手把手教你给企业微信 Mac 客户端去除水印

0x01 起因

0x02 工具准备

• Hopper Disassembler demo version 的就可以，我们并不需要用到它的付费版功能

• insert_dylib 用于修改二进制，加入一个 LC_LOAD_DYLIB 的 load command，让最终的二进制在运行的时候，加载我们自己写的 framework 中的代码

• Xcode，创建 framework，编写代码

• 企业微信，2.6.1 版本

0x03 寻找入口

我觉得客户端中的逆向工程或者说“破解”，最重要的是找到对应的方法，或者说入口，找到了以后，离成功也就只有一步之遥了。

• [WEWConversation isConversationSupportWaterMark]

• +[WEWConversation isWaterMarkSupportConversation:]

• [WEWConversationService isOpenConversationWaterMark] (企业微信管理员的设置里应该有一键关闭水印之类的设置 🤔)

在逆向破解的过程中实现同一个需求往往有多种途径，发散思维，路不只一条

# 创建企业微信的调试 targer，准备调试，这一步并不会启动企业微信
lldb -w /Applications/企业微信.app/Contents/MacOS/企业微信

(lldb) b -[WEWConversation isConversationSupportWaterMark]
Breakpoint 1: no locations (pending).
WARNING:  Unable to resolve breakpoint to any actual locations.

(lldb) b -[NSObject init]
Breakpoint 2: where = libobjc.A.dylib`-[NSObject init], address = 0x000000000000b702

(lldb) breakpoint delete
About to delete all breakpoints, do you want to do that?: [Y/n] Y
All breakpoints removed. (2 breakpoints)

(lldb) run
...
CTRL + C

(lldb) b 0x00000001017fb7e6
Breakpoint 3: where = 企业微信`___lldb_unnamed_symbol145659$$企业微信, address = 0x00000001017fb7e6

⚠️ 在应用启动之前是不可以通过地址下断点的，因为在应用程序启动后，所有的地址会产生一个随机的 offset，在这之后 lldb 才能确定这个 offset 是多少，从而在正确的地址 break

(lldb) c

* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 3.1
    frame #0: 0x00000001017fb7e6 企业微信` ___lldb_unnamed_symbol145659$$企业微信
企业微信`___lldb_unnamed_symbol145659$$企业微信:
->  0x1017fb7e6 <+0>:  push   rbp
    0x1017fb7e7 <+1>:  mov    rbp, rsp
    0x1017fb7ea <+4>:  push   r15
    0x1017fb7ec <+6>:  push   r14
    0x1017fb7ee <+8>:  push   rbx
    0x1017fb7ef <+9>:  push   rax
    0x1017fb7f0 <+10>: mov    r15, rdi
    0x1017fb7f3 <+13>: mov    r14, qword ptr [rip + 0x16364a6] ; "conversationType"
Target 0: (企业微信) stopped.

x86_64 中的寄存器与函数参数的对应关系如下表，arg1arg2arg3arg4arg5arg6argxRDIRSIRDXRCXR8R9R10+

(lldb) po $rdi
<WEWConversation: 0x11f195a40>
(lldb) po (char *)$rsi
"isConversationSupportWaterMark"

(lldb) thread return 0
(lldb) c

0x04 制做 Framework

加了 use_framework! 以后，每一个 pod target 都是一个 framework，这样需要处理很多的 framework，比较麻烦，我们希望所有 pod target 最终的符号都链接到 WEWTweak.framework 中，一个 framework 解决问题

#import <Foundation/Foundation.h>
#import <objc/runtime.h>
#import <JRSwizzle/JRSwizzle.h>

@implementation NSObject (WEWTweak)

+ (void)load {
    [objc_getClass("WEWConversation")
     jr_swizzleMethod:NSSelectorFromString(@"isConversationSupportWaterMark")
     withMethod:@selector(wew_isConversationSupportWaterMark)
     error:nil];
}

- (BOOL)wew_isConversationSupportWaterMark {
    return NO;
}

@end

__attribute__((constructor)) 是一个 clang 的 attribute，被标记的 C 方法会在 +(void)load 和 main 函数之间被执行。

$ cd /Applications/企业微信.app/Contents/MacOS
$ ls
WEWTweak.framework insert_dylib       企业微信
# 给 insert_dylib 加一下可执行的权限
$ chmod +x insert_dylib
# 备份一下二进制文件
$ cp 企业微信 企业微信.bak
# 把制作好的 framework 通过 insert_dylib 植入二进制文件中
$ ./insert_dylib /Applications/企业微信.app/Contents/MacOS/WEWTweak.framework/WEWTweak 企业微信 企业微信 --all-yes

企业微信 already exists. Overwrite it? [y/n] y
LC_CODE_SIGNATURE load command found. Remove it? [y/n] y
Added LC_LOAD_DYLIB to 企业微信

之前我也曾逆向/破解过一些程序，校验二进制信息的还是头一回遇到。Good Job 企业微信团队！

$ lldb -w 企业微信

# 在 exit 上下断点
(lldb) b exit
Breakpoint 1: 3 locations.
# 启动程序
(lldb) run

(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.3
 * frame #0: 0x00007fff5d4781a7  libsystem_c.dylib` exit
  frame #1: 0x00007fff2d9498bb  AppKit` -[NSApplication terminate:]  + 1755
  frame #2: 0x000000010055a82f  企业微信` ___lldb_unnamed_symbol29576$$企业微信  + 150
  frame #3: 0x00000001004eb8ce  企业微信` ___lldb_unnamed_symbol26847$$企业微信  + 1035
  frame #4: 0x000000010054f77b  企业微信` ___lldb_unnamed_symbol29391$$企业微信  + 54

#0: -[NSApplication terminate:]
#1: +[WEWApplicationUtils terminate]
#2: -[WEWApplicationLifeCricleObserver applicationDidFinishLaunching]
#3: -[WEWApplicationDelegateWindowController applicationDidFinishLaunching:]

void -[WEWApplicationLifeCricleObserver applicationDidFinishLaunching](void * self, void * _cmd) {
    // ...
    rbx = [[NSBundle mainBundle] retain];
    r14 = [[rbx executablePath] retain];
    [rbx release];
    r15 = [NSTemporaryDirectory() retain];
    rbx = [[r15 stringByAppendingPathComponent:^ { /* block implemented at sub_1004ebb58 */ }] retain];
    [r15 release];
    rax = objc_retainAutorelease(r14);
    var_50 = rax;
    r15 = [rax UTF8String];
    rax = objc_retainAutorelease(rbx);
    var_48 = rax;
    rbx = sub_100b16d72(r15, [rax UTF8String], @"tmp_exe");
    r14 = sub_100b170c4();
    // some check...
    return;
}

#import <Foundation/Foundation.h>
#import <objc/runtime.h>
#import <JRSwizzle/JRSwizzle.h>

@implementation NSObject (WEWTweak)

+ (void)load {
    [objc_getClass("WEWConversation")
     jr_swizzleMethod:NSSelectorFromString(@"isConversationSupportWaterMark")
     withMethod:@selector(wew_isConversationSupportWaterMark)
     error:nil];

    [NSBundle jr_swizzleMethod:@selector(executablePath)
                    withMethod:@selector(wew_executablePath)
                         error:nil];
}

- (NSString *)wew_executablePath {
    return @"/Applications/企业微信.app/Contents/MacOS/企业微信.bak";
}

- (BOOL)wew_isConversationSupportWaterMark {
    return NO;
}

@end

$ ./insert_dylib /Applications/企业微信.app/Contents/MacOS/WEWTweak.framework/WEWTweak 企业微信 企业微信 --all-yes

0x05 结尾