标签：
DANI-LEE-2:git clone https://github.com/stefanesser/dumpdecrypted.git
DANI-LEE-2:dumpdecrypted danqingdani$ vim Makefile
PLATFORM=/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer
SDK_VER=5.1
BIN = $(PLATFORM)/usr/bin
GCC_BIN = $(BIN)/gcc
#GCC = $(GCC_BASE) -arch armv6
GCC = $(GCC_BASE) -arch armv7
GCC_UNIVERSAL = $(GCC_BASE) -arch armv6 -arch armv7
GCC_NATIVE = gcc
SDK=$(PLATFORM)/SDKs/iPhoneOS$(SDK_VER).sdk/
CFLAGS =
GCC_BASE = $(GCC_BIN) -Os $(CFLAGS) -Wimplicit -isysroot $(SDK) -F$(SDK)System/Library/Frameworks -F$(SDK)System/Library/Privat eFrameworks
all: dumpdecrypted.dylib
dumpdecrypted.dylib: dumpdecrypted.o
$(GCC_UNIVERSAL) -dynamiclib -o $@ $^
%.o: %.c
$(GCC_UNIVERSAL) -dynamiclib -c -o $@ $<
clean:
rm -f *.o dumpdecrypted.dylib
DANI-LEE-2:dumpdecrypted danqingdani$ make
DANI-LEE-2:dumpdecrypted danqingdani$ codesign -fs tanjiti<自签名证书> dumpdecrypted.dylib
DANI-LEE-2:dumpdecrypted danqingdani$ scp dumpdecrypted.dylib root@10.0.0.3:/tmp/
root@10.0.0.3‘s password:
dumpdecrypted.dylib 100% 46KB 45.8KB/s 00:00
DANI-LEE-2:dumpdecrypted danqingdani$ ssh root@10.0.0.3<实际的ip>
root@10.0.0.3‘s password:
danimato-iPad:/tmp root# DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Applications/2664B392-0B9B-4CB5-9EFC-5F0D8E3D5C80/CTRIP_WIRELESS.app/CTRIP_WIRELESS mach-o decryption dumper DISCLAIMER: This tool is only meant for security research purposes, not for application crackers. [+] offset to cryptid found: @0xeba78(from 0xeb000) = a78 [+] Found encrypted data at address 00002000 of length 10551296 bytes - type 1. [+] Opening /private/var/mobile/Applications/2664B392-0B9B-4CB5-9EFC-5F0D8E3D5C80/CTRIP_WIRELESS.app/CTRIP_WIRELESS for reading. [+] Reading header [+] Detecting header type [+] Executable is a FAT image - searching for right architecture [+] Correct arch is at offset 4096 in the file [+] Opening CTRIP_WIRELESS.decrypted for writing. [+] Copying the not encrypted start of the file [+] Dumping the decrypted data into the file [+] Copying the not encrypted remainder of the file [+] Setting the LC_ENCRYPTION_INFO->cryptid to 0 at offset 1a78 [+] Closing original file [+] Closing dump file
danimato-iPad:/tmp root# otool -l /private/var/tmp/CTRIP_WIRELESS.decrypted | grep cryptid cryptid 0
参考：
标签：
原文地址：http://www.cnblogs.com/dependence/p/4462921.html
