所以,如果你想看看我是如何为越狱的 iOS 做的(而不是非常无聊的“不可能”):我基本上挂钩了 safari 以访问页面完成加载时调用的特定方法。使用 MobileSubstrate(注入动态库时过滤 com.apple.mobilesafari):
#import <substrate.h>
#import <UIKit/UIKit.h>
/* Some globals */
static IMP _orig_1, _orig_2;
static id tabController;
id _mod_1(id __self, SEL __cmd, CGRect frame, id tabDocument);
void _mod_2(id __self, SEL __cmd, id doc, BOOL error);
/* The library constructor */
__attribute__((constructor))
static void init()
{
Class tabClass;
tabClass = objc_getClass("TabController");
MSHookMessageEx(tabClass, @selector(initWithFrame:tabDocument:),
(IMP)_mod_1, &_orig_1);
MSHookMessageEx(tabClass, @selector(tabDocument:didFinishLoadingWithError:),
(IMP)_mod_2, &_orig_2);
}
/* This hook merely captures the TabController of Safari. */
id _mod_1(id __self, SEL __cmd, CGRect frame, id tabDocument)
{
__self = _orig_1(__self, __cmd, frame, tabDocument);
tabController = __self;
return __self;
}
/* This is called when the page loading is done */
void _mod_2(id __self, SEL __cmd, id doc, BOOL error)
{
/* Make sure you always call the original method */
_orig_2(__self, __cmd, doc, error);
/* then do what you want */
}