最近研究了基于LLVM的混淆工具 Hikari 、中文文档 ，从编译器层面完成了代码的安全加固，可以说是非常牛了。但作者并没有实现Objective-C的方法名/类名混淆，于是想到了老办法。这个办法最大的难点在于如何提取混淆的关键字，之前都是尝试用脚本去提取关键字，方法名加前缀等等，github有不少工具、Demo，大多都不太好使。后来经大神提点，可以用Objective-C强大的运行时来处理关键字的提取。
周末抽空写了个小工具 XDSecurityDefense，实现了
- 过滤掉苹果SDK的类名、方法名
- 过滤掉setter、getter方法
- 过滤掉协议方法
- 过滤掉继承自父类的方法
/**
获取所有开发者创建的类的名称
@return 类的名称集合
*/
- (NSSet *)customClassNames {
NSMutableSet *customClassName = [NSMutableSet set];
unsigned int classNamesCount = 0;
// 用 executablePath 获取当前 app image
NSString *appImage = [NSBundle mainBundle].executablePath;
// objc_copyClassNamesForImage 获取到的是 image 下的类，直接排除了系统的类
const char **classNames = objc_copyClassNamesForImage([appImage UTF8String], &classNamesCount);
if (classNames) {
for (unsigned int i = 0; i < classNamesCount; i++) {
const char *className = classNames[i];
NSString *classNameString = [NSString stringWithUTF8String:className];
[customClassName addObject:classNameString];
}
free(classNames);
}
return customClassName;
}
/**
检查方法是否继承自父类
@param class 类
@param sel 方法名
@return 是否继承自父类
*/
- (BOOL)superClass:(Class)class respondsToSelector:(SEL)sel
{
Class supClass = class_getSuperclass(class);
BOOL bTespondsToSelector= NO;
while (supClass != nil) {
if (class_respondsToSelector(supClass,sel)) {
bTespondsToSelector = YES;
supClass = nil;
} else {
supClass = class_getSuperclass(supClass);
}
}
return bTespondsToSelector;
}
/**
获取类遵循所有协议的协议方法名
@param classNameString 类的集合
@return 方法名集合
*/
- (NSSet *)protocalMethodListWithClass:(NSString *)classNameString {
NSMutableSet *protocalMethodList = [NSMutableSet set];
Class className = NSClassFromString(classNameString);
unsigned int methodCount = 0;
__unsafe_unretained Protocol **protocolList = class_copyProtocolList(className, &methodCount);
for (int i = 0; i < methodCount; i++) {
Protocol *protocal = protocolList[i];
// const char *pName = protocol_getName(protocal);
// NSLog(@"protocol[%d] ---- %@", i, [NSString stringWithUTF8String:pName]);
unsigned int protocolMethodCount = 0;
struct objc_method_description * methodList = protocol_copyMethodDescriptionList(protocal, NO, YES, &protocolMethodCount);
for (int i = 0; i < protocolMethodCount; i++) {
struct objc_method_description method = methodList[i];
NSString *protocolMethodName = NSStringFromSelector(method.name);
[protocalMethodList addObject:protocolMethodName];
}
free(methodList);
methodList = protocol_copyMethodDescriptionList(protocal, YES, YES, &protocolMethodCount);
for (int i = 0; i < protocolMethodCount; i++) {
struct objc_method_description method = methodList[i];
NSString *protocolMethodName = NSStringFromSelector(method.name);
[protocalMethodList addObject:protocolMethodName];
}
}
free(protocolList);
return protocalMethodList;
}
使用方法 不再赘述
踩的一些坑
1.如果有用到 NSClassFromString NSSelectorFromString等方法要检查是否会出错
2.有使用NSCoding、archivedDataWithRootObject等归档操作也要注意运行时是否出错
