IOS 越狱插件-虚拟定位、WIFI修改

前言

  • 阅读本文需要有一定逆向相关基础，否则可能看不懂，哈。
  • 虚拟定位、WIFI修改原理是HOOK系统函数，所以并不针对某个APP。
  • 本文所讲的是越狱插件，最好有越狱手机，当然你也可以重签名APP来实现HOOK函数。
  • 本文纯属逆向知识学习及探讨，请勿用作学习之外的任何用途。

开始

准备

  • XCode安装MonkeyDev插件

  • 创建LogosTweak项目


    image.png
  • 如果选择要导入PreferenceLoader,要在手机Cydia安装PreferenceLoader插件（雷锋源http://apt.abcydia.com/有）
    image.png

  • 部分配置解释


    image.png

虚拟定位

  • hook函数 - CLLocation的coordinate
// See http://iphonedevwiki.net/index.php/Logos

#if TARGET_OS_SIMULATOR
#error Do not support the simulator, please use the real iPhone Device.
#endif

#import <UIKit/UIKit.h>
#import <CoreLocation/CoreLocation.h>

%hook CLLocation
-(CLLocationCoordinate2D) coordinate
{
    CLLocationCoordinate2D location;
    //纬度
    location.latitude = 26.012345;
    //经度
    location.longitude = 106.49328;
    return location;
}
%end
  • 只要修改为你想去的地方的经纬度即可，也可以参考我另一篇文章IOS非越狱虚拟定位（保持定位）查看经纬度怎么写。
  • 可以看到，其实就只需要几行代码而已。但是每次都要研究经纬度是多少，再重新安装一次插件，太麻烦。所以我提供一个简易版（就是简单在地图上直接选位置）的选择位置信息控制器ViewController（目标APP需使用的是高德地图）。
  • SelectLocationVct.h
#import <UIKit/UIKit.h>
#import <CoreLocation/CoreLocation.h>
#import <NetworkExtension/NetworkExtension.h>
NS_ASSUME_NONNULL_BEGIN
/**
 选择位置
 */
@interface SelectLocationVct : UIViewController
//获取保存的定位
+(CLLocationCoordinate2D) getSaveLocation;

@end

NS_ASSUME_NONNULL_END
  • SelectLocationVct.m
#import "SelectLocationVct.h"
#import "AMapFoundationKit.h"
#import "MAMapKit.h"
#import "AMapSearchAPI.h"
#import "MAPointAnnotation.h"

#define ScreenWidth [UIScreen mainScreen].bounds.size.width
#define ScreenHeight [UIScreen mainScreen].bounds.size.height


@interface SelectLocationVct ()<MAMapViewDelegate,AMapSearchDelegate,UISearchBarDelegate,UIActionSheetDelegate>
@property (nonatomic,assign) BOOL isFirstLocation;
@property (nonatomic,copy) NSString *firstLocationCity;
@property (nonatomic,strong) MAMapView *mapView;
@property (nonatomic,strong) MAPointAnnotation *pointAnn;
@property (nonatomic,strong) AMapSearchAPI *search;
@property (nonatomic,strong) UISearchBar * searchBar;
@property (nonatomic,strong) NSMutableArray *searchContentArray;
@end

@implementation SelectLocationVct

+(CLLocationCoordinate2D) getSaveLocation
{
   NSUserDefaults *userDefault = [NSUserDefaults standardUserDefaults];
   double latitude = [userDefault doubleForKey:@"save_latitude"];
   double longitude =  [userDefault doubleForKey:@"save_longitude"];
    if (latitude == 0 && longitude == 0) {
        CLLocationCoordinate2D location;
        location.latitude = 33.63235;
        location.longitude = 113.255743;
        return location;
    }
    return CLLocationCoordinate2DMake(latitude, longitude);
   
}

-(void) saveLocationWithLatitude:(double)latitude longitude:(double)longitude
{
    NSUserDefaults *userDefault = [NSUserDefaults standardUserDefaults];
    [userDefault setDouble:latitude forKey:@"save_latitude"];
    [userDefault setDouble:longitude forKey:@"save_longitude"];
    [userDefault synchronize];
    self.mapView.centerCoordinate = CLLocationCoordinate2DMake(latitude, longitude);
}

