Username - The Username for attempting authentication.
PasswordHash - Password hash of the user.
TargetSystem - Single hostname or IP for authentication attempt.
TargetList - A list of hosts to scan one per line
AllSystems - A switch that when enabled utilizes PowerView modules to enumerate all domain systems. This list is then used to check local admin access.
Domain - This is the domain that PowerView will utilize for discovering systems.
UserDomain - This is the user's domain to authenticate to each system with. Don't use this flag if using a local cred instead of domain cred.
Protocol - This is the setting for whether to check the hash using WMI or SMB. Default is 'WMI' but set it to 'SMB' to check that instead.
CIDR - Specify a CIDR form network range such as 192.168.0.0/24
Threads - Defaults to 5 threads. (I've run into some odd issues setting threads more than 15 with some results not coming back.)
ExfilPSReadline - For each system where auth is successful it runs a PowerShell command to locate PSReadLine console history files (PowerShell command history) and then POSTS them to a web server. See the Readme for server setup.
%hook SBApplicationController
-(void)uninstallApplication:(SBApplication *)application {
NSLog(@"Hey, we're hooking uninstallApplication:!");
%orig; // Call the original implementation of this method
return;
}
%end
2、%new该指令用来给指定的class添加一个新的函数
%new
-(void)newMethod:(NSString*) output{
NSLog(@"This is a new method : %@", output);
}
3、％orig调用原始的挂钩方法。
％orig
％orig （arg1 ， … ）
4、%group用于条件初始化或%hook分组
%group iOS8
%hook IOS8_SPECIFIC_CLASS
// your code here
%end // end hook
%end // end group ios8
%group iOS9
%hook IOS9_SPECIFIC_CLASS
// your code here
%end // end hook
%end // end group ios9
%ctor {
if (kCFCoreFoundationVersionNumber > 1200) {
%init(iOS9);
} else {
%init(iOS8);
}
}
> dotnet AppInspector.dll or on *Windows* simply AppInspector.exe <command> <options>
Microsoft Application Inspector 1.0.25
ApplicationInspector 1.0.25
(c) Microsoft Corporation. All rights reserved
ERROR(S):
No verb selected.
analyze Inspect source directory/file/compressed file (.tgz|zip) against defined characteristics
tagdiff Compares unique tag values between two source paths
tagtest Test presence of smaller set or custom tags in source (compare or verify modes)
exporttags Export default unique rule tags to view what features may be detected
verifyrules Verify rules syntax is valid
help Display more information on a specific command
version Display version information
使用样例
命令行帮助信息：
Usage: dotnet AppInspector.dll [arguments] [options]
dotnet AppInspector.dll -description of available commands
dotnet AppInspector.dll <command> -options description for a given command
分析命令：
Usage: dotnet AppInspector.dll analyze [arguments] [options]
Arguments:
-s, --source-path Required. Path to source code to inspect (required)
-o, --output-file-path Path to output file. Ignored with -f html option which auto creates output.html
-f, --output-file-format Output format [html|json|text]. Default = html
-e, --text-format Match text format specifiers
-r, --custom-rules-path Custom rules path
-t, --tag-output-only Output only contains identified tags. Default = false
-i, --ignore-default-rules Ignore default rules bundled with application. Default = false
-d, --allow-dup-tags Output only non-unique tag matches. Default = false
-c, --confidence-filters Output only matches with confidence [high|medium|low]. Default = high,medium
-k, --file-path-exclusions Exclude source files [none|<list>]. Default = sample,example,test,docs,.vs,.git
-x, --console-verbosity Console verbosity [high|medium|low|none]. Default = medium
-l, --log-file-path Log file path. Default is <application path>/log.txt
-v, --log-file-level Log file level [Debug|Info|Warn|Error|Fatal|Off]. Default = Error
清水师傅的功能较多，并且使用和安装方便快捷。 
