: 0x1d1eca10>"

cy# #0x1d1eca10.view
#"<UILayoutContainerView: 0x1d1ece90; frame = (0 0; 320 480); autoresize = W+H; layer = <CALayer: 0x1d1ecf50>>"

cy# #0x1d1eca10.visibleViewController
#"<WCAccountLoginLastUserViewController: 0x1d1ec390>"

cy# #0x1d1ec390.view
#"<UIView: 0x1d0da930; frame = (0 0; 320 460); autoresize = W+H; layer = <CALayer: 0x1d0da8c0>>"

cy# view = #0x1d0da930
#"<UIView: 0x1d0da930; frame = (0 0; 320 460); autoresize = W+H; layer = <CALayer: 0x1d0da8c0>>"

cy# *view
{isa:UIView,_layer:#"<CALayer: 0x1d0da8c0>",_tapInfo:null,_gestureInfo:null,_gestureRecognizers:null,_subviewCache:@[#"<MMTableView: 0x1cadd200; baseClass = UITableView; frame = (0 0; 320 460); clipsToBounds = YES; autoresize = W+H; gestureRecognizers = <NSArray: 0x1d0db020>; layer = <CALayer: 0x1d0daba0>; contentOffset: {-0, -44}>",#"<UIButton: 0x1d1129e0; frame = (134.5 409; 51 41); opaque = NO; autoresize = LM+RM+TM; tag = 2222; layer = <CALayer: 0x1d1129b0>>"],_charge:0,_tag:0,_viewDelegate:#"<WCAccountLoginLastUserViewController: 0x1d1ec390>",_backgroundColorSystemColorName:null,_viewFlags:@error,_retainCount:6,_boundsWidthVariable:null,_boundsHeightVariable:null,_minXVariable:null,_minYVariable:null,_internalConstraints:null,_constraintsExceptingSubviewAutoresizingConstraints:null,_dependentConstraints:null,_shouldArchiveUIAppearanceTags:0}
cy# 

我們可以看到_subviewCache裏面的內容，就是此頁面的圖層結構。

我們可以看到微信的登陸界面用的是UITabelView。。。。

【3】修改UI界面

我們把TableView和UIButton拿出來。

cy# #0x1cadd200
#"<MMTableView: 0x1cadd200; baseClass = UITableView; frame = (0 0; 320 460); clipsToBounds = YES; autoresize = W+H; gestureRecognizers = <NSArray: 0x1d0db020>; layer = <CALayer: 0x1d0daba0>; contentOffset: {-0, -44}>"

cy# #0x1d1129e0
#"<UIButton: 0x1d1129e0; frame = (134.5 409; 51 41); opaque = NO; autoresize = LM+RM+TM; tag = 2222; layer = <CALayer: 0x1d1129b0>>"

修改TableView的背景顏色

cy# tb = #0x1cadd200
#"<MMTableView: 0x1cadd200; baseClass = UITableView; frame = (0 0; 320 460); clipsToBounds = YES; autoresize = W+H; gestureRecognizers = <NSArray: 0x1d0db020>; layer = <CALayer: 0x1d0daba0>; contentOffset: {-0, -44}>"

cy# tb.backgroundColor = [UIColor blueColor]
#"UIDeviceRGBColorSpace 0 0 1 1"

不得不說，藍色好醜。我們還是改回去吧。

cy# tb.backgroundColor = [UIColor whiteColor]
#"UIDeviceWhiteColorSpace 1 1"

隱藏這個Button和更改title

cy# btn = #0x1d1129e0
#"<UIButton: 0x1d1129e0; frame = (134.5 409; 51 41); opaque = NO; autoresize = LM+RM+TM; tag = 2222; layer = <CALayer: 0x1d1129b0>>"
cy# btn.frame
{0:{0:134.5,1:409},1:{0:51,1:41}}
cy# [btn frame]
{0:{0:134.5,1:409},1:{0:51,1:41}}
cy# btn.hidden = YES
true

我們會發現，微信登陸界面 “更多”按鈕消失了。
所以這個button就是更多按鈕！

如果輸入btn.frame， 有錯誤提示，這個一個C語言的結構體的話，那麼就用[btn frame]

cy# btn.titleLabel.text = "hahahhahaahaha"
"hahahhahaahaha"

我們發現這個更多按鈕變成了h...

咳咳，原來老版本的微信這塊的frame是寫死的噢，嘎嘎~~

---

查看UI的層級結構，一目瞭然

cy# UIApp.keyWindow.recursiveDescription()
throw new TypeError(`'<iConsoleWindow: 0x1c5f3320; baseClass = UIWindow; frame = (0 0; 320 480); layer = <UIWindowLayer: 0x1c5f3500>>
   | <UILayoutContainerView: 0x1d1ece90; frame = (0 0; 320 480); autoresize = W+H; layer = <CALayer: 0x1d1ecf50>>
   |    | <UINavigationTransitionView: 0x1d0d97f0; frame = (0 0; 320 480); clipsToBounds = YES; autoresize = W+H; layer = <CALayer: 0x1d0d98c0>>
   |    |    | <UIViewControllerWrapperView: 0x1d111d50; frame = (0 20; 320 460); autoresize = W+H; layer = <CALayer: 0x1d111cd0>>
   |    |    |    | <UIView: 0x1d0da930; frame = (0 0; 320 460); autoresize = W+H; layer = <CALayer: 0x1d0da8c0>>
   |    |    |    |    | <MMTableView: 0x1cadd200; baseClass = UITableView; frame = (0 0; 320 460); clipsToBounds = YES; autoresize = W+H; gestureRecognizers = <NSArray: 0x1d0db020>; layer = <CALayer: 0x1d0daba0>; contentOffset: {-0, -44}>
   |    |    |    |    |    | <UIView: 0x1d112190; frame = (0 0; 320 348); layer = <CALayer: 0x1d112160>>
   |    |    |    |    |    |    | <UIView: 0x1d11ac70; frame = (0 0; 320 348); autoresize = LM+RM; layer = <CALayer: 0x1d11acd0>>
   |    |    |    |    |    |    |    | <UIImageView: 0x1d22b5d0; frame = (120 44; 80 80); clipsToBounds = YES; opaque = NO; autoresize = LM+RM; userInteractionEnabled = NO; layer = <CALayer: 0x1d22b630>>
   |    |    |    |    |    |    |    | <MMUILabel: 0x1d22c0e0; baseClass = UILabel; frame = (118 139; 84 20); text = '1548388802'; clipsToBounds = YES; autoresize = LM+RM; userInteractionEnabled = NO; layer = <CALayer: 0x1d22c010>>
   |    |    |    |    |    |    |    | <UIView: 0x1d119390; frame = (0 189; 320 44); layer = <CALayer: 0x1d1193f0>>
   |    |    |    |    |    |    |    |    | <WCUITextField: 0x1d118e80; baseClass = UITextField; frame = (15 0; 295 44); clipsToBounds = YES; opaque = NO; gestureRecognizers = <NSArray: 0x1d117810>; layer = <CALayer: 0x1d118e00>>
   |    |    |    |    |    |    |    |    |    | <MMUILabel: 0x1d232ba0; baseClass = UILabel; frame = (0 0; 93 44); text = '\u5bc6\u7801'; clips
cy#