Skip to content

Commit

Permalink
Support [CleanShot-X-4.7.3] X86
Browse files Browse the repository at this point in the history
  • Loading branch information
marlkiller committed Jul 19, 2024
1 parent 3136bc9 commit 382cdb7
Show file tree
Hide file tree
Showing 7 changed files with 201 additions and 35 deletions.
1 change: 1 addition & 0 deletions CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ set(COMPILE_OPTION
-Wno-incompatible-pointer-types
-Wno-int-to-void-pointer-cast
-Wno-unguarded-availability-new # is only available on macOS 10.15 or newer
# -ftrivial-auto-var-init=zero
)

set(LINK_OPTION
Expand Down
31 changes: 16 additions & 15 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,22 +26,23 @@
2. Xcode|Clion 集成开发调试环境
3. 特征码搜索

| App | version | x86 | arm | Download | remark | Author |
|-----------------|---------|-----|-----|---------------------------------------------|--------------------------------------------------------------------------------------------------------------|---------------------|
| TablePlus | 6.* ||| https://tableplus.com/ | inject_bin="/Applications/TablePlus.app/Contents/Frameworks/Sparkle.framework/Versions/B/Sparkle" | |
| DevUtils | 1.* ||| https://devutils.com/ | | |
| AirBuddy | 2.* ||| https://v2.airbuddy.app/download | inject_bin="/Applications/AirBuddy.app/Contents/Frameworks/LetsMove.framework/Versions/A/LetsMove" | |
| Navicat Premium | 17.* ||| App Store | inject_bin="/Applications/Navicat Premium.app/Contents/Frameworks/EE.framework/Versions/A/EE" | QiuChenlyOpenSource |
| Paste | 4.1.3 ||| App Store | | LeeeMooo |
| Transmit | 5.* ||| https://panic.com/transmit/#download | | |
| AnyGo | 7.* ||| https://itoolab.com/gps-location-changer/ | | |
| Downie | 4.* ||| https://software.charliemonroe.net/downie/ | inject_bin="/Applications/Permute 3.app/Contents/Frameworks/Licensing.framework/Versions/A/Licensing" | |
| Permute | 3.* ||| https://software.charliemonroe.net/permute/ | inject_bin="/Applications/Downie 4.app/Contents/Frameworks/Licensing.framework/Versions/A/Licensing" | |
| ProxyMan | 5.2 ||| https://proxyman.io/ | inject_bin="/Applications/Proxyman.app/Contents/Frameworks/HexFiend.framework/Versions/A/HexFiend" | |
| Movist Pro | 2.* ||| https://movistprime.com/ | inject_bin="/Applications/Movist Pro.app/Contents/Frameworks/MediaKeyTap.framework/Versions/A/MediaKeyTap" | |
| Surge | 5.7.* ||| https://nssurge.com/ | inject_bin="/Applications/Surge.app/Contents/Frameworks/MMMarkdown.framework/Versions/A/MMMarkdown" | |
| Infuse | 7.7.* ||| App Store | inject_bin="/Applications/Infuse.app/Contents/Frameworks/Differentiator.framework/Versions/A/Differentiator" | |
| App | version | x86 | arm | Download | remark | Author |
|-----------------|---------|-----|-----|----------------------------------------------|--------------------------------------------------------------------------------------------------------------|---------------------|
| TablePlus | 6.* ||| https://tableplus.com/ | inject_bin="/Applications/TablePlus.app/Contents/Frameworks/Sparkle.framework/Versions/B/Sparkle" | |
| DevUtils | 1.* ||| https://devutils.com/ | | |
| AirBuddy | 2.* ||| https://v2.airbuddy.app/download | inject_bin="/Applications/AirBuddy.app/Contents/Frameworks/LetsMove.framework/Versions/A/LetsMove" | |
| Navicat Premium | 17.* ||| App Store | inject_bin="/Applications/Navicat Premium.app/Contents/Frameworks/EE.framework/Versions/A/EE" | QiuChenlyOpenSource |
| Paste | 4.1.3 ||| App Store | | LeeeMooo |
| Transmit | 5.* ||| https://panic.com/transmit/#download | | |
| AnyGo | 7.* ||| https://itoolab.com/gps-location-changer/ | | |
| Downie | 4.* ||| https://software.charliemonroe.net/downie/ | inject_bin="/Applications/Permute 3.app/Contents/Frameworks/Licensing.framework/Versions/A/Licensing" | |
| Permute | 3.* ||| https://software.charliemonroe.net/permute/ | inject_bin="/Applications/Downie 4.app/Contents/Frameworks/Licensing.framework/Versions/A/Licensing" | |
| ProxyMan | 5.2 ||| https://proxyman.io/ | inject_bin="/Applications/Proxyman.app/Contents/Frameworks/HexFiend.framework/Versions/A/HexFiend" | |
| Movist Pro | 2.* ||| https://movistprime.com/ | inject_bin="/Applications/Movist Pro.app/Contents/Frameworks/MediaKeyTap.framework/Versions/A/MediaKeyTap" | |
| Surge | 5.7.* ||| https://nssurge.com/ | inject_bin="/Applications/Surge.app/Contents/Frameworks/MMMarkdown.framework/Versions/A/MMMarkdown" | |
| Infuse | 7.7.* ||| App Store | inject_bin="/Applications/Infuse.app/Contents/Frameworks/Differentiator.framework/Versions/A/Differentiator" | |
| MacUpdater | 3. ||| https://www.corecode.io/macupdater/#download | inject_bin="/Applications/MacUpdater.app/Contents/Frameworks/Sparkle.framework/Versions/B/Sparkle" | |
| CleanShotX | 4. ||| https://updates.getcleanshot.com/v3/ | inject_bin="/Applications/CleanShot X.app/Contents/Frameworks/LetsMove.framework/Versions/A/LetsMove" | |

