所以,如果你想看看我是如何为越狱的 iOS 做的(而不是非常无聊的“不可能”):我基本上挂钩了 safari 以访问页面完成加载时调用的特定方法。使用 MobileSubstrate(注入动态库时过滤 com.apple.mobilesafari):
#import <substrate.h>
#import <UIKit/UIKit.h>
/* Some globals */
static IMP _orig_1, _orig_2;
static id tabController;
id _mod_1(id __self, SEL __cmd, CGRect frame, id tabDocument);
void _mod_2(id __self, SEL __cmd, id doc, BOOL error);
/* The library constructor */
__attribute__((constructor))
static void init()
{
    Class tabClass;
    tabClass = objc_getClass("TabController");
    MSHookMessageEx(tabClass, @selector(initWithFrame:tabDocument:),    
        (IMP)_mod_1, &_orig_1);
    MSHookMessageEx(tabClass, @selector(tabDocument:didFinishLoadingWithError:),
        (IMP)_mod_2, &_orig_2);
}
/* This hook merely captures the TabController of Safari. */
id _mod_1(id __self, SEL __cmd, CGRect frame, id tabDocument)
{
    __self = _orig_1(__self, __cmd, frame, tabDocument);
    tabController = __self;
    return __self;
}
/* This is called when the page loading is done */
void _mod_2(id __self, SEL __cmd, id doc, BOOL error)
{
    /* Make sure you always call the original method */
    _orig_2(__self, __cmd, doc, error);
    /* then do what you want */
}