ios 如何反编译iOS应用程序？

How to decompile iOS apps?

提问by ahmadhhh

I want to see the code of an iOS app.

我想查看一个 iOS 应用程序的代码。

The app I downloaded is .deb.

我下载的应用程序是.deb。

First question: Is it possible to install .deb file on iOS or I downloaded a wrong file?

第一个问题：是否可以在 iOS 上安装 .deb 文件或者我下载了错误的文件？

After unpacking the .deb file, I got some files, including .nib, .storyboard and some other files.

解压.deb 文件后，我得到了一些文件，包括.nib、.storyboard 和其他一些文件。

My main questionis, How to decompile these .nib files?

我的主要问题是，如何反编译这些 .nib 文件？

I tried to decompile these files using NibToXibConverter, but I didn't succeed.

我尝试使用 NibToXibConverter 反编译这些文件，但没有成功。

回答by Stoyan

Answer to your first question:

回答你的第一个问题：

I think you downloaded the wrong file. .debfiles for iOS are common for jailbreak community and not for apps, I think all of the Cydia stuffs are packed into .deb's. If your app is especially made for the jailbreak scene then you may try to install it using Cydia's auto install featureon a jailbroken device.

我想你下载了错误的文件。.deb适用于 iOS 的文件对于越狱社区而不是应用程序很常见，我认为所有 Cydia 的东西都打包到.deb. 如果您的应用程序是专门为越狱场景制作的，那么您可以尝试在越狱设备上使用Cydia 的自动安装功能安装它。

Answer to your main question:

回答你的主要问题：

^{This is general info about decompiling and modifying iOS apps (not specific for nibs, but you may still find it useful).}

^{这是有关反编译和修改 iOS 应用程序的一般信息（并非特定于笔尖，但您可能仍然会发现它很有用）。}

iOS apps are distibuted in .ipaarchives, which are ordinary zip archives. They contain, usually one executable in the form of Mach-O file, and resources like .plist, sounds, images - every resource you include in your xcode project. Decompiling the executable file is only possible on jailbroken iDevice, because it is encrypted especially for the current device and the magic key to decrypt the binary is burned inside the device CPU and as far as I know there is no software way to read that key. The encryption system here is called FairPlay.

iOS 应用程序分布在.ipa档案中，这些档案是普通的 zip 档案。它们通常包含一个 Mach-O 文件形式的可执行文件，以及诸如.plist声音、图像之类的资源 - 您在 xcode 项目中包含的每一种资源。反编译可执行文件只能在越狱的 iDevice 上进行，因为它特别针对当前设备进行了加密，并且解密二进制文件的魔法密钥在设备 CPU 内被烧毁，据我所知，没有软件方法可以读取该密钥。这里的加密系统称为FairPlay。

Briefly described, one way to decrypt that binary is to have the app installed on a jailbroken device, and launch it from command line using a debugger (gdb) which you can download from Cydia. You have to set a breakpoint somewhere, and when your code execution pauses at the breakpoint, you are doing a memory dump of the device ram - and that is your decrypted bin.

简而言之，解密该二进制文件的一种方法是将应用程序安装在越狱设备上，然后使用可以从 Cydia 下载的调试器 (gdb) 从命令行启动它。你必须在某处设置一个断点，当你的代码执行在断点处暂停时，你正在对设备 ram 进行内存转储——这就是你的解密 bin。

So when you have the decrypted binary, you can run one tool called "class-dump", and get the information for declared classes and their methods if the app is written in Objective C. Once you know this information you can alter the implementation of given method from some class used in your app using "Cydia Subtstrate" a.k.a "Mobile Substrate". In fact that is the way all of the jailbroken iOS tweaks are made. Basically you are hooking a method call, and when that method get invoked, it uses your implementation. Furthermore your implementation can call the original implementation, and that is really useful if you want to make some small code addition.

因此，当您拥有解密的二进制文件时，您可以运行一个名为“class-dump”的工具，如果应用程序是用 Objective C 编写的，则可以获取声明的类及其方法的信息。一旦您知道这些信息，您就可以更改使用“Cydia Subtstrate”又名“Mobile Substrate”在您的应用程序中使用的某个类中的给定方法。事实上，这就是所有越狱 iOS 调整的方式。基本上，您正在挂钩一个方法调用，并且当该方法被调用时，它会使用您的实现。此外，您的实现可以调用原始实现，如果您想添加一些小的代码，这非常有用。

I am not sure whether those things possible in Swift, but if you are dealing with a Hybrid app like the ones done with cordova, phonegap, etc., then you can see all of its javascript source because it is persisted as a resource inside the "ipa" file. In addition you can alter that javascript code directly if you have a jailbroken device and find where the app is installed on file system (usually /var/containers/Bundle/Application/uuid_for_your_app/). However, I think there is no way to get that patched version and redistribute it (correct me if I'm wrong).

我不确定这些事情在 Swift 中是否可行，但是如果您正在处理一个混合应用程序，例如使用cordova、phonegap 等完成的应用程序，那么您可以看到它的所有 javascript 源代码，因为它作为资源持久存在于“ipa”文件。此外，如果您有越狱设备并找到应用程序在文件系统上的安装位置（通常为/var/containers/Bundle/Application/uuid_for_your_app/），则可以直接更改该 javascript 代码。但是，我认为没有办法获得该修补版本并重新分发它（如果我错了，请纠正我）。