## Usage

Expand Down
4 changes: 4 additions & 0 deletions dylib_dobby_hook.xcodeproj/project.pbxproj
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
B502BD5D2BCFB35200DAD97F /* MovistProHack.m in Sources */ = {isa = PBXBuildFile; fileRef = B502BD5C2BCFB35200DAD97F /* MovistProHack.m */; };
B50E935E2BBD024F0073FEAA /* PaddleBaseHack.m in Sources */ = {isa = PBXBuildFile; fileRef = B50E935D2BBD024F0073FEAA /* PaddleBaseHack.m */; };
B53522462C2FE4D4001CA305 /* MacUpdaterHack.m in Sources */ = {isa = PBXBuildFile; fileRef = B53522452C2FE4D4001CA305 /* MacUpdaterHack.m */; };
B53F9DED2C4AA4EC00A6B32D /* CleanShotXHack.m in Sources */ = {isa = PBXBuildFile; fileRef = B53F9DEC2C4AA4EC00A6B32D /* CleanShotXHack.m */; };
B546A6582BC4F0CD0012338D /* ProxyManHack.m in Sources */ = {isa = PBXBuildFile; fileRef = B546A6572BC4F0CD0012338D /* ProxyManHack.m */; };
B55407272B653DCB005C08E6 /* NavicatPremiumHack.m in Sources */ = {isa = PBXBuildFile; fileRef = B55407262B653DCB005C08E6 /* NavicatPremiumHack.m */; };
B554D7BC2B63F2A300B7EFEA /* DevUtilsHack.m in Sources */ = {isa = PBXBuildFile; fileRef = B554D7BB2B63F2A300B7EFEA /* DevUtilsHack.m */; };
Expand Down Expand Up @@ -73,6 +74,7 @@
B502BD5C2BCFB35200DAD97F /* MovistProHack.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = MovistProHack.m; sourceTree = "<group>"; };
B50E935D2BBD024F0073FEAA /* PaddleBaseHack.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = PaddleBaseHack.m; sourceTree = "<group>"; };
B53522452C2FE4D4001CA305 /* MacUpdaterHack.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = MacUpdaterHack.m; sourceTree = "<group>"; };
B53F9DEC2C4AA4EC00A6B32D /* CleanShotXHack.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = CleanShotXHack.m; sourceTree = "<group>"; };
B546A6572BC4F0CD0012338D /* ProxyManHack.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = ProxyManHack.m; sourceTree = "<group>"; };
B55407262B653DCB005C08E6 /* NavicatPremiumHack.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = NavicatPremiumHack.m; sourceTree = "<group>"; };
B554D7BB2B63F2A300B7EFEA /* DevUtilsHack.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = DevUtilsHack.m; sourceTree = "<group>"; };
Expand Down Expand Up @@ -200,6 +202,7 @@
B546A6572BC4F0CD0012338D /* ProxyManHack.m */,
B502BD5C2BCFB35200DAD97F /* MovistProHack.m */,
B53522452C2FE4D4001CA305 /* MacUpdaterHack.m */,
B53F9DEC2C4AA4EC00A6B32D /* CleanShotXHack.m */,
);
path = apps;
sourceTree = "<group>";
Expand Down Expand Up @@ -324,6 +327,7 @@
B58160172BE88569001DDB9B /* encryp_utils.m in Sources */,
B53522462C2FE4D4001CA305 /* MacUpdaterHack.m in Sources */,
38350BF82B53F73A00DD52B3 /* dylib_dobby_hook.m in Sources */,
B53F9DED2C4AA4EC00A6B32D /* CleanShotXHack.m in Sources */,
382A25862B6918DF0083F28C /* PasteHack.m in Sources */,
B554D7BC2B63F2A300B7EFEA /* DevUtilsHack.m in Sources */,
B5F06B1D2BEF591E0079E68D /* InfuseHack.m in Sources */,
Expand Down
66 changes: 66 additions & 0 deletions dylib_dobby_hook/apps/CleanShotXHack.m
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
//
// CleanShotXHack.m
// dylib_dobby_hook
//
// Created by voidm on 2024/7/19.
//

