持续创作，加速成长！这是我参与「掘金日新计划 · 10 月更文挑战」的第29天，点击查看活动详情

前言

1. 快速找到按钮action方法

cy# [#0x17a9cad0 actionsForTarget:#0x174eb8b0  forControlEvent:64]
@["onVerifyContactOk"]

2. 代码触发button的点击事件： [btn sendActionsForControlEvents:UIControlEventTouchUpInside]；

I 找按钮的action方法（在逆向分析中的应用例子）

1.1 步骤1: 利用cy 找到对应的按钮地址

• 展开views结构: [UIWindow keyWindow].recursiveDescription().toString()

   |    |    |    |    |    |    |    |    |    |    | <WCPayOfflinePayBottomButton: 0x170bab80; baseClass = 

• 文字unicode转码

\u4e8c\u7ef4\u7801\u6536\u6b3e 进行搜索找到对应按钮

echo -e 

1.2 步骤2：寻找 点击按钮对应的执行方法

UIButton 是继承 UIControl 的，而 UIControl 的话可以通过allTargets 与 allControlEvents查看所有的对象与事件，再使用actionsForTarget:forControlEvent:从而找到触发的方法

- (nullable NSArray<NSString *> *)actionsForTarget:(nullable id)target forControlEvent:(UIControlEvents)controlEvent;    // single event. returns NSArray of NSString selector names. returns nil if none

• allTargets

cy# [#0x17a9cad0 allTargets]
[NSSet setWithArray:@[#"<WeixinContactInfoAssist: 0x174eb8b0>"]]]

• allControlEvents

cy# [#0x17a9cad0 allControlEvents]
64

• actionsForTarget: forControlEvent

cy# [#0x17a9cad0 actionsForTarget:#0x174eb8b0  forControlEvent:64]
@["onVerifyContactOk"]

• 最终确定：WeixinContactInfoAssist WeixinContactInfoAssist:

- (void)onVerifyContactOk;

1.3 进行验证方法

• objc_msgSend

            objc_msgSend(vc, @selector(initView));

• []

cy# [[[#0x170bab80 allTargets] allObjects][0] receiveMoneyBtnPress:nil]

• valueForKey

cy# [[#0x183d6e00 valueForKey:@"m_delegate"] WCPayFacingReceiveChangeToFixedAmount]

1.4 tweak code

相关code的获取,请关注公号：iOS逆向。

• cy# [#0x16b60600 _ivarDescription].toString()

 CBaseContactInfoAssist *m_oContactInfoAssist;
     CContact *m_contact;
\tm_uiVerify (unsigned long): <01000000>
\tm_contact (CContact*): <CPushContact: 0x177450d0>
\tm_oContactInfoAssist (CBaseContactInfoAssist*): <WeixinContactInfoAssist: 0x174eb8b0>     

• 书写 tweak

%hook ContactInfoViewController
- (void)viewWillAppear:(BOOL)arg1 {
%orig;


            Ivar mDelegateVar = class_getInstanceVariable(objc_getClass("ContactInfoViewController"), "m_oContactInfoAssist");
            WeixinContactInfoAssist * mDelegate = object_getIvar(self, mDelegateVar);
            [mDelegate onAction];
        Ivar mDelegateVar1 = class_getInstanceVariable(objc_getClass("ContactInfoViewController"), "m_contact");
            
}

1.5 小结

• 获取allTargets

cy# [[#0x170bab80 allTargets] allObjects][0]
#"<WCPayOfflinePayViewController: 0x1642b200>"

• 获取 actions

cy# [#0x170bab80 actionsForTarget:[[#0x170bab80 allTargets] allObjects][0] forControlEvent:[#0x170bab80 allControlEvents]]
@["receiveMoneyBtnPress:"]

• cy# [#0x189ce7e0 setHidden:0] 验证是否找对了view

II 代码触发button点击事件

2.1 UIControl

NS_CLASS_AVAILABLE_IOS(2_0) @interface UIControl : UIView


// send the action. the first method is called for the event and is a point at which you can observe or override behavior. it is called repeately by the second.
- (void)sendAction:(SEL)action to:(nullable id)target forEvent:(nullable UIEvent *)event;
- (void)sendActionsForControlEvents:(UIControlEvents)controlEvents;                        // send all actions associated with events

2.2 UIButton

NS_CLASS_AVAILABLE_IOS(2_0) @interface UIButton : UIControl <NSCoding>

2.3 iOS 代码触发button点击事件

cy# [#0x18c0ad10 sendActionsForControlEvents:UIControlEventTouchUpInside]

[btn sendActionsForControlEvents:UIControlEventTouchUpInside];

III 预备知识: UIButton到NSObject之间的继承关系

UIButton继承自UIControl，UIControl继承自UIView，UIView继承自UIResponder，UIResponder继承自最基本的类NSObject。

UIButton是一个控件，它具备“按下”等具体的动作操控，而不仅仅是一个简单的静态组件（如UILabel），从这个角度来看UIButton肯定是继承自UIControl的； UIControl继承自UIView，它将UIView的复杂的触摸事件封装成了像“Touch Down”“Editing DidBegin”“Touch Drag Enter”等具体的UIControlEvent事件，其他继承自UIControl的控件还有UISwitch、UITextField、UISlider、UISegmentedControl、UIPageControl等。

最后UIView、UIControl等都是可交互的元素，它们必然都继承自UIResponder，UIResponder继承自根类NSObject

see also

更多内容请关注 #公号：iOS逆向,只为你呈现有价值的信息，专注于移动端技术研究领域；