Can you directly inject into backboardd on iOS 14 and later to simulate events without using UIWindow?

[lengfeng222]

#import "TouchSimulator.h"
#import <UIKit/UIApplication.h>
#import <dlfcn.h>

// 函数声明
static void postEvent(IOHIDEventRef event);
static void execute();
static IOHIDEventRef parent = NULL;
unsigned long long int senderID = 0;

void simulateTouch(int type, float x, float y) {
if (parent == NULL) {
parent = IOHIDEventCreateDigitizerEvent(kCFAllocatorDefault,
mach_absolute_time(),
kIOHIDDigitizerTransducerTypeHand,
0,
0,
kIOHIDDigitizerEventTouch,
0,
0.0,
0.0,
0.0,
0.0,
0.0,
0,
true,
0
);
IOHIDEventSetIntegerValue(parent, kIOHIDEventFieldDigitizerIsDisplayIntegrated, 1);
}

uint32_t isTouch = type == TOUCH_UP ? 0 : 1;
IOHIDDigitizerEventMask eventMask = 0;
if (type != TOUCH_UP && type != TOUCH_DOWN)
    eventMask |= kIOHIDDigitizerEventPosition;
if (type == TOUCH_UP || type == TOUCH_DOWN)
    eventMask |= (kIOHIDDigitizerEventTouch | kIOHIDDigitizerEventRange);

IOHIDEventRef child = IOHIDEventCreateDigitizerFingerEvent(kCFAllocatorDefault, mach_absolute_time(), 1, 3, eventMask, x, y, 0.0f, 0.0f, 0.0f, isTouch, isTouch, 0);
IOHIDEventSetFloatValue(child, kIOHIDEventFieldDigitizerMajorRadius, 0.04f);
IOHIDEventSetFloatValue(child, kIOHIDEventFieldDigitizerMinorRadius, 0.04f);
IOHIDEventAppendEvent(parent, child);

execute();

}

static UIWindow* getKeyWindow() {
for (UIWindow *window in [UIApplication sharedApplication].windows) {
if (window.isKeyWindow) {
return window;
}
}
return NULL;
}

static void postEvent(IOHIDEventRef event) {
static IOHIDEventSystemClientRef ioSystemClient = nil;
UIWindow* keyWindow = getKeyWindow();

if (ioSystemClient == NULL) {
    ioSystemClient = IOHIDEventSystemClientCreate(kCFAllocatorDefault);
}
if (event != NULL && keyWindow != NULL) {
    uint32_t contextID = keyWindow._contextId;
    void *handle = dlopen("/System/Library/PrivateFrameworks/BackBoardServices.framework/BackBoardServices", RTLD_NOW);
    if (handle) {
        typedef void (* BKSHIDEventSetDigitizerInfoType)(IOHIDEventRef,uint32_t,uint8_t,uint8_t,CFStringRef,CFTimeInterval,float);
        
        BKSHIDEventSetDigitizerInfoType digitizer = (BKSHIDEventSetDigitizerInfoType)dlsym(handle, "BKSHIDEventSetDigitizerInfo");
        digitizer(event, contextID, false, false, NULL, 0, 0);
        [[UIApplication sharedApplication] _enqueueHIDEvent:event];
    }
}
IOHIDEventSetSenderID(event, kIOHIDEventDigitizerSenderID);
IOHIDEventSystemClientDispatchEvent(ioSystemClient, event);

}

static void execute() {
IOHIDEventSetIntegerValue(parent, kIOHIDEventFieldDigitizerTiltX, kIOHIDDigitizerTransducerTypeHand);
IOHIDEventSetIntegerValue(parent, kIOHIDEventFieldDigitizerTiltY, 1);
IOHIDEventSetIntegerValue(parent, kIOHIDEventFieldDigitizerAltitude, 1);
postEvent(parent);
CFRelease(parent);
parent = NULL;
}