# Hướng dẫn phân tích Facebook IPA để tìm hook

## 1. Extract IPA

```bash
unzip facebook.ipa -d /tmp/ipa_extracted
cd /tmp/ipa_extracted/Payload/Facebook.app
```

## 2. Liệt kê class liên quan đến seen/story

```bash
# Tìm class trong main binary
strings Facebook | grep "^_OBJC_CLASS.*Seen\|^_OBJC_CLASS.*Story" | sort -u

# Tìm class trong Frameworks
for fw in Frameworks/*.framework; do
  fw_bin=$(find "$fw" -type f -perm -111 -not -name "*.metallib" | head -1)
  [ -n "$fw_bin" ] && echo "=== $(basename $fw) ===" && strings "$fw_bin" | grep "^_OBJC_CLASS.*Seen\|^_OBJC_CLASS.*Story\|^_OBJC_CLASS.*Snacks" | sort -u
done
```

## 3. Tìm method (selector) liên quan

```bash
strings Facebook | grep -i "markSeen\|sendSeen\|setSeenState\|markStory\|canMark\|markThread\|SeenStateWriter\|SeenStateMutator\|SeenStateInfo" | sort -u
```

## 4. Xác định class chứa selector

Dùng `nm` với binary đã decrypt (trên máy thật / jailbreak):

```bash
# Trên iPhone qua SSH
nm -g Facebook | grep "setSeenState"
nm -g FBSnacksSurfaceAwareSeenStateWriter 2>/dev/null

# Hoặc dùng class-dump / dump_class
class-dump Facebook 2>/dev/null | grep -A5 "setSeenState"
```

## 5. Runtime exploration với Frida

Trên máy thật jailbreak:

```bash
# Trace tất cả call đến setSeenState:
frida -U Facebook -l - <<'EOF'
Interceptor.attach(ObjC.classes.FBSnacksSurfaceAwareSeenStateWriter["- setSeenState:"], {
  onEnter(args) {
    console.log("setSeenState called from:");
    console.log(Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join("\n"));
  }
});
EOF
```

## 6. Kiểm tra call stack khi xem story

```bash
frida -U Facebook -l - <<'EOF'
var StorySeenClasses = [
  "FBSnacksSurfaceAwareSeenStateWriter",
  "FBSnacksUnifiedSeenStateMutator",
  "FBSnacksSeenStateInfoDataSource",
  "FBSnacksViewReceiptsSeenStateInfoDataSource"
];

StorySeenClasses.forEach(function(clsName) {
  var cls = ObjC.classes[clsName];
  if (cls) {
    console.log("[+] Found class: " + clsName);
    // Log tất cả method của class
    cls.$ownMethods.forEach(function(m) {
      console.log("  " + m);
    });
  } else {
    console.log("[-] Class not found: " + clsName);
  }
});
EOF
```

## 7. Khi tìm đúng method, hook để disable

```objc
// Trong Tweak.xm
%hook FBSnacksSurfaceAwareSeenStateWriter
  - (void)setSeenState:(id)state {
    // Không gọi %orig → seen không được ghi
  }
%end
```

## 8. Build + inject loop

```bash
make package
cp packages/*.deb ~/test/glow/
# Dùng glow-build-ubuntu.sh để inject cả 2 tweak
```