菱菱邦signature及sd参数分析
image-20211230140326245
headers有signature，请求参数和返回结果里有sd
apk有壳，然后脱壳的时候出了个小问题，使用blackdex脱出来只有一个dex文件，打开查看也没有看到主要代码。转而使用fdex脱壳，这次就没问题了。
脱出来有很多个dex文件，一个个查找虽然也可以，但是略显麻烦，而且有时候需要跳转代码而两个方法又不在同一个dex里的话，就很头痛。
一种方法是把dex转成java代码，放到同一个文件夹，然后用ide打开，可以使用jdax的命令
jadx -j 1 -r -d dst a.dex
另一种就是用脱壳出来的dex替换原来的dex，生成新的apk文件，然后用jadx打开，需要注意的是，这里并没有处理签名问题，在手机上安装的话应该是会出问题的，但是只是用于jdax分析的话还是没问题的。
这里选择第二种方式
import pathlib
import zipfile
def get_files(dex_dir):
fdir = pathlib.Path(dex_dir)
infos = {}
for item in fdir.glob('*.dex'):
size = item.stat().st_size
infos[size] = item
fdict = {}
for idx, key in enumerate(sorted(infos, reverse=True)):
name = 'classes{}.dex'.format(str(idx) if idx else '')
fdict[name] = infos[key]
return fdict
def pack(apk_path, dex_dir):
dst = apk_path + '.pack.apk'
with zipfile.ZipFile(apk_path) as zf, zipfile.ZipFile(dst, 'w') as zout:
for item in zf.infolist():
if item.filename.startswith('classes') and item.filename.endswith('.dex'):
print('Ignore:', item.filename)
elif item.filename.startswith('res/'):
pass
else:
buffer = zf.read(item.filename)
zout.writestr(item, buffer)
for filename, fpath in get_files(dex_dir).items():
print('Add:', fpath)
zinfo = zipfile.ZipInfo(filename)
with open(fpath, 'rb') as fin:
zout.writestr(zinfo, fin.read())
if __name__ == '__main__':
pack(r"linglingbang\linglingbang8011.apk", r"linglingbang\linglingbangfdex")
image-20211230144210341
image-20211230144304813
可以看到jdax能够正常解析。
查找"signature"
image-20211230144509760
com.cloudy.linglingbang.model.request.retrofit2.RequestUtils -> addTokenAndSignature
image-20211230144624687
可以看到有nonce，有oauthConsumerKey，应该就是这里了，hook验证一下。
请求参数和返回结果分析
搜索"sd"
image-20211230144820278
image-20211230144925133
然乎查找用例
com.cloudy.linglingbang.model.request.retrofit2.CheckCodeUtils -> decodeContent
image-20211230145016901
com.cloudy.linglingbang.model.request.retrofit2.CheckCodeUtils -> decrypt
image-20211230145110253
com.bangcle.comapiprotect.CheckCodeUtil -> decheckcode
image-20211230145205477
image-20211230145326901
checkcode和decheckcode应该就是加密和解密的地方。
image-20211230145426172
可以看到最后调用的是libencrypt.so里面的函数
unidbg实现
decheckcode部分
打开so大致看了下，直接逆向还是有点难度的，所以还是先用unidbg实现，然后unidbg结合ida来逆向，比较节省精力。
package com.linglingbang;
import com.github.unidbg.AndroidEmulator;
import com.github.unidbg.Module;
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import com.github.unidbg.linux.android.AndroidResolver;
import com.github.unidbg.linux.android.dvm.*;
import com.github.unidbg.memory.Memory;
import java.io.File;
import java.util.ArrayList;
import java.util.List;
public class LingLingBang extends AbstractJni {
private final AndroidEmulator emulator;
private final VM vm;
private final Module module;
public static String pkgName = "com.cloudy.linglingbang";
public static String apkPath = "unidbg-android/src/test/java/com/linglingbang/linglingbang8011.apk";
public static String soPath = "unidbg-android/src/test/java/com/linglingbang/libencrypt.so";
public LingLingBang() {
emulator = AndroidEmulatorBuilder.for32Bit().setProcessName(pkgName).build();
Memory memory = emulator.getMemory();
memory.setLibraryResolver(new AndroidResolver(23));