/**
 修改位置并保存

 @param title 标题
 @param latitude 纬度
 @param longitude 经度
 */
-(void) changeLocationWithTitle:(NSString *)title latitude:(double)latitude longitude:(double)longitude
{
    self.pointAnn.coordinate = CLLocationCoordinate2DMake(latitude, longitude);
    self.pointAnn.title = title;
    [self.mapView selectAnnotation:self.pointAnn animated:YES];
    [self saveLocationWithLatitude:latitude longitude:longitude];
}

- (void)viewDidLoad {
    [super viewDidLoad];
    // Do any additional setup after loading the view.
    self.title = [SelectLocationVct selectBtnName];
    _pointAnn = [NSClassFromString(@"MAPointAnnotation") new];
    _search = [NSClassFromString(@"AMapSearchAPI") new];
    _search.delegate = self;
    _searchContentArray = [[NSMutableArray alloc] init];
}

-(void) viewDidAppear:(BOOL)animated
{
    [super viewDidAppear:animated];
    
    [self.view addSubview:self.searchBar];
    [self.view addSubview:self.mapView];
}

-(UISearchBar *) searchBar
{
    CGFloat navHeight = self.navigationController.navigationBar.bounds.size.height + [[UIApplication sharedApplication] statusBarFrame].size.height;
    _searchBar = [[UISearchBar alloc] initWithFrame:CGRectMake(0, navHeight, ScreenWidth , 40)];
    _searchBar.placeholder = @"请输入搜索地名";
    _searchBar.delegate = self;
    return _searchBar;
}

- (MAMapView *) mapView
{
    if (_mapView == nil) {
//        _mapView = [[MAMapView alloc] initWithFrame:CGRectMake(0, 0, ScreenWidth,ScreenHeight - 200 - 64)];
        _mapView = [NSClassFromString(@"MAMapView") new];
        CGFloat navHeight = self.navigationController.navigationBar.bounds.size.height + [[UIApplication sharedApplication] statusBarFrame].size.height;
        _mapView.frame = CGRectMake(0, navHeight + 40, ScreenWidth,ScreenHeight - navHeight - _searchBar.frame.size.height);
        _mapView.delegate = self;
        /// 打开定位
        _mapView.showsUserLocation = YES;
        /*
         MAUserTrackingModeNone              = 0,    ///< 不追踪用户的location更新
         MAUserTrackingModeFollow            = 1,    ///< 追踪用户的location更新
         MAUserTrackingModeFollowWithHeading = 2     ///< 追踪用户的location与heading更新
         */
        _mapView.userTrackingMode = MAUserTrackingModeFollow;
        ///设定定位精度。默认为kCLLocationAccuracyBest
        _mapView.desiredAccuracy = kCLLocationAccuracyBest;
        /// 是否显示指南针
        _mapView.showsCompass = NO;
        /// 设定定位的最小更新距离。默认为kCLDistanceFilterNone，会提示任何移动

        _mapView.distanceFilter = 15.0f;
        /// 是否显示比例尺，默认为YES
        _mapView.showsScale = NO;
        /// 是否支持缩放，默认为YES

        _mapView.zoomEnabled = YES;
        /// 是否支持平移，默认为YES
        _mapView.scrollEnabled = YES;
        /// 缩放级别, [3, 20]
        _mapView.zoomLevel = 15;
        /// 去掉高德地图logo
        for (UIView *view in _mapView.subviews) {
            if ([view isKindOfClass:[UIImageView class]]) {
                [view removeFromSuperview];
            }
        }

    }
    return _mapView;

}

/*
#pragma mark - Navigation

// In a storyboard-based application, you will often want to do a little preparation before navigation
- (void)prepareForSegue:(UIStoryboardSegue *)segue sender:(id)sender {
    // Get the new view controller using [segue destinationViewController].
    // Pass the selected object to the new view controller.
}
*/



#pragma mark -- MAMapViewDelegate
/**
 * @brief 位置或者设备方向更新后调用此接口
 * @param mapView 地图View
 * @param userLocation 用户定位信息(包括位置与设备方向等数据)
 * @param updatingLocation 标示是否是location数据更新, YES:location数据更新 NO:heading数据更新
 */
- (void)mapView:(MAMapView *)mapView didUpdateUserLocation:(MAUserLocation *)userLocation updatingLocation:(BOOL)updatingLocation
{
    NSLog(@"定位更新");
    NSLog(@"经度-->%f 纬度-->%f",userLocation.coordinate.longitude,userLocation.coordinate.latitude);
    if (!_isFirstLocation) {
        _isFirstLocation = true;
        self.pointAnn.coordinate = userLocation.coordinate;
        self.pointAnn.title = userLocation.title;
        [self.mapView addAnnotation:self.pointAnn];
        [self.mapView selectAnnotation:self.pointAnn animated:YES];
        [self saveLocationWithLatitude:userLocation.coordinate.latitude longitude:userLocation.coordinate.longitude];
        [self getLocationByCoordinate:userLocation.coordinate successAction:^(NSDictionary *addressDic) {
            NSString *city=[addressDic objectForKey:@"City"];
            self.firstLocationCity = city;
        } failAction:^{
            
