iOS越狱:去除腾讯视频的播放广告

1.使用reveal查看播放页面的UI布局,查找播放广告的View.(找到QNBPlayerVideoAdsView)

ads.jpeg

2.查看QNBPlayerVideoAdsView的头文件

#import "QNBPlayerIntellectView.h"

@class UIButton;

@interface QNBPlayerVideoAdsView : QNBPlayerIntellectView
{
    id <QNBPlayerVideoAdsViewDelegate> _delegate;
    QNBPlayerIntellectView *_videoAdsView;
    UIButton *_backButton;
}

@property(retain, nonatomic) UIButton *backButton; // @synthesize backButton=_backButton;
@property(retain, nonatomic) QNBPlayerIntellectView *videoAdsView; // @synthesize videoAdsView=_videoAdsView;
@property(nonatomic) __weak id <QNBPlayerVideoAdsViewDelegate> delegate; // @synthesize delegate=_delegate;
- (void).cxx_destruct;
- (void)backBtnClicked:(id)arg1;
- (void)showAdsBackButton:(_Bool)arg1;
- (id)videoAdsSuperView;
- (void)layoutSubviews;
- (id)initWithFrame:(struct CGRect)arg1;

@end

3.尝试使这个view为nil

- (id)initWithFrame:(struct CGRect)arg1{
    return nil;
}

4.使用theos重新编译打包,发现点击vip视频闪退

5.使用cydia移除这个插件,使用reveal再次查找有关信息

查到QNBPlayerVideoAdsView所在控制器为QNBPlayerVideoAdsViewController

controller.png

查看控制器QNBPlayerVideoAdsViewController头文件相关信息

#import "QNBBasePlayerViewController.h"

#import "QNBPlayerVideoAdsViewDelegate.h"

@class NSString, UIView;

@interface QNBPlayerVideoAdsViewController : QNBBasePlayerViewController <QNBPlayerVideoAdsViewDelegate>
{
    _Bool _adsStartPlay;
    UIView *_adTimeCountView;
}

@property(nonatomic) _Bool adsStartPlay; // @synthesize adsStartPlay=_adsStartPlay;
@property(retain, nonatomic) UIView *adTimeCountView; // @synthesize adTimeCountView=_adTimeCountView;
- (void).cxx_destruct;
- (_Bool)didReceivePageLoadQNBVideoInfo:(id)arg1;
- (_Bool)didReceiveStop:(id)arg1;
- (_Bool)didReceiveRequestShowADCountView:(id)arg1;
- (_Bool)didReceiveADStateChange:(id)arg1;
- (_Bool)didReceiveUITipsBarStateChange:(id)arg1;
- (_Bool)didReceivePluginNetworkReachabilityChange:(id)arg1;
- (_Bool)didReceivePlayerStateChange:(id)arg1;
- (_Bool)didReceiveUIScreenModeChange:(id)arg1;
- (_Bool)didReceiveAdsPlayStateChange:(id)arg1;
- (void)hideADTimeCountView;
- (void)showADTimeCountView;
- (double)playerSafeAreaHorizonPadding;
- (void)backBtnClicked:(id)arg1;
- (void)showAdsView;
- (void)updateBackButton;
- (id)videoAdsSuperView;
- (void)viewDidLoad;
- (id)rootView;
- (void)viewWillAppear:(_Bool)arg1;
- (void)viewWillLayoutSubviews;
- (void)loadView;

// Remaining properties
@property(readonly, copy) NSString *debugDescription;
@property(readonly, copy) NSString *description;
@property(readonly) unsigned long long hash;
@property(readonly) Class superclass;

@end

6.分析这个控制器,发现这个控制器名称是带有ads的控制器,猜测播放广告的控制器和播放视频的控制器是分开的,尝试在init方法返回nil;发现此类没有init初始化方法,查看父类QNBBasePlayerViewController

#import "UIViewController.h"

#import "QNBBasePlayerViewControllerEventDelegate.h"
#import "QNBEventDelegate.h"