#import <Foundation/Foundation.h>
#import "Constant.h"
#import "dobby.h"
#import "MemoryUtils.h"
#import <objc/runtime.h>
#import "HackProtocol.h"
#include <sys/ptrace.h>
#import "common_ret.h"


@interface CleanShotXHack : NSObject <HackProtocol>



@end


@implementation CleanShotXHack


- (NSString *)getAppName {
return @"pl.maketheweb.cleanshotx";
}

- (NSString *)getSupportAppVersion {
return @"4.";
}

- (BOOL)hack {

NSString *searchFilePath = [[Constant getCurrentAppPath] stringByAppendingString:@"/Contents/MacOS/CleanShot X"];
uintptr_t fileOffset =[MemoryUtils getCurrentArchFileOffset: searchFilePath];

void* showCleanShotAWC = DobbySymbolResolver(
"/Contents/Frameworks/Legit.framework/Versions/A/Legit",
"_$s5Legit0A9CleanShotC11productName03appE07website5email8delegate15updaterDelegate16cloudAPIDelegateACSS_S3SAA0aK0_pAA0a7UpdaterK0_pAA0a5CloudM0_ptcfc"
);
DobbyHook(showCleanShotAWC, ret0, nil);

#if defined(__arm64__) || defined(__aarch64__)
// TODO
NSString *checkHex = @"TODO";
#elif defined(__x86_64__)
NSString *checkHex = @"48 89 F0 49 89 FA 4C 89 CE 48 C1 EE 38 83 E6 0F 49 0F BA E1 3D 49 0F 43 F0 49 BB FF FF FF FF FF FF 00 00 49 21 F3 48 C1 E8 10 4C 39 C2";
#endif
NSArray *checkHexOffsets =[MemoryUtils searchMachineCodeOffsets:
searchFilePath
machineCode:checkHex
count:(int)1
];

intptr_t checkHexPtr = [MemoryUtils getPtrFromGlobalOffset:0 targetFunctionOffset:(uintptr_t)[checkHexOffsets[0] unsignedIntegerValue] reduceOffset:(uintptr_t)fileOffset];

DobbyHook((void *)checkHexPtr, ret1, NULL);

return YES;
}

@end
65 changes: 45 additions & 20 deletions dylib_dobby_hook/apps/DevHack.m
Original file line number Diff line number Diff line change
Expand Up @@ -164,26 +164,51 @@ + (void)draw_event:(id)sender {