        }];
    }
}

/**
 * @brief 在地图View将要启动定位时调用此接口
 * @param mapView 地图View
 */
- (void)mapViewWillStartLocatingUser:(MAMapView *)mapView
{
    NSLog(@"开始定位");
}

/**
 * @brief 在地图View停止定位后调用此接口
 * @param mapView 地图View
 */
- (void)mapViewDidStopLocatingUser:(MAMapView *)mapView
{
    NSLog(@"停止定位");
}

/**
 * @brief 单击地图底图调用此接口
 * @param mapView    地图View
 * @param coordinate 点击位置经纬度
 */
- (void)mapView:(MAMapView *)mapView didSingleTappedAtCoordinate:(CLLocationCoordinate2D)coordinate
{
    NSLog(@"单击地图");
    NSLog(@"经度-->%f 纬度-->%f",coordinate.longitude,coordinate.latitude);
    
    [self getLocationByCoordinate:coordinate successAction:^(NSDictionary *addressDic) {
        NSString *state=[addressDic objectForKey:@"State"];
        NSString *city=[addressDic objectForKey:@"City"];
        NSString *subLocality=[addressDic objectForKey:@"SubLocality"];
        NSString *street=[addressDic objectForKey:@"Street"];
        //NSLog(@"%@,%@,%@,%@",state,city,subLocality,street);
        NSString *strLocation;
        if (street.length == 0 || street == NULL || [street isEqualToString:@"(null)"]) {
            strLocation= [NSString stringWithFormat:@"%@%@%@",state,city,subLocality];
        }else{
            strLocation= [NSString stringWithFormat:@"%@%@%@%@",state,city,subLocality,street];
        }
        
        [self changeLocationWithTitle:strLocation latitude:coordinate.latitude longitude:coordinate.longitude];
    } failAction:^{
        
    }];
}
//通过坐标获取位置信息
-(void) getLocationByCoordinate:(CLLocationCoordinate2D)coordinate successAction:(void(^)(NSDictionary *info))success failAction:(void(^)())fail
{
    //反编码 经纬度---->位置信息
    CLLocation *location=[[CLLocation alloc] initWithLatitude:coordinate.latitude longitude:coordinate.longitude];
    CLGeocoder *geocoder=[[CLGeocoder alloc] init];
    [geocoder reverseGeocodeLocation:location completionHandler:^(NSArray *placemarks, NSError *error) {
        if (error) {
            NSLog(@"反编码失败:%@",error);
            if (fail) {
                fail();
            }
        }else{
            //NSLog(@"反编码成功:%@",placemarks);
            CLPlacemark *placemark=[placemarks lastObject];
            //NSLog(@"%@",placemark.addressDictionary[@"FormattedAddressLines"]);
            NSDictionary *addressDic=placemark.addressDictionary;
            if (success) {
                success(addressDic);
            }
        }
    }];
}


#pragma mark -- AMapSearchDelegate
/* POI 搜索回调. */
- (void)onPOISearchDone:(AMapPOISearchBaseRequest *)request response:(AMapPOISearchResponse *)response
{
    if (response.pois.count == 0)
    {
        NSLog(@"没有搜索到内容");
        return;
    }
    NSLog(@"搜索到了");
    //解析response获取POI信息
    [self.searchContentArray removeAllObjects];
    UIActionSheet *action = [[UIActionSheet alloc] initWithTitle:@"选择位置" delegate:self cancelButtonTitle:@"取消" destructiveButtonTitle:nil otherButtonTitles: nil];
    for (int i = 0 ; i < response.pois.count; i++) {
        AMapPOI *p = [response.pois objectAtIndex:i];
        [action addButtonWithTitle:[NSString stringWithFormat:@"%@-%@",p.name,p.address]];
        [self.searchContentArray addObject:p];
    }
    [action showInView:self.view];
}


