Get Sms Broadcast with Text Body Without Jailbreak But Private Frameworks in iOS

Detect incoming SMS or iMessage without Jailbreak

It looks like it is impossible to do that without JailBreaking.

source: react on incoming sms on an iPhone

how to get the message when receiving the kCTMessageReceivedNotification notification on IOS5

Here's what I found ...

Just looking at the dumped private APIs, it looks like ChatKit.framework could help. Take a look at
CKSMSService.h

or CKMadridService.h for iMessage messages.

I did quickly attempt to swizzle my own method in, for a couple methods in CKSMSService:

- (void)_receivedMessage: (id)arg1 replace:(BOOL)arg2 replacedRecordIdentifier:(int)arg3 postInternalNotification:(BOOL)arg4;

- (void)_receivedMessage: (id)arg1 replace:(BOOL)arg2 postInternalNotification:(BOOL)arg3;

but on iOS 5.0.1 I didn't see either of those get called (maybe my error?). So, I tried to just get the message directly from the sqlite SMS database. Note ... I didn't build the full app, to register for notifications. I'm assuming your code to get the kCTMessageReceivedNotification is ok ... it just doesn't give you the SMS content anymore. So, if you put the following code in your notification handler, you should be able to see the message text:

- (NSString *) mostRecentSMS  { 
    NSString *text = @"";

    sqlite3 *database;
    if(sqlite3_open([@"/private/var/mobile/Library/SMS/sms.db" UTF8String], &database) == SQLITE_OK) {
        sqlite3_stmt *statement;

        // iOS 4 and 5 may require different SQL, as the .db format may change
        const char *sql4 = "SELECT text from message ORDER BY rowid DESC";  // TODO: different for iOS 4.* ???
        const char *sql5 = "SELECT text from message ORDER BY rowid DESC";

        NSString *osVersion =[[UIDevice currentDevice] systemVersion];         
        if([osVersion hasPrefix:@"5"]) {
            // iOS 5.* -> tested
            sqlite3_prepare_v2(database, sql5, -1, &statement, NULL);
        } else {
            // iOS != 5.* -> untested!!!
            sqlite3_prepare_v2(database, sql4, -1, &statement, NULL);
        }

        // Use the while loop if you want more than just the most recent message
        //while (sqlite3_step(statement) == SQLITE_ROW) {
        if (sqlite3_step(statement) == SQLITE_ROW) {
            char *content = (char *)sqlite3_column_text(statement, 0);
            text = [NSString stringWithCString: content encoding: NSUTF8StringEncoding];
            sqlite3_finalize(statement);
        }

        sqlite3_close(database);
    }
    return text;
}    

Now, make sure this app is installed in /Applications/. If you just build this app, and install normally with Xcode, you'll get a permission denied error opening the sqlite database, because of app sandboxing.

My code snippet just gets the most recent text content. Here's an example of doing a little more with the database. Look at the QuerySMS method.

Also, here's a link on the database format of sms.db. You can find what else you need in there. Or, just copy the sms.db to your computer, and browse it with something like the Firefox SQLiteManager plugin. Good luck!

Update: some information from a question I posted on multi-process SQLite thread safety on iOS

Programmatically send iMessage using private frameworks

I haven't tested this, but look at the code posted here. If you look at httpResponseForMethod:URI:, you see where he/she sends a message (appears to be hardcode to support iOS 5 or iOS 4):

CKSMSService *smsService = [CKSMSService sharedSMSService];

//id ct = CTTelephonyCenterGetDefault();
CKConversationList *conversationList = nil;

NSString *value =[[UIDevice currentDevice] systemVersion];          
if([value hasPrefix:@"5"])
{
    //CKMadridService *madridService = [CKMadridService sharedMadridService];
    //NSString *foo = [madridService _temporaryFileURLforGUID:@"A5F70DCD-F145-4D02-B308-B7EA6C248BB2"];

    NSLog(@"Sending SMS");
    conversationList = [CKConversationList sharedConversationList];
    CKSMSEntity *ckEntity = [smsService copyEntityForAddressString:Phone];
    CKConversation *conversation = [conversationList conversationForRecipients:[NSArray arrayWithObject:ckEntity] create:TRUE service:smsService];
    NSString *groupID = [conversation groupID];           
    CKSMSMessage *ckMsg = [smsService _newSMSMessageWithText:msg forConversation:conversation];
    [smsService sendMessage:ckMsg];
    [ckMsg release];     
} else {
    //4.0
    id ct = CTTelephonyCenterGetDefault();
    void* address = CKSMSAddressCreateWithString(pid); 

    int group = [grp intValue];         

    if (group <= 0) {
        group = CKSMSRecordCreateGroupWithMembers([NSArray arrayWithObject:address]);       
    }

    void *msg_to_send = _CKSMSRecordCreateWithGroupAndAssociation(NULL, address, msg, group, 0);    
    CKSMSRecordSend(ct, msg_to_send);

}

The code uses normal SMS, but you can see the following commented out code:

//CKMadridService *madridService = [CKMadridService sharedMadridService];

The "Madrid" service is probably what can send iMessages. See the private header here.

Both SMS and iMessage private APIs are in the ChatKit.framework.

Import ChatKit (i.e., Private Framework) OR using CKDBMessage somehow

Well not many people viewed this, but for the sake of our wiki community, I managed to solve this by adding the CKDBMessage.h file to my project (actually I added all the headers of ChatKit but I don't think it's necessary), than I loaded the framework dynamically with dlopen like so:

dlopen("/System/Library/PrivateFrameworks/ChatKit.framework/ChatKit", RTLD_LAZY)

So my full solution is:

dlopen("/System/Library/PrivateFrameworks/ChatKit.framework/ChatKit", RTLD_LAZY);

Class CKDBMessageClass = NSClassFromString(@"CKDBMessage");
CKDBMessage *msg = [[CKDBMessageClass alloc] initWithRecordID:lastID];

NSString *text = msg.text;
NSLog(@"text: %@", text);

Getting the ID of the last message involves another framework: IMDPersistence:

//SomeFile.h
// ...
//declare the function:
static int (*IMDMessageRecordGetMessagesSequenceNumber)();

// SomeFile.m
// ...
//open IMDPersistence framework
void *libHandleIMD = dlopen("/System/Library/PrivateFrameworks/IMDPersistence.framework/IMDPersistence", RTLD_LAZY);

//make/get symbol from framework + name
IMDMessageRecordGetMessagesSequenceNumber = (int (*)())dlsym(libHandleIMD, "IMDMessageRecordGetMessagesSequenceNumber");

// get id of last SMS from symbol
int lastID = IMDMessageRecordGetMessagesSequenceNumber();

Now you can use lastID to get the message contents...

---

Related Topics