前言
逆向分析WVWebView的重要突破口:
通过代码分析jsBridgeCallHistory,即js调用app的方法历史:
- (id)getMainFrame{
%log();
NSLog(@"jsBridgeCallHistory %@:",[self jsBridgeCallHistory]);
return %orig;
}
Oct 24 11:51:27 iPhone Moon[982] <Notice>: [taokeSearchTweak] Tweak.xm:255 DEBUG: -[<WVWebView: 0x1a9f7f30> getMainFrame]
Oct 24 11:51:27 iPhone Moon[982] <Notice>: [taokeSearchTweak] Tweak.xm:195 DEBUG: -[<WVWebView: 0x1a9f7f30> jsBridgeCallHistory]
Oct 24 11:51:27 iPhone Moon[982] <Warning>: jsBridgeCallHistory {
"MtopWVPlugin.send" = 1;
"WVTBUserTrack.toUT" = 1;
}:
@property(readonly, nonatomic) NSDictionary *jsBridgeCallHistory;
其中包含了调用历史,从这个地方入手,找到字典中的对象以及方法包括:
MoonJSBridge.openWebView
@interface MoonJSBridge : WVDynamicHandler
{
}
+ (void)openWebView:(id)arg1 withCallback:(CDUnknownBlockType)arg2 withWebView:(id)arg3 withViewController:(id)arg4;
MtopWVPlugin.send
@interface MtopWVPlugin : WVDynamicHandler
- (void)pending:(id)arg1 request:(id)arg2 delegate:(id)arg3;
- (void)send:(id)arg1 withCallback:(CDUnknownBlockType)arg2 withWebView:(id)arg3 withViewController:(id)arg4;
WVTBUserTrack.toUT
@interface WVTBUserTrack : WVDynamicHandler
{
}
+ (void)toUT:(id)arg1 withCallback:(CDUnknownBlockType)arg2 withWebView:(id)arg3 withViewController:(id)arg4;
进一步分析
TBSDKMTOPServer ApiRequestDelegateImpl、MtopWVPlugin、ApiRequest 进行分析
结论
调用 MtopWVPlugin.send 的时候会创建ApiRequestDelegateImpl.initWithRequest 并回调到requestSuccess
总结
%hook WVWebView
- (NSDictionary *)jsBridgeCallHistory{
%log();
return %orig;
}
- (id)getMainFrame{
%log();
NSLog(@"jsBridgeCallHistory %@:",[self jsBridgeCallHistory]);
return %orig;
}
- (void)dealloc{
%log();
// NSDictionary *tmp =[self jsBridgeCallHistory];
// NSLog(@"jsBridgeCallHistory %@:",tmp);
return %orig;
}
- (void)setTitle:(id)arg1{
%log();
[self openJSBridgeLog];
return %orig;
}
%end