#pragma mark -- UISearchBarDelegate
- (void)searchBarSearchButtonClicked:(UISearchBar *)searchBar
{
    [searchBar resignFirstResponder];
    AMapPOIKeywordsSearchRequest *request = [NSClassFromString(@"AMapPOIKeywordsSearchRequest") new];

    request.keywords            = searchBar.text;
    request.city                = self.firstLocationCity ? self.firstLocationCity : @"广州";
//    request.types               = @"";
    request.requireExtension    = YES;
    /* 按照距离排序. */
    request.sortrule            = 0;
    /*  搜索SDK 3.2.0 中新增加的功能，只搜索本城市的POI。*/
    request.cityLimit           = YES;
    request.requireSubPOIs      = YES;
    [self.search AMapPOIKeywordsSearch:request];
}
- (void)searchBar:(UISearchBar *)searchBar textDidChange:(NSString *)searchText
{
    NSLog(@"textDidChange-->%@",searchText);
    if ([searchText isEqualToString:@""]) {
        CLLocationCoordinate2D coordinate = self.mapView.userLocation.coordinate;
        [self changeLocationWithTitle:self.mapView.userLocation.title latitude:coordinate.latitude longitude:coordinate.longitude];
    }
}

#pragma mark -- UIActionSheetDelegate
- (void)actionSheet:(UIActionSheet *)actionSheet clickedButtonAtIndex:(NSInteger)buttonIndex NS_DEPRECATED_IOS(2_0, 8_3) __TVOS_PROHIBITED
{
 
    if(actionSheet.cancelButtonIndex != buttonIndex){
        AMapPOI *p = [self.searchContentArray objectAtIndex:buttonIndex-1];
        NSLog(@"%@*%@*%@",p.description,p.name,p.address);
        CLLocationCoordinate2D coordinate = CLLocationCoordinate2DMake(p.location.latitude, p.location.longitude);
        [self changeLocationWithTitle:p.name latitude:coordinate.latitude longitude:coordinate.longitude];
    }
}
@end

  • 当然你还是要导入高德地图API的头文件（随便开个项目，pod高德地图的API再拷贝过来）

  • 最后修改一下xm文件

#import <UIKit/UIKit.h>
#import <CoreLocation/CoreLocation.h>
#import "SelectLocationVct.h"
%hook CLLocation
-(CLLocationCoordinate2D) coordinate
{
    return [%c(SelectLocationVct) getSaveLocation];
}
%end

  • 来张效果图吧（支持直接点击地图，搜索来确定位置）


    image.png

PS：在哪里跳到这个控制器，就个人喜欢了，比如你可以hook某个按钮，或者hook某个控制器然后加个按钮，按钮点击时就跳到这个控制器就行了。

WIFI信息修改

  • 使用fishhook钩住系统函数

1、CNCopySupportedInterfaces：获取wifi列表（实际测试只返回当前wifi）
2、CNCopyCurrentNetworkInfo：获取wifi信息

  • 相关类
#import <Foundation/Foundation.h>
@interface DataManage : NSObject

+(void) saveDataForObject:(id)value AndKey:(NSString *)key;

+(id) getObjectFromKey:(NSString *)key;
@end


#import "DataManage.h"

@implementation DataManage

#pragma mark - 保存数据和获取数据
+(void) saveDataForObject:(id)value AndKey:(NSString *)key
{
    NSUserDefaults *defaluts = [NSUserDefaults standardUserDefaults];
    [defaluts setObject:value forKey:key];
    [defaluts synchronize];
}

+(id) getObjectFromKey:(NSString *)key
{
    NSUserDefaults *defaults = [NSUserDefaults standardUserDefaults];
    return [defaults objectForKey:key];
}

@end
  • 创建一个实体来保存wifi信息
@interface DVWifiModel : NSObject

// BSSID：路由器的Mac地址
@property (nonatomic, copy) NSString *BSSID;

// SSID:路由器的广播名称
@property (nonatomic, copy) NSString *SSID;

// SSIDDATA:SSID的十六进制
@property (nonatomic, strong) NSData *SSIDDATA;

//CNCopySupportedInterfaces返回的数组里的对象
@property (nonatomic, copy) NSString *ifnam;

+(instancetype) getSaveWifiInfo;

@end

@implementation DVWifiModel
+(instancetype) getSaveWifiInfo
{
    NSDictionary *dic = [DataManage getObjectFromKey:@"Wifi_info"];
    DVWifiModel *model = [DVWifiModel new];
    model.ifnam = dic[@"ifnam"];
    model.BSSID = dic[@"BSSID"];
    model.SSID = dic[@"SSID"];
    model.SSIDDATA = [model.SSID dataUsingEncoding:NSUTF8StringEncoding];
    return model;
}

