iOS 简书app去广告

简书App不错，但是广告太烦人，动手把广告屏蔽掉

分析 简书 6.2.0

由于广告是开屏弹出的，所以大致猜测在 application:didFinishLaunchingWithOptions: 中加载，找到代理类 HGAppDelegate ，发现其重写了 [HGAppDelegate load]，
替换了两个oc方法，所以需要分析 swizzled_application:didFinishLaunchingWithOptions: 中执行过程。

1
2
objc_msgSend(HGAppDelegate,"exchangeSelector:withSwizzledSelector:","application:didFinishLaunchingWithOptions:"，"swizzled_application:didFinishLaunchingWithOptions:");
objc_msgSend(HGAppDelegate,"exchangeSelector:withSwizzledSelector:","applicationWillResignActive:","swizzled_applicationWillResignActive:");

发现执行了 [HGAppConfiguration setupPreloadItems] 方法 ，在内部看到 [Hugo.ThirdPartyADManager fetchFlowAD] 方法 ，通过搜索 fetchFlowAD 发现多个 ADProvider。通过frida 查看调用的API,hook 掉即可。。。。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

%hook _TtC4Hugo19ThirdPartyADManager
-(void)fetchFlowAD
{
    
}
-(void)showBannerAdViewFrom:(id)a1 margin:(double)a2 superView:(id)a3 closeHandler:(id)a4
{
}

-(BOOL)isShowMyBannerAD
{
    return NO;
}
%end

%hook _TtC4Hugo17ToutiaoADProvider
-(void)showBannerAdViewFrom:(id)a1 margin:(double)a2 superView:(id)a3 resultHandler:(id)a4 closeHandler:(id)a5
{
    
}
%end

%hook _TtC4Hugo13GDTADProvider
-(void)showBannerAdViewFrom:(id)a1 margin:(double)a2 superView:(id)a3 resultHandler:(id)a4 closeHandler:(id)a5
{
    
}
%end

%hook HGMyPageTableViewController
-(void)showBannerAdView
{

}
-(void)fetchBannerAD
{

}
-(BOOL)isClosedOfBannerAdView
{
    return YES;
}

%end

%hook GDTUnifiedBannerView
-(void)loadAdAndShow
{
}
%end

其中 有意思的是 “Hugo.MifuADProvider” 这类类名 可以通过 “_TtC4Hugo19ThirdPartyADManager” hook，并且在越狱设备上直接动态注入插件不起作用，但是通过注入后重签名，安装在未越狱设备上时是有效的。