@class NSMutableArray, NSObject<QNBEventProxy>, NSString, QNBPlayerInfo;

@interface QNBBasePlayerViewController : UIViewController <QNBEventDelegate, QNBBasePlayerViewControllerEventDelegate>
{
    _Bool _alreadyAddToParent;
    QNBPlayerInfo *_playerInfo;
    QNBBasePlayerViewController *_parentEventController;
    UIViewController *_parentUIController;
    UIViewController *_pageViewController;
    NSMutableArray *_childEventControllers;
    SEL _interceptReceiveSEL;
    NSObject<QNBEventProxy> *_proxy;
}

@property(nonatomic) _Bool alreadyAddToParent; // @synthesize alreadyAddToParent=_alreadyAddToParent;
@property(nonatomic) __weak NSObject<QNBEventProxy> *proxy; // @synthesize proxy=_proxy;
@property(nonatomic) SEL interceptReceiveSEL; // @synthesize interceptReceiveSEL=_interceptReceiveSEL;
@property(retain, nonatomic) NSMutableArray *childEventControllers; // @synthesize childEventControllers=_childEventControllers;
@property(nonatomic) __weak UIViewController *pageViewController; // @synthesize pageViewController=_pageViewController;
@property(nonatomic) __weak UIViewController *parentUIController; // @synthesize parentUIController=_parentUIController;
@property(nonatomic) __weak QNBBasePlayerViewController *parentEventController; // @synthesize parentEventController=_parentEventController;
@property(nonatomic) __weak QNBPlayerInfo *playerInfo; // @synthesize playerInfo=_playerInfo;
- (void).cxx_destruct;
- (void)excuteEvent:(id)arg1 forEventNode:(id)arg2;
- (id)didReceivePlayerEventInUI:(id)arg1;
- (void)shouldSetConstraintsForViews;
- (void)shouldSetupViews;
- (void)addChildEventController:(id)arg1;
- (void)addToParentViewController;
- (void)viewDidLayoutSubviews;
- (id)eventProxy;
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3 withPageViewController:(id)arg4 withAddToParenViewControllerNow:(_Bool)arg5;
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3 withParentEventViewController:(id)arg4 withAddToParenViewControllerNow:(_Bool)arg5;
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3 withAddToParenViewControllerNow:(_Bool)arg4;
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3 withParentEventViewController:(id)arg4;
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3;

// Remaining properties
@property(readonly, copy) NSString *debugDescription;
@property(readonly, copy) NSString *description;
@property(readonly) unsigned long long hash;
@property(readonly) Class superclass;![ads.jpeg](https://upload-images.jianshu.io/upload_images/987457-05a76618e9d0b86c.jpeg?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)

@end

7.发现有5个init开头方法,编写去除QNBPlayerVideoAdsViewController控制器的代码

%hook QNBPlayerVideoAdsViewController

- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3 withPageViewController:(id)arg4 withAddToParenViewControllerNow:(_Bool)arg5{
    return nil;
}
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3 withParentEventViewController:(id)arg4 withAddToParenViewControllerNow:(_Bool)arg5{
    return nil;
}
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3 withAddToParenViewControllerNow:(_Bool)arg4{
    return nil;
}
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3 withParentEventViewController:(id)arg4{
    return nil;
}
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3{
    return nil;
}
%end

结果发现广告页面是没有显示出来,但是还是广告的声音却仍然在播放;播放按钮无法点击,进度条也无法快进,播放下一集的按钮全屏以及其他按钮都可以用,广告控制器都置为nil了,谁在播放广告声音呢?

