使用lldb和Hopper破解Reveal的试用限制

本文仅供学习和交流，如有侵权或不妥，请联系我删除

之前写了篇lldb联机调试的文章，恰好Reveal的试用到期了，于是拿来练练手。本文参考了“[原创]破解Reveal购买提示框”，但是去掉了“Free trial has ended” ：），并假设你已经了解了一些lldb的基本调试命令

首先用Hopper分析Reveal源程序，搜索关键字trial，首先发现了IBATrialModeReminderPresenter

用lldb调试下，断点在图中内存地址中

(lldb) target create "/Applications/Reveal.app"
Current executable set to '/Applications/Reveal.app' (x86_64).
(lldb) b -a 0000000100094180
Breakpoint 1: address = 0x0000000100094180
(lldb) r
Process 4255 launched: '/Applications/Reveal.app/Contents/MacOS/Reveal' (x86_64)
2014-10-20 19:40:37.548 Reveal[4255:d0b] Unknown class          IBAViewHierarchyCanvasSharingMenu in Interface Builder file at path /Applications/  Reveal.app/Contents/Resources/en.lproj/MainMenu.nib.
2014-10-20 19:40:37.554 Reveal[4255:d0b]  INFO: Log Level Enabled
2014-10-20 19:40:37.554 Reveal[4255:d0b]  WARN: Log Level Enabled
2014-10-20 19:40:37.554 Reveal[4255:d0b] ERROR: Log Level Enabled
2014-10-20 19:40:37.574 Reveal[4255:d0b]  INFO: Reveal Automatic Updates are    enabled!
2014-10-20 19:40:37.862 Reveal[4255:d0b] [HockeySDK] WARNING: Detecting crashes is  NOT enabled due to running the app with a debugger attached.
2014-10-20 19:40:37.863 Reveal[4255:d0b]  INFO: Reveal Crash Reporting is enabled!
Process 4255 stopped
* thread #1: tid = 0x3abbf, 0x0000000100094180  Reveal`___lldb_unnamed_function3544$$Reveal, queue = 'com.apple.main-thread', stop reason   = breakpoint 1.1
    frame #0: 0x0000000100094180 Reveal`___lldb_unnamed_function3544$$Reveal
Reveal`___lldb_unnamed_function3544$$Reveal:
-> 0x100094180:  pushq  %rbp
   0x100094181:  movq   %rsp, %rbp
   0x100094184:  leaq   0xa05c5(%rip), %rsi       ; { /usr/lib/ libobjc.A.dylib`objc_msgSend_fixedup, "alloc" }
   0x10009418b:  callq  *0xa05bf(%rip)            ; { /usr/lib/ libobjc.A.dylib`objc_msgSend_fixedup, "alloc" }

至此Reveal启动，并进入了断点，si和ni都是一步步调试，直接finish单步跳出，第一次的内存地址100095f96中没什么太有用的信息，但是所在的类是IBATrialModReminderPresenter中，说明我们很进了…

(lldb) finish
Process 4255 stopped
* thread #1: tid = 0x3abbf, 0x0000000100095f96  Reveal`___lldb_unnamed_function3586$$Reveal + 94, queue = 'com.apple.main-thread', stop     reason = step out
    frame #0: 0x0000000100095f96 Reveal`___lldb_unnamed_function3586$$Reveal + 94
Reveal`___lldb_unnamed_function3586$$Reveal + 94:
-> 0x100095f96:  movq   %rbx, %r13
   0x100095f99:  movq   %rax, %rdi
   0x100095f9c:  callq  0x1000a0596               ; symbol stub for:    objc_retainAutoreleasedReturnValue
   0x100095fa1:  movq   0x67400(%rip), %r15       ; (void *)0x00007fff8f6d10d0:     objc_release
(lldb) finish
Process 4255 stopped
* thread #1: tid = 0x3abbf, 0x000000010009614e  Reveal`___lldb_unnamed_function3588$$Reveal + 66, queue = 'com.apple.main-thread', stop     reason = step out
    frame #0: 0x000000010009614e Reveal`___lldb_unnamed_function3588$$Reveal + 66
Reveal`___lldb_unnamed_function3588$$Reveal + 66:
-> 0x10009614e:  movq   %r14, %rdi
   0x100096151:  popq   %rbx
   0x100096152:  popq   %r14
   0x100096154:  popq   %rbp

再次finish，查看内存地址10009614e，这次发现了关键方法@selector(shouldShowTrialModeSheet)：