vm = emulator.createDalvikVM(new File(apkPath));
vm.setJni(this);
vm.setVerbose(true);
DalvikModule dm = vm.loadLibrary(new File(soPath), true);
module = dm.getModule();
}
public void call_decheckcode() {
List<Object> list = new ArrayList<>(10);
list.add(vm.getJNIEnv());
list.add(0);
list.add(vm.addLocalObject(new StringObject(vm, "MLj4JOPMKPdGeytkeBPy/TvgGCgIOWegKndYgDVbmrctTnrov1z7Uei09BKfKhlW/xnLMOg1HaIN7llJqgPFjmayzV1OI2Rqd7heXxQw1VAmVCe6yXyiiyQ5OHaZ7hhRm5BRpmlFqgY1ebjsv8WPnnw+OZXydnPcySv4Lt5bwmHrOQfygHI7KhDFN40NU8/Csuumues12zRmtaQH9ycfD8fnu27yxX0UQeZBL/VPS+UVNrAwPtjFWrahQztLD3btpjWPXVttVzQZWcLl05iS1hg==")));
Number ret = module.callFunction(emulator, 0x165e0+1, list.toArray());
System.out.println(vm.getObject(ret.intValue()).getValue());
}
public static void main(String[] args) {
LingLingBang test = new LingLingBang();
test.call_decheckcode();
}
}
之后就是循环的报错和补环境
image
@Override
public DvmObject<?> callStaticObjectMethod(BaseVM vm, DvmClass dvmClass, String signature, VarArg varArg) {
switch (signature) {
case "android/app/ActivityThread->currentPackageName()Ljava/lang/String;": {
return new StringObject(vm, "com.cloudy.linglingbang");
}
}
return super.callStaticObjectMethod(vm, dvmClass, signature, varArg);
}
image-20220106171834454
case "android/app/ActivityThread->currentActivityThread()Landroid/app/ActivityThread;": {
return vm.resolveClass("android/app/ActivityThread").newObject(null);
}
image-20220106172004674
@Override
public DvmObject<?> callObjectMethod(BaseVM vm, DvmObject<?> dvmObject, String signature, VarArg varArg) {
switch (signature) {
case "android/app/ActivityThread->getSystemContext()Landroid/app/ContextImpl;": {
return vm.resolveClass("android/app/ContextImpl").newObject(null);
}
}
return super.callObjectMethod(vm, dvmObject, signature, varArg);
}
image-20220106172051867
case "android/app/ContextImpl->getPackageManager()Landroid/content/pm/PackageManager;": {
return vm.resolveClass("android/content/pm/PackageManager").newObject(null);
}
再次运行后，发现有结果了，但是结果不太对
image-20220106172221305
这时候就需要用ida看看问题了，跳转到0x166cd。然后再往前面看看
image
看看sub_138AC
image-20220106172602610
也许是签名校验？我们尝试patch这部分代码，修改if(!v6)这个判断语句，查看对应的汇编代码
image-20220106173626117
原指令是CBNZ，我们修改为CBZ，对应的指令可以用Patcher测试
image-20220106173848010
unidbg对应代码
public void patchVerify(){
emulator.getMemory().pointer(module.base + 0x16605).setInt(0, 0x000020B1);
}
public static void main(String[] args) {
LingLingBang test = new LingLingBang();
test.patchVerify();
test.call_decheckcode();
}
重新运行
image-20220106174746995
结果出来了，H4sI是一个比较熟悉东西，它是gzip的头\x1f\x8b\x08经过base64后的结果，我们在cyberchef上验证一下
image-20220106175018133
猜测没错，所以解密的流程就是b64decode -> aes_decrypt -> b64decode -> gunzip。
checkcode部分
添加代码
public void call_checkCode() {
DvmClass clz = vm.resolveClass("com/bangcle/comapiprotect/CheckCodeUtil");
DvmObject ret = clz.callStaticJniMethodObject(emulator, "checkcode(Ljava/lang/String;ILjava/lang/String;)Ljava/lang/String;",
"hello", 2, "everhu");
System.out.println(ret.getValue());
}
同样的报错和补环境
image-20220106175741601
@Override
public DvmObject<?> getStaticObjectField(BaseVM vm, DvmClass dvmClass, String signature) {
switch (signature) {