- (BOOL)hack {

dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(1 * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{
// 在这里执行你的代码
NSLog(@">>>>>> 代码延迟执行了 1 秒");
NSLog(@">>>>>> 添加自定义菜单");

NSMenu *mainMenu = [NSApplication sharedApplication].mainMenu;
// 创建一个与独立的菜单项
NSMenuItem *newMenuItem = [[NSMenuItem alloc] initWithTitle:@"menu_new" action:nil keyEquivalent:@""];
NSMenuItem *subMenuItem1 = [[NSMenuItem alloc] initWithTitle:@"mem_event" action:NSSelectorFromString(@"mem_event:") keyEquivalent:@""];
[subMenuItem1 setTarget:self.class];
NSMenuItem *subMenuItem2 = [[NSMenuItem alloc] initWithTitle:@"draw_event" action:@selector(draw_event:) keyEquivalent:@""];
[subMenuItem2 setTarget:DevHack.class];
// 创建一个子菜单并将子菜单项添加进去
NSMenu *newMenu = [[NSMenu alloc] initWithTitle:@"New Menu [HOOK]"];
[newMenu addItem:subMenuItem1];
[newMenu addItem:subMenuItem2];
// 将子菜单添加到父菜单项
[newMenuItem setSubmenu:newMenu];
[mainMenu addItem:newMenuItem];
});
// 手动定时监测菜单
// dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
// while (true) {
// // 每 5 秒执行一次
// sleep(5);
// NSLog(@">>>>>> allWindows");
// // 在主线程上异步执行窗口信息获取和日志记录
// dispatch_async(dispatch_get_main_queue(), ^{
// NSArray<NSWindow *> *allWindows = [NSApplication sharedApplication].windows;
// // 遍历所有窗口,打印窗口信息
// for (NSWindow *window in allWindows) {
// NSViewController *viewController = window.contentViewController;
// NSLog(@"窗口类名: %@, 关联视图控制器: %@", NSStringFromClass([window class]), viewController ? viewController : @"无");
// }
// });
// }
// });

// -[_TtC13App_Cleaner_822BaseFeaturesController onAppDidFinishLaunching]:





// 添加菜单
// dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(1 * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{
// // 在这里执行你的代码
// NSLog(@">>>>>> 代码延迟执行了 1 秒");
// NSLog(@">>>>>> 添加自定义菜单");
//
// NSMenu *mainMenu = [NSApplication sharedApplication].mainMenu;
// // 创建一个与独立的菜单项
// NSMenuItem *newMenuItem = [[NSMenuItem alloc] initWithTitle:@"menu_new" action:nil keyEquivalent:@""];
// NSMenuItem *subMenuItem1 = [[NSMenuItem alloc] initWithTitle:@"mem_event" action:NSSelectorFromString(@"mem_event:") keyEquivalent:@""];
// [subMenuItem1 setTarget:self.class];
// NSMenuItem *subMenuItem2 = [[NSMenuItem alloc] initWithTitle:@"draw_event" action:@selector(draw_event:) keyEquivalent:@""];
// [subMenuItem2 setTarget:DevHack.class];
// // 创建一个子菜单并将子菜单项添加进去
// NSMenu *newMenu = [[NSMenu alloc] initWithTitle:@"New Menu [HOOK]"];
// [newMenu addItem:subMenuItem1];
// [newMenu addItem:subMenuItem2];
// // 将子菜单添加到父菜单项
// [newMenuItem setSubmenu:newMenu];
// [mainMenu addItem:newMenuItem];
// });


// Class WinControllerClass = NSClassFromString(@"mac_app_dev_swift.ViewController");
Expand Down
68 changes: 68 additions & 0 deletions dylib_dobby_hook/apps/NavicatPremiumHack.m
Original file line number Diff line number Diff line change
Expand Up @@ -167,6 +167,54 @@ - (void)hk_displayRegisteredInfo {
// [mutableDict setObject:@"organization" forKey:@"organization"];
// *deviceIdPtr = mutableDict;
// }


