1.下载dumpdecrypted
2.make 获取dumpdecrypted.dylib文件
3.用Cycript找出QQ的Documents目录路径
cycript -p QQ
cy# [[NSFileManager defaultManager] URLsForDirectory:NSDocumentDirectory inDomains:NSUserDomainMask][0]
得到:
#"file:///var/mobile/Containers/Data/Application/BA0352C6-AF10-40E3-AE27-4C1B8F6EF18C/Documents/"
4.把dumpdecrypted.dylib复制到刚输出的Documents目录中
/var/mobile/Containers/Data/Application/BA0352C6-AF10-40E3-AE27-4C1B8F6EF18C/Documents/
5.cd进去documents目录后执行破壳命令
DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Containers/Bundle/Application/A3766CB3-3256-4625-B4F7-4746772B5ABF/QQ.app/QQ
在本目录会出现QQ.decrypted的破壳后文件
6.使用class-dump导出头文件
class-dump -H QQ.decrypted -o headers