case "android/os/Build->MODEL:Ljava/lang/String;": {
return new StringObject(vm, "Pixel");
}
}
return super.getStaticObjectField(vm, dvmClass, signature);
}
image-20220106175854011
case "android/os/Build->MANUFACTURER:Ljava/lang/String;": {
return new StringObject(vm, "Google");
}
image-20220106175948642
case "android/os/SystemProperties->get(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;": {
String key = (String) varArg.getObjectArg(0).getValue();
String val2 = (String) varArg.getObjectArg(1).getValue();
System.out.println("get:" + key + " val:" + val2);
return new StringObject(vm, "unknown");
}
image-20220106180035226
case "android/app/ContextImpl->getSystemService(Ljava/lang/String;)Ljava/lang/Object;": {
return vm.resolveClass("java/lang/Object").newObject(null);
}
image-20220106180124532
case "java/lang/Object->getConnectionInfo()Landroid/net/wifi/WifiInfo;": {
return vm.resolveClass("android/net/wifi/WifiInfo").newObject(null);
}
image-20220106180221867
case "android/net/wifi/WifiInfo->getMacAddress()Ljava/lang/String;": {
return new StringObject(vm, "02:00:00:00:00:00");
}
image-20220106180257388
case "android/os/Build$VERSION->SDK:Ljava/lang/String;": {
return new StringObject(vm, "23");
}
再次运行
image-20220106193752406
这个结果的输入到底是什么呢，我们把它作为decheckcode的输入看看
image-20220106193726821
可以看到除了checkcode之外，其他参数都比较容易构造，猜测应该是做了个MD5签名之后再做AES加密。
完整代码
package com.linglingbang;
import com.github.unidbg.AndroidEmulator;
import com.github.unidbg.Module;
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import com.github.unidbg.linux.android.AndroidResolver;
import com.github.unidbg.linux.android.dvm.*;
import com.github.unidbg.memory.Memory;
import java.io.File;
import java.util.ArrayList;
import java.util.List;
public class LingLingBang extends AbstractJni {
private final AndroidEmulator emulator;
private final VM vm;
private final Module module;
public static String pkgName = "com.cloudy.linglingbang";
public static String apkPath = "unidbg-android/src/test/java/com/linglingbang/linglingbang8011.apk";
public static String soPath = "unidbg-android/src/test/java/com/linglingbang/libencrypt.so";
public LingLingBang() {
emulator = AndroidEmulatorBuilder.for32Bit().setProcessName(pkgName).build();
Memory memory = emulator.getMemory();
memory.setLibraryResolver(new AndroidResolver(23));
vm = emulator.createDalvikVM(new File(apkPath));
vm.setJni(this);
vm.setVerbose(true);
DalvikModule dm = vm.loadLibrary(new File(soPath), true);
module = dm.getModule();
}
@Override
public DvmObject<?> callObjectMethod(BaseVM vm, DvmObject<?> dvmObject, String signature, VarArg varArg) {
switch (signature) {
case "android/app/ActivityThread->getSystemContext()Landroid/app/ContextImpl;": {
return vm.resolveClass("android/app/ContextImpl").newObject(null);
}
case "android/app/ContextImpl->getPackageManager()Landroid/content/pm/PackageManager;": {
return vm.resolveClass("android/content/pm/PackageManager").newObject(null);
}
case "android/app/ContextImpl->getSystemService(Ljava/lang/String;)Ljava/lang/Object;": {
return vm.resolveClass("java/lang/Object").newObject(null);
}
case "java/lang/Object->getConnectionInfo()Landroid/net/wifi/WifiInfo;": {
