#### at the end of the year (clearly 17 early 😓), also summed up their own see, learn about the reverse knowledge system, welcome everyone to supplement and correct
####1. There are usually six ways to attack an app
1. Static analysis
2. Dynamic debugging
3. Dynamic injection
4. Man-in-the-middle attack
5. Resource tampering
6. The signature
Copy the code#####1.1: Static analysis
1.hopper
2.ida
3.class-dump
Copy the code#####1.2: Dynamic debugging
1.LLDB
2.Cycript
3.introspy
Copy the code#####1.3: Dynamic injection
1. Tweak injection
2. Dylid injection in a non-jailbreak environment
3. Fishook and Method Swizzling
Copy the code#####1.4: Man-in-the-middle attack
1. Middleman agency
Copy the code#####1.5: Resource tampering
1. Replace the Mach - O
2. Replace resource images, videos, and audio
Copy the code# # # # # 1.6: signature
1. The codesign signature
Copy the code####2. Defense scheme for each attack #####2.1: Static analysis defense
1. Analysis against Hopper and IDA can modify some offsets of macho files to make hopper and IDA unable to analyze and cause flash backoff
2. Against class-dump and tool analysis, method names and class names can be confused
1. Replace macro definitions in batches with scripts before compilation
2.LLVM confusion (no)
3. The Mach - O__objc_classnamehe __objc_methname
3. Logic confusion (flowery instructions)
Copy the code#####2.2: Dynamic analysis defense
1. Ptrace, the syscall sysctl, dlsym, etc
2. Cycript protection will not be implemented yet
3. Neither does introspy
Copy the code#####2.3: Dynamic injection protection
1.__RESTRICT associates the main function
2. Dladdr checks the memory space of the function to verify that the pointer to the function is from the program, apple library, or unknown.
Copy the code#####2.4: Man-in-the-middle attack defense
1. Using HTTPS
2. Transfer data encryption
Copy the code#####2.5: Resource tamper prevention
1. Encrypt the resource and compare the value with the value before compilation
Copy the code#####2.6: Resignature defense
1. Obtain the signature information of the current signature file and compare it with the signature information before compilation
Copy the code####3. Some precautions
1. Make the call inline
2. Preferably in C or C++
Copy the code####4. There is no crack can not open the program, is to see the time cost is not worth to hard gang (anus), welcome to give me some valuable opinions and plans I will always maintain this article, has been updated, I hope you add more
Copy the code