WVWebView

NO IMAGE

前言

逆向分析WVWebView的重要突破口:

通過程式碼分析jsBridgeCallHistory,即js呼叫app的方法歷史:

- (id)getMainFrame{
    %log();
    NSLog(@"jsBridgeCallHistory %@:",[self jsBridgeCallHistory]);
    return %orig;
}
Oct 24 11:51:27 iPhone Moon[982] <Notice>: [taokeSearchTweak] Tweak.xm:255 DEBUG: -[<WVWebView: 0x1a9f7f30> getMainFrame]
Oct 24 11:51:27 iPhone Moon[982] <Notice>: [taokeSearchTweak] Tweak.xm:195 DEBUG: -[<WVWebView: 0x1a9f7f30> jsBridgeCallHistory]
Oct 24 11:51:27 iPhone Moon[982] <Warning>: jsBridgeCallHistory {
        "MtopWVPlugin.send" = 1;
        "WVTBUserTrack.toUT" = 1;
    }:

@property(readonly, nonatomic) NSDictionary *jsBridgeCallHistory;

其中包含了呼叫歷史,從這個地方入手,找到字典中的物件以及方法包括:

MoonJSBridge.openWebView

@interface MoonJSBridge : WVDynamicHandler
{
}

  (void)openWebView:(id)arg1 withCallback:(CDUnknownBlockType)arg2 withWebView:(id)arg3 withViewController:(id)arg4;

MtopWVPlugin.send

@interface MtopWVPlugin : WVDynamicHandler

- (void)pending:(id)arg1 request:(id)arg2 delegate:(id)arg3;
- (void)send:(id)arg1 withCallback:(CDUnknownBlockType)arg2 withWebView:(id)arg3 withViewController:(id)arg4;

WVTBUserTrack.toUT

@interface WVTBUserTrack : WVDynamicHandler
{
}

  (void)toUT:(id)arg1 withCallback:(CDUnknownBlockType)arg2 withWebView:(id)arg3 withViewController:(id)arg4;

進一步分析

TBSDKMTOPServer ApiRequestDelegateImpl、MtopWVPlugin、ApiRequest 進行分析

結論

呼叫 MtopWVPlugin.send 的時候會建立ApiRequestDelegateImpl.initWithRequest 並回撥到requestSuccess

總結


%hook WVWebView


- (NSDictionary *)jsBridgeCallHistory{
    %log();
    return %orig;
}

- (id)getMainFrame{
    %log();
    NSLog(@"jsBridgeCallHistory %@:",[self jsBridgeCallHistory]);
    return %orig;
}

- (void)dealloc{
    %log();
    
    // NSDictionary *tmp =[self jsBridgeCallHistory];
    // NSLog(@"jsBridgeCallHistory %@:",tmp);
    return %orig;
}
- (void)setTitle:(id)arg1{
    %log();
    [self openJSBridgeLog];
    return %orig;
}
%end

相關文章

IOS開發 最新文章