@end
  • 主角 DVWifiHook -- 钩住系统方法的具体实现
#import <UIKit/UIkit.h>
@interface DVWifiHook : NSObject
+(NSDictionary *) getCurrentSSIDInfo;

+(void) saveCurrentWifi;

@end


#import "DVWifiHook.h"
#import "fishhook.h"
#import "DataManage.h"
#import "DVWifiModel.h"
@implementation DVWifiHook
+ (void)load {
    
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        struct rebinding rebind1 = {"CNCopySupportedInterfaces", dv_CNCopySupportedInterfaces, (void *)&orig_CNCopySupportedInterfaces};
        struct rebinding rebind2 = {"CNCopyCurrentNetworkInfo", dv_CNCopyCurrentNetworkInfo, (void *)&orig_CNCopyCurrentNetworkInfo};
        //定义数组
        struct rebinding rebinds[] = {rebind1,rebind2};
        /*
         参数一 : 存放rebinding结构体的数组
         参数二 : 数组的长度
         */
        rebind_symbols(rebinds, 2);

    });
}



// CFArrayRef CNCopySupportedInterfaces        (void)
static CFArrayRef (*orig_CNCopySupportedInterfaces)();

static CFArrayRef dv_CNCopySupportedInterfaces() {
    CFArrayRef cfArray = NULL;
    DVWifiModel *wifi = [DVWifiModel getSaveWifiInfo];
    if(wifi && wifi.ifnam) {
        NSArray *array = [NSArray arrayWithObject:wifi.ifnam];
        cfArray = CFRetain((__bridge CFArrayRef)(array));
    }
    if(!cfArray) {
        cfArray = orig_CNCopySupportedInterfaces();
    }

    return cfArray;
}

// CFDictionaryRef CNCopyCurrentNetworkInfo        (CFStringRef interfaceName)
static CFDictionaryRef (*orig_CNCopyCurrentNetworkInfo)(CFStringRef interfaceName);

static CFDictionaryRef dv_CNCopyCurrentNetworkInfo(CFStringRef interfaceName) {
    CFDictionaryRef dic = NULL;
    DVWifiModel *wifi = [DVWifiModel getSaveWifiInfo];
    if(wifi) {
        NSDictionary *dictionary = @{
                                     @"BSSID" : (wifi.BSSID ? wifi.BSSID : @""),
                                     @"SSID" : (wifi.SSID ? wifi.SSID : @""),
                                     @"SSIDDATA" : (wifi.SSIDDATA ? wifi.SSIDDATA : @""),
                                     };
        dic = CFRetain((__bridge CFDictionaryRef)(dictionary));
    }
    if(!dic) {
        dic = orig_CNCopyCurrentNetworkInfo(interfaceName);
    }
    return dic;
}

+(NSDictionary *) getCurrentSSIDInfo
{
    NSString *currentSSID = @"";
    CFArrayRef myArray = orig_CNCopySupportedInterfaces();
    if (myArray != nil){
        NSDictionary* myDict = (__bridge NSDictionary *) orig_CNCopyCurrentNetworkInfo(CFArrayGetValueAtIndex(myArray, 0));
        if (myDict!=nil){
            currentSSID=[myDict valueForKey:@"SSID"];
        } else {
            currentSSID=@"NULL";
        }
    } else {
        currentSSID=@"NULL";
    }
    
    NSArray *ifs = (__bridge id)orig_CNCopySupportedInterfaces();
    NSLog(@"%s: Supported interfaces: %@", __func__, ifs);
    id info = nil;
    NSMutableDictionary *resultDic = nil;
    for (NSString *ifnam in ifs) {
        info = (__bridge id)orig_CNCopyCurrentNetworkInfo((CFStringRef)CFBridgingRetain(ifnam));
        if (info && [info count]) {
            resultDic = [[NSMutableDictionary alloc] initWithDictionary:info];
            [resultDic setValue:ifnam forKey:@"ifnam"];
            break;
        }
    }
    
