How to analyze iOS Application to make tweaks in theos

Question

I'm tring to make tweak in Theos.
Thanks to many good tutorials, I am now able to make some simple tweak by myself.
But it doesn't always go well.

To make tweak, first I need to use utility called "class dump" to get application headers.
Second, by search and browse headers I have to guess which class I should hook.
Third, write code and make package.

I can't do second step well.
To guess how app works, I used logo(%orig, %log) in test tweak and 'syslog to /var/log/syslog'.
For example,
if there is following class header:

@interface SampleClass
- (id)methodA:(int)Arg;
.
.
@end

I write following code to make test tweak:

%hook SampleClass
- (id)methodA:(int)Arg {
    %log;
    NSLog(@"return Class is %@", NSStringFromClass([%orig class]);
    NSLog(@"Argument value is %d", Arg);
}
%end

In this way, I could recognize return Class and Arguments by test tweak.

But, I can't know what is done in 'methodA' perfectly.
Concretely, I want to know what kind of original code is written , and what method calls what method.

Is there any idea to know them??

Answer 1

As you want to hook in to private APIs. And as we know that there is no any document available for private APIs. You can come to know about that methods only by doing TRIAL and ERROR Method, or you can get somewhat help by some blogs people have wrote on that private APIs.

The whole idea totally depends on what thing you want to do. If you specify any specific method or class in which you want to hook in. I may help you, i have worked on too many private apis, it may become helpful to you.

Answer 2

Well I would suggest using some reverse engineering tools on the app you want to analyze, probably a dissasembler. Here is a list with some of them http://iphonedevwiki.net/index.php/Reverse_Engineering_Tools

I personally tried Hopper a bit but it is still hard to understand the code. Probably IDA is better at this, but did not had the chance to try it yet.

Also I saw some projects which try to hook obj_msgSend and this way to log all objective-c calls, but did not found a functional one yet. one example is https://github.com/emeau/itrace but you can search more of these on your own. If you find a functional one let me know

UPDATE Check out Snoop-it, it might me exaclty what you need