8.再次查看Reveal, QNBPlayerImageAdsViewController

QLVideoDetailViewController猜测应该是真正视屏内容播放器

经过多次尝试,终于找到播放广告声音的控制器TADVideoAdController

%hook TADVideoAdController
- (id)init{
    return nil;
}
%end

这样就完美实现了去除广告

label.png

去除vip首月12元标签

%hook QNBPlayerSimpleIAPButton
- (id)initWithFrame:(struct CGRect)arg1{
    return nil;
}
%end

完整去除启动页和播放视屏页广告代码如下

@interface DXClass
- (void)hideSplash;
- (void)endReadTimeCount;
@end

%hook TADSplashWindow

- (void)showSplash{
    [self hideSplash];
}
%end

%hook QNBPlayerVideoAdsViewController

- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3 withPageViewController:(id)arg4 withAddToParenViewControllerNow:(_Bool)arg5{
    return nil;
}
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3 withParentEventViewController:(id)arg4 withAddToParenViewControllerNow:(_Bool)arg5{
    return nil;
}
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3 withAddToParenViewControllerNow:(_Bool)arg4{
    return nil;
}
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3 withParentEventViewController:(id)arg4{
    return nil;
}
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3{
    return nil;
}
%end

%hook QNBPlayerImageAdsViewController

- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3 withPageViewController:(id)arg4 withAddToParenViewControllerNow:(_Bool)arg5{
    return nil;
}
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3 withParentEventViewController:(id)arg4 withAddToParenViewControllerNow:(_Bool)arg5{
    return nil;
}
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3 withAddToParenViewControllerNow:(_Bool)arg4{
    return nil;
}
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3 withParentEventViewController:(id)arg4{
    return nil;
}
- (id)initWithEventProxy:(id)arg1 withPlayerInfo:(id)arg2 withParentViewController:(id)arg3{
    return nil;
}
%end

%hook QNBPlayerSimpleIAPButton
- (id)initWithFrame:(struct CGRect)arg1{
    return nil;
}
%end

%hook TADVideoAdController
- (id)init{
    return nil;
}
%end

人面猴
序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
沈念sama阅读 210,914评论 6赞 490
死咒
序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
沈念sama阅读 89,935评论 2赞 383
救了他两次的神仙让他今天三更去死
文/潘晓璐我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
开封第一讲书人阅读 156,531评论 0赞 345
道士缉凶录：失踪的卖姜人
文/不坏的土叔我叫张陵，是天一观的道长。经常有香客问我，道长，这世上最难降的妖魔是什么？我笑而不...
开封第一讲书人阅读 56,309评论 1赞 282
港岛之恋（遗憾婚礼）
正文为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
茶点故事阅读 65,381评论 5赞 384
恶毒庶女顶嫁案：这布局不是一般人想出来的
文/花漫我一把揭开白布。她就那样静静地躺着，像睡着了一般。火红的嫁衣衬着肌肤如雪。梳的纹丝不乱的头发上，一...
开封第一讲书人阅读 49,730评论 1赞 289
城市分裂传说
那天，我揣着相机与录音，去河边找鬼。笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。我是一名探鬼主播，决...
沈念sama阅读 38,882评论 3赞 404
双鸳鸯连环套：你想象不到人心有多黑
文/苍兰香墨我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
开封第一讲书人阅读 37,643评论 0赞 266
万荣杀人案实录
序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
沈念sama阅读 44,095评论 1赞 303
护林员之死
正文独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋以下内容为张勋视角年9月15日...
茶点故事阅读 36,448评论 2赞 325
白月光启示录
正文我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
茶点故事阅读 38,566评论 1赞 339
活死人
序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
沈念sama阅读 34,253评论 4赞 328
日本核电站爆炸内幕
正文年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
茶点故事阅读 39,829评论 3赞 312
男人毒药：我在死后第九天来索命
文/蒙蒙一、第九天我趴在偏房一处隐蔽的房顶上张望。院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
开封第一讲书人阅读 30,715评论 0赞 21
一桩弑父案，背后竟有这般阴谋
文/苍兰香墨我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。一阵脚步声响...
开封第一讲书人阅读 31,945评论 1赞 264
情欲美人皮
我被黑心中介骗来泰国打工，没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。一个月前我还...
沈念sama阅读 46,248评论 2赞 360
代替公主和亲
正文我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
茶点故事阅读 43,440评论 2赞 348

iOS越狱:去除腾讯视频的播放广告

推荐阅读更多精彩内容