    NSLog(@"wifi info %@",resultDic);
    
    return resultDic;
}

+(void) saveCurrentWifi
{
    NSDictionary *info = [DVWifiHook getCurrentSSIDInfo];
    NSMutableDictionary *dic = [[NSMutableDictionary alloc] init];
    [dic setValue:info[@"SSID"] forKey:@"SSID"];
    [dic setValue:info[@"BSSID"] forKey:@"BSSID"];
    [dic setValue:info[@"ifnam"] forKey:@"ifnam"];
    [DataManage saveDataForObject:dic AndKey:@"Wifi_info"];
    [[[UIAlertView alloc] initWithTitle:@"提示" message:[NSString stringWithFormat:@"设置成功\nWifi名称：%@\nBSSID：%@\nifnam：%@",info[@"SSID"],info[@"BSSID"],info[@"ifnam"]] delegate:nil cancelButtonTitle:@"确定" otherButtonTitles: nil] show];
}
  • XCode11以上可能遇到的问题

问题一：
  An empty identity is not valid when signing a binary for the product type 'Dynamic Library'.
解决方案：
  在Building Settings中点击下方的 + 号，选择Add User-Defined Setting，最后添加此变量CODE_SIGNING_ALLOWED = NO

问题二：
  building for iOS, but linking in .tbd file (/opt/theos/vendor/lib/CydiaSubstrate.framework/CydiaSubstrate.tbd) built for iOS Simulator, file '/opt/theos/vendor/lib/CydiaSubstrate.framework/CydiaSubstrate.tbd' for architecture arm64.
解决方案：
  打开/opt/theos/vendor/lib/CydiaSubstrate.framework/CydiaSubstrate.tbd，删除其中的i386,x86_64架构，保存。

PS：调用saveCurrentWifi方法后，无论连接什么WIFI，返回的都是保存的WIFI信息。原理不难，具体你想怎么去完善功能就靠你自己发挥了。

最后附上完整GitHub项目地址（VirtualLocationTweak）,欢迎讨论交流。

最后编辑于 ：
©著作权归作者所有,转载或内容合作请联系作者
  • 人面猴
    序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
    沈念sama阅读 216,919评论 6赞 502
  • 死咒
    序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
    沈念sama阅读 92,567评论 3赞 392
  • 救了他两次的神仙让他今天三更去死
    文/潘晓璐 我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
    开封第一讲书人阅读 163,316评论 0赞 353
  • 道士缉凶录：失踪的卖姜人
    文/不坏的土叔 我叫张陵，是天一观的道长。 经常有香客问我，道长，这世上最难降的妖魔是什么？ 我笑而不...
    开封第一讲书人阅读 58,294评论 1赞 292
  • 港岛之恋（遗憾婚礼）
    正文 为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
    茶点故事阅读 67,318评论 6赞 390
  • 恶毒庶女顶嫁案：这布局不是一般人想出来的
    文/花漫 我一把揭开白布。 她就那样静静地躺着，像睡着了一般。 火红的嫁衣衬着肌肤如雪。 梳的纹丝不乱的头发上，一...
    开封第一讲书人阅读 51,245评论 1赞 299
  • 城市分裂传说
    那天，我揣着相机与录音，去河边找鬼。 笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。 我是一名探鬼主播，决...
    沈念sama阅读 40,120评论 3赞 418
  • 双鸳鸯连环套：你想象不到人心有多黑
    文/苍兰香墨 我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
    开封第一讲书人阅读 38,964评论 0赞 275
  • 万荣杀人案实录
    序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
    沈念sama阅读 45,376评论 1赞 313
  • 护林员之死
    正文 独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋 以下内容为张勋视角 年9月15日...
    茶点故事阅读 37,592评论 2赞 333
  • 白月光启示录
    正文 我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。 大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
    茶点故事阅读 39,764评论 1赞 348
  • 活死人
    序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
    沈念sama阅读 35,460评论 5赞 344
  • 日本核电站爆炸内幕
    正文 年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
    茶点故事阅读 41,070评论 3赞 327
  • 男人毒药：我在死后第九天来索命
    文/蒙蒙 一、第九天 我趴在偏房一处隐蔽的房顶上张望。 院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
    开封第一讲书人阅读 31,697评论 0赞 22
  • 一桩弑父案，背后竟有这般阴谋
    文/苍兰香墨 我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。 一阵脚步声响...
    开封第一讲书人阅读 32,846评论 1赞 269
  • 情欲美人皮
    我被黑心中介骗来泰国打工， 没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。 一个月前我还...
    沈念sama阅读 47,819评论 2赞 370
  • 代替公主和亲
    正文 我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。 传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
    茶点故事阅读 44,665评论 2赞 354