// 指针转换 (void *)
// id object = self;
// NSString *user = *(NSString __strong **)((__bridge void *)object + 0x60);
// NSString *newUser = @"";
// *(NSString __strong **)((__bridge void *)object + 0x60) = newUser;


// 指针转换 (&)
// id object = self;
// NSString *user = *(NSString __strong **)(&object + 0x60);
// NSString *newUser = @"";
// *(NSString __strong **)((&object) + 0x60) = newUser;



// 指针转换 (uintptr_t)
// id object = self;
// NSString *user = *(NSString __strong **)(((void *)(uintptr_t)object) + 0x60);
// NSString *newUser = @"";
// *(NSString __strong **)(((void *)(uintptr_t)object) + 0x60) = newUser;

// 读写 id 类型
// id user = *(id __strong *)((__bridge void *)object + 0x60);
// id c = *(id __strong *)(&object + 0x60);
// id newC = @"";
// *(id __strong *)(&object + 0x60) = newC;


// 读写 int 属性对象
// int intValue = *(int *)((__bridge void *)object + 0x30);
// *(int *)((__bridge void *)object + 0x30) = 123;


// 读写 NSString 属性对象
// NSString __strong **propertyPtr = (NSString __strong **)(&object + 0x60);
// *propertyPtr = @"1";
// NSString *propertyA = *propertyPtr = @"1";


// demo
// std::string str = "123";
// std::string *ptr = &str;
//
// uintptr_t address = reinterpret_cast<uintptr_t>(ptr);
// void * address2 = (void *)ptr;
// void * address3 = &str;

((void(*)(id, SEL))displayRegisteredInfoIMP)(self, _cmd);

Expand All @@ -182,5 +230,25 @@ - (void)hk_displayRegisteredInfo {
[_appExtraInfoLabel setStringValue:[Constant G_EMAIL_ADDRESS]];

}
// id BaseFeaturesController = self;
//
//// r14 = *(r13 + *objc_ivar_offset__TtC13App_Cleaner_822BaseFeaturesController_licenseManager);
// id NKLicenseManager = *(id __strong *)((__bridge void *)BaseFeaturesController + 0x8);
//
//// r14 = *(rbx + 0x28);
//// r15 = r14 + 0x20;
// id LicenseStateStorage = *(id __strong *)((__bridge void *)NKLicenseManager + 0x28);
// id TtC16NKLicenseManager19LicenseStateStorage_serialKey = *(id __strong *)((__bridge void *)LicenseStateStorage + 0x20);
// if (!TtC16NKLicenseManager19LicenseStateStorage_serialKey) {
//
//
//// *(id __strong *)((__bridge void *)LicenseStateStorage + 0x20) = @"123456";
// Ivar serialKeyIvar = class_getInstanceVariable([LicenseStateStorage class], "serialKey");
// const char *ivarTypeEncoding = ivar_getTypeEncoding(serialKeyIvar);
// NSString *ivarType = [NSString stringWithUTF8String:ivarTypeEncoding];
// id currentValue = object_getIvar(LicenseStateStorage, serialKeyIvar);
// object_setIvar(LicenseStateStorage, serialKeyIvar, @"2222222222");
// *(int *)((__bridge void *)LicenseStateStorage + 0x28) = 1;
// }
}
@end
1 change: 1 addition & 0 deletions script/auto_hack.sh
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,7 @@ hack_app "Movist Pro" "/Applications/Movist Pro.app/Contents/Frameworks/MediaKey
hack_app "AirBuddy" "/Applications/AirBuddy.app/Contents/Frameworks/LetsMove.framework/Versions/A/LetsMove"
hack_app "Infuse" "/Applications/Infuse.app/Contents/Frameworks/Differentiator.framework/Versions/A/Differentiator"
hack_app "MacUpdater" "/Applications/MacUpdater.app/Contents/Frameworks/Sparkle.framework/Versions/B/Sparkle"
hack_app "CleanShot X" "/Applications/CleanShot X.app/Contents/Frameworks/LetsMove.framework/Versions/A/LetsMove"



Expand Down

0 comments on commit 382cdb7

Please sign in to comment.