搜狗搜索-公众号文章列表unidbg逆向

搜狗搜索-公众号文章列表unidbg逆向

Java层

image-20211213172034546

从抓包结果看，参数和返回结果都经过加密，而且参数名都是极其简单的单个字符串，不太好入手，尝试从请求的url入手，在jadx搜索v2.get

image-20211213172326842

进入看看

image-20211213172416259

疑似加密和解密的函数

image-20211213172452959

可以看到最终是调用了ScoreTools这个so里面的native函数，接下来使用frida hook看看。

function hook_encrypt() {
    var ScEncryptWall = Java.use('com.sogou.scoretools.ScEncryptWall');
    ScEncryptWall.encrypt.implementation = function (a, b, c) {
        console.log('encrypt.a:', a);
        console.log('encrypt.b:', b);
        console.log('encrypt.c:', c);

        var res = this.encrypt(a, b, c);
        console.log('encrypt.res:', res);

        return res;
    }
}

Java.perform(function () {
    hook_encrypt();
})

image-20211213173541000

so层

ida打开libSCoreTools.so,函数窗口搜索java，可以看出是静态注册的，接下来用unidbg调用encrypt函数

image-20211213174535701

unidbg逆向

package com.sogou;

import com.github.unidbg.AndroidEmulator;
import com.github.unidbg.Emulator;
import com.github.unidbg.Module;
import com.github.unidbg.hook.hookzz.*;
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import com.github.unidbg.linux.android.AndroidResolver;
import com.github.unidbg.linux.android.dvm.*;
import com.github.unidbg.memory.Memory;
import com.sun.jna.Pointer;

import java.io.File;
import java.util.ArrayList;
import java.util.List;

public class Sogou extends AbstractJni {
    private final AndroidEmulator emulator;
    private final VM vm;
    private final Module module;

    public static String pkgName = "com.sogou.activity.src";
    public static String apkPath = "unidbg-android/src/test/java/com/sogou/sogou7.9.6.6.apk";
    public static String soPath = "unidbg-android/src/test/java/com/sogou/libSCoreTools.so";

    public Sogou() {
        emulator = AndroidEmulatorBuilder.for32Bit().setProcessName(pkgName).build();
        final Memory memory = emulator.getMemory();
        memory.setLibraryResolver(new AndroidResolver(23));
        vm = emulator.createDalvikVM(new File(apkPath));
        vm.setVerbose(true);
        DalvikModule dm = vm.loadLibrary(new File(soPath), true);
        vm.setJni(this);

        dm.callJNI_OnLoad(emulator);
        module = dm.getModule();
    }

    public void call_encrypt() {
        List<Object> list = new ArrayList<>(10);
        list.add(vm.getJNIEnv());
        list.add(0);
        list.add(vm.addLocalObject(new StringObject(vm, "http://app.weixin.sogou.com/api/searchapp")));
        list.add(vm.addLocalObject(new StringObject(vm, "type=2&ie=utf8&page=2&query=Python&select_count=0&usip=")));
        list.add(vm.addLocalObject(new StringObject(vm, "")));

        Number number = module.callFunction(emulator, 0x9ca0+1, list.toArray())[0];
        System.out.println("Result:" + vm.getObject(number.intValue()).getValue().toString());
    }
    
    public static void main(String[] args) {
        Sogou test = new Sogou();
        test.call_encrypt();
    }
}

image-20211213173948453

运行之后发现，跑完了整个流程，但是没有结果。不过在java代码里面就发现了有个init函数，也许我们要先调用一下这个函数。

image-20211213174125151

public void call_init() {
    DvmClass Context = vm.resolveClass("android/content/Context");
    List<Object> list = new ArrayList<>(10);
    list.add(vm.getJNIEnv());
    list.add(0);
    list.add(vm.addLocalObject(Context.newObject(null)));
    Number number = module.callFunction(emulator, 0x9564+1, list.toArray())[0];
    System.out.println("init:" + number.intValue());
}

public static void main(String[] args) {
    Sogou test = new Sogou();
    test.call_init();
    test.call_encrypt();
}

image-20211213174746087

结果出来了，同样的参数运行多次，我们发现每次的结果都不一样，说明算法的输入可能还有随机数或时间戳的参与。

完整代码

package com.sogou;

import com.github.unidbg.AndroidEmulator;
import com.github.unidbg.Emulator;
import com.github.unidbg.Module;
import com.github.unidbg.hook.hookzz.*;
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import com.github.unidbg.linux.android.AndroidResolver;
import com.github.unidbg.linux.android.dvm.*;
import com.github.unidbg.memory.Memory;
import com.sun.jna.Pointer;

import java.io.File;
import java.util.ArrayList;
import java.util.List;

public class Sogou extends AbstractJni {
    private final AndroidEmulator emulator;
    private final VM vm;
    private final Module module;

    public static String pkgName = "com.sogou.activity.src";
    public static String apkPath = "unidbg-android/src/test/java/com/sogou/sogou7.9.6.6.apk";
    public static String soPath = "unidbg-android/src/test/java/com/sogou/libSCoreTools.so";

    public Sogou() {
        emulator = AndroidEmulatorBuilder.for32Bit().setProcessName(pkgName).build();
        final Memory memory = emulator.getMemory();
        memory.setLibraryResolver(new AndroidResolver(23));
        vm = emulator.createDalvikVM(new File(apkPath));
        vm.setVerbose(true);
        DalvikModule dm = vm.loadLibrary(new File(soPath), true);
        vm.setJni(this);

        dm.callJNI_OnLoad(emulator);
        module = dm.getModule();
    }

    public void call_init() {
        DvmClass Context = vm.resolveClass("android/content/Context");
        List<Object> list = new ArrayList<>(10);
        list.add(vm.getJNIEnv());
        list.add(0);
        list.add(vm.addLocalObject(Context.newObject(null)));
        Number number = module.callFunction(emulator, 0x9564+1, list.toArray())[0];
        System.out.println("init:" + number.intValue());
    }

    public void call_encrypt() {
        List<Object> list = new ArrayList<>(10);
        list.add(vm.getJNIEnv());
        list.add(0);
        list.add(vm.addLocalObject(new StringObject(vm, "http://app.weixin.sogou.com/api/searchapp")));
        list.add(vm.addLocalObject(new StringObject(vm, "type=2&ie=utf8&page=2&query=Python&select_count=0&usip=")));
        list.add(vm.addLocalObject(new StringObject(vm, "")));

        Number number = module.callFunction(emulator, 0x9ca0+1, list.toArray())[0];
        System.out.println("Result:" + vm.getObject(number.intValue()).getValue().toString());
    }

    public static void main(String[] args) {
        Sogou test = new Sogou();
        test.call_init();
        test.call_encrypt();
    }
}

代码仅供把玩。