|
| 1 | +#include <unistd.h> |
| 2 | +#include <xpc/xpc.h> |
| 3 | +#include <dlfcn.h> |
| 4 | +#include <sys/utsname.h> |
| 5 | + |
| 6 | +int main() { |
| 7 | + |
| 8 | + // 1. 获取系统版本 |
| 9 | + struct utsname uts; |
| 10 | + uname(&uts); |
| 11 | + |
| 12 | + // 2. Unlink MemoryMaintenance 的 state 文件 必要步骤,否则不会重启 |
| 13 | + // iOS 15及以上系统的mmaintenanced和iOS 15以下的位置不同，所以必须区分 |
| 14 | + if (atoi(uts.release) >= 21) { |
| 15 | + unlink("/private/var/mobile/Library/MemoryMaintenance/mmaintenanced"); |
| 16 | + } else { |
| 17 | + unlink("/private/var/db/mmaintenanced"); |
| 18 | + } |
| 19 | + |
| 20 | + |
| 21 | + // 3. 因为直接XPC编译器不让,所以动态加载 libxpc |
| 22 | + void *lib = dlopen("/usr/lib/system/libxpc.dylib", RTLD_LAZY); |
| 23 | + if (!lib) { |
| 24 | + return -1; |
| 25 | + } |
| 26 | + |
| 27 | + // 4. 动态获取函数指针 |
| 28 | + xpc_connection_t (*p_xpc_connection_create_mach_service)(const char *, dispatch_queue_t, uint64_t) = |
| 29 | + dlsym(lib, "xpc_connection_create_mach_service"); |
| 30 | + xpc_object_t (*p_xpc_dictionary_create)(const char *const *, const xpc_object_t *, size_t) = |
| 31 | + dlsym(lib, "xpc_dictionary_create"); |
| 32 | + void (*p_xpc_dictionary_set_uint64)(xpc_object_t, const char *, uint64_t) = |
| 33 | + dlsym(lib, "xpc_dictionary_set_uint64"); |
| 34 | + void (*p_xpc_connection_set_event_handler)(xpc_connection_t, xpc_handler_t) = |
| 35 | + dlsym(lib, "xpc_connection_set_event_handler"); |
| 36 | + void (*p_xpc_connection_resume)(xpc_connection_t) = |
| 37 | + dlsym(lib, "xpc_connection_resume"); |
| 38 | + xpc_object_t (*p_xpc_connection_send_message_with_reply_sync)(xpc_connection_t, xpc_object_t) = |
| 39 | + dlsym(lib, "xpc_connection_send_message_with_reply_sync"); |
| 40 | + const char *(*p_xpc_copy_description)(xpc_object_t) = |
| 41 | + dlsym(lib, "xpc_copy_description"); |
| 42 | + |
| 43 | + if (!p_xpc_connection_create_mach_service || |
| 44 | + !p_xpc_dictionary_create || |
| 45 | + !p_xpc_dictionary_set_uint64 || |
| 46 | + !p_xpc_connection_set_event_handler || |
| 47 | + !p_xpc_connection_resume || |
| 48 | + !p_xpc_connection_send_message_with_reply_sync || |
| 49 | + !p_xpc_copy_description) { |
| 50 | + |
| 51 | + dlclose(lib); |
| 52 | + return -1; |
| 53 | + } |
| 54 | + |
| 55 | + // 5.建立连接 |
| 56 | + xpc_connection_t conn = p_xpc_connection_create_mach_service("com.apple.mmaintenanced", NULL, 0); |
| 57 | + if (!conn) { |
| 58 | + dlclose(lib); |
| 59 | + return -1; |
| 60 | + } |
| 61 | + |
| 62 | + // 简单 event handler，防止崩但记录事件 |
| 63 | + p_xpc_connection_set_event_handler(conn, ^(xpc_object_t event){}); |
| 64 | + p_xpc_connection_resume(conn); |
| 65 | + |
| 66 | + // 6. 构造消息 { cmd = 5 } |
| 67 | + xpc_object_t msg = p_xpc_dictionary_create(NULL, NULL, 0); |
| 68 | + p_xpc_dictionary_set_uint64(msg, "cmd", 5); |
| 69 | + |
| 70 | + // 7. 发送消息并等待同步回复 |
| 71 | + p_xpc_connection_send_message_with_reply_sync(conn, msg); |
| 72 | + |
| 73 | + dlclose(lib); |
| 74 | + return 0; |
| 75 | +} |
0 commit comments