return vm.resolveClass("android/net/wifi/WifiInfo").newObject(null);
}
case "android/net/wifi/WifiInfo->getMacAddress()Ljava/lang/String;": {
return new StringObject(vm, "02:00:00:00:00:00");
}
}
return super.callObjectMethod(vm, dvmObject, signature, varArg);
}
@Override
public DvmObject<?> callStaticObjectMethod(BaseVM vm, DvmClass dvmClass, String signature, VarArg varArg) {
switch (signature) {
case "android/app/ActivityThread->currentPackageName()Ljava/lang/String;": {
return new StringObject(vm, "com.cloudy.linglingbang");
}
case "android/app/ActivityThread->currentActivityThread()Landroid/app/ActivityThread;": {
return vm.resolveClass("android/app/ActivityThread").newObject(null);
}
case "android/os/SystemProperties->get(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;": {
String key = (String) varArg.getObjectArg(0).getValue();
String val2 = (String) varArg.getObjectArg(1).getValue();
System.out.println("get:" + key + " val:" + val2);
// switch (key){
// case "ro.serialno": return new StringObject(vm, "FA6AT0306923");
// }
return new StringObject(vm, "unknown");
}
}
return super.callStaticObjectMethod(vm, dvmClass, signature, varArg);
}
@Override
public DvmObject<?> getStaticObjectField(BaseVM vm, DvmClass dvmClass, String signature) {
switch (signature) {
case "android/os/Build->MODEL:Ljava/lang/String;": {
return new StringObject(vm, "Pixel");
}
case "android/os/Build->MANUFACTURER:Ljava/lang/String;": {
return new StringObject(vm, "Google");
}
case "android/os/Build$VERSION->SDK:Ljava/lang/String;": {
return new StringObject(vm, "23");
}
}
return super.getStaticObjectField(vm, dvmClass, signature);
}
public void patchVerify(){
emulator.getMemory().pointer(module.base + 0x16605).setInt(0, 0x000020B1);
//emulator.getMemory().pointer(module.base + 0x13fc6).setInt(0, 0x00000128);
}
public void call_checkCode() {
DvmClass clz = vm.resolveClass("com/bangcle/comapiprotect/CheckCodeUtil");
DvmObject ret = clz.callStaticJniMethodObject(emulator, "checkcode(Ljava/lang/String;ILjava/lang/String;)Ljava/lang/String;",
"hello", 2, "everhu");
System.out.println(ret.getValue());
}
public void call_decheckcode() {
List<Object> list = new ArrayList<>(10);
list.add(vm.getJNIEnv());
list.add(0);
// list.add(vm.addLocalObject(new StringObject(vm, "MLj4JOPMKPdGeytkeBPy/TvgGCgIOWegKndYgDVbmrctTnrov1z7Uei09BKfKhlW/xnLMOg1HaIN7llJqgPFjmayzV1OI2Rqd7heXxQw1VAmVCe6yXyiiyQ5OHaZ7hhRm5BRpmlFqgY1ebjsv8WPnnw+OZXydnPcySv4Lt5bwmHrOQfygHI7KhDFN40NU8/Csuumues12zRmtaQH9ycfD8fnu27yxX0UQeZBL/VPS+UVNrAwPtjFWrahQztLD3btpjWPXVttVzQZWcLl05iS1hg==")));
list.add(vm.addLocalObject(new StringObject(vm, "MwUaGPev8Eg0vAo+U6kQ5Rttn7JWhJrZ85kPHQbs7GNNYdHWOMLSUvdCTzcAFoO1302KS4qdH/j1e8A8ghHpjD7NWW3gOeoj4nQDXWAqHmx+vyiMG9yxL2PRdIOpFnT5AH62scsuuSYlj3KYmn7ZX9x78pINtVXJFkUcM8ITyW0xFhXadqqY2djgjTjflJU6A")));
Number ret = module.callFunction(emulator, 0x165e0+1, list.toArray());
System.out.println(vm.getObject(ret.intValue()).getValue());
}
public static void main(String[] args) {
LingLingBang test = new LingLingBang();
test.patchVerify();
// test.call_checkCode();
test.call_decheckcode();
}
}
网友评论