一择诈、目標(biāo)
我們來(lái)分析某站 App的sign簽名算法颖医，先搜索一下 游戲 备籽，抓包結(jié)果:
bsign.png
二庐完、步驟
這個(gè)sign依然是32位的字符串
都9020年了钢属，這種規(guī)模用戶(hù)的App應(yīng)該是不會(huì)裸奔在java層了，我們就直接一點(diǎn)门躯，在so里面搜索 sign=
可惜沒(méi)有結(jié)果……
藏起來(lái)的東西一定是重要的東西
so層導(dǎo)出函數(shù)給java層調(diào)用淆党，有兩種方法，一種是靜態(tài)注冊(cè)讶凉，直接會(huì)體現(xiàn)在so的導(dǎo)出表里染乌。 一種是RegisterNatives來(lái)動(dòng)態(tài)注冊(cè)，這種就比較隱晦了懂讯，從導(dǎo)出表里看不到痕跡荷憋。
所以我們Hook下RegisterNatives，看看它藏了什么褐望？
// hook register 打印動(dòng)態(tài)注冊(cè)的函數(shù)地址
function hook_register(){
// libart.so 所有導(dǎo)出函數(shù)表
var symbols = Module.enumerateSymbolsSync("libart.so");
var addr_register = null;
for(var i = 0; i < symbols.length; i++){
var symbol = symbols[i];
var method_name = symbol.name;
if(method_name.indexOf("art") >= 0){
if(method_name.indexOf("_ZN3art3JNI15RegisterNativesEP7_JNIEnvP7_jclassPK15JNINativeMethodi") >= 0){
addr_register = symbol.address;
}
}
}
// 開(kāi)始hook
if(addr_register){
Interceptor.attach(addr_register, {
onEnter: function(args){
var methods = ptr(args[2]);
var method_count = args[3];
console.log("[RegisterNatives] method_count:", method_count);
for(var i = 0; i < method_count; i++){
var fn_ptr = methods.add(i * Process.pointerSize * 3 + Process.pointerSize * 2).readPointer();
var find_module = Process.findModuleByAddress(fn_ptr);
if(i == 0){
console.log("module name", find_module.name);
console.log("module base", find_module.base);
}
console.log("\t method_name:", methods.add(i * Process.pointerSize * 3).readPointer().readCString(), "method_sign:", methods.add(i * Process.pointerSize * 3 + Process.pointerSize).readPointer().readCString(), "method_fnPtr:", fn_ptr, "method offset:", fn_ptr.sub(find_module.base));
}
}, onLeave(retval){
}
})
}
}
掛上我心愛(ài)的frida勒庄，跑起來(lái)……
這種函數(shù)命名可讀性這么好，望文生義就知道不是做sign
[RegisterNatives] method_count: 0x6
module name libimagepipeline.so
module base 0x7c29c000
method_name: nativeAllocate method_sign: (I)J method_fnPtr: 0x7c29cc6d method offset: 0xc6d
method_name: nativeFree method_sign: (J)V method_fnPtr: 0x7c29ccb5 method offset: 0xcb5
method_name: nativeCopyToByteArray method_sign: (J[BII)V method_fnPtr: 0x7c29ccbb method offset: 0xcbb
method_name: nativeCopyFromByteArray method_sign: (J[BII)V method_fnPtr: 0x7c29ccd7 method offset: 0xcd7
method_name: nativeMemcpy method_sign: (JJI)V method_fnPtr: 0x7c29ccf3 method offset: 0xcf3
method_name: nativeReadByte method_sign: (J)B method_fnPtr: 0x7c29ccff method offset: 0xcff
這個(gè) libbili.so 大兄弟看上去不像好人瘫里，都9020年了实蔽，函數(shù)命名個(gè) a、b谨读、s之類(lèi)局装，這么明目張膽的寫(xiě)bug，在我司是要被李老板拉出去打PP的。
[RegisterNatives] method_count: 0x7
module name libbili.so
module base 0x88e2b000
method_name: a method_sign: (Ljava/lang/String;)Ljava/lang/String; method_fnPtr: 0x88e2cc35 method offset: 0x1c35
method_name: ao method_sign: (Ljava/lang/String;II)Ljava/lang/String; method_fnPtr: 0x88e2cc3b method offset: 0x1c3b
method_name: b method_sign: (Ljava/lang/String;)Ljavax/crypto/spec/IvParameterSpec; method_fnPtr: 0x88e2cc49 method offset: 0x1c49
method_name: s method_sign: (Ljava/util/SortedMap;)Lcom/bilibili/nativelibrary/SignedQuery; method_fnPtr: 0x88e2cc4f method offset: 0x1c4f
method_name: so method_sign: (Ljava/util/SortedMap;II)Lcom/bilibili/nativelibrary/SignedQuery; method_fnPtr: 0x88e2cc55 method offset: 0x1c55
method_name: getCpuCount method_sign: ()I method_fnPtr: 0x88e2cc63 method offset: 0x1c63
method_name: getCpuId method_sign: ()I method_fnPtr: 0x88e2cc67 method offset: 0x1c67
既然不是好人铐尚，那就問(wèn)詢(xún)一下拨脉，Hook之:
var biliNative = Java.use("com.bilibili.nativelibrary.LibBili");
biliNative.a.implementation = function(a){
var result = this.a(a);
console.log("biliNative a(" + a + ") = " + result);
return result;
}
biliNative.ao.implementation = function(a,b,c){
var result = this.ao(a,b,c);
console.log("biliNative ao(" + a + "," + b + "," + c + ") = " + result);
return result;
}
biliNative.b.overload('java.lang.String').implementation = function(a){
var result = this.b(a);
console.log("biliNative b(" + a + ") = " + result);
return result;
}
biliNative.s.implementation = function(map){
var result = this.s(map);
console.log("biliNative s(" + map + ") = " + result);
return result;
}
biliNative.so.implementation = function(a,b,c){
var result = this.so(a,b,c);
console.log("biliNative so(" + a + "," + b + "," + c + ") = " + result);
return result;
}
現(xiàn)形了，收工塑径。
signshow.png
慢著女坑！李老板出場(chǎng)了，為什么老板總在下班的時(shí)候出現(xiàn)统舀？上班的時(shí)候他們干什么去了匆骗？(?╯︵╰?)
奮飛呀，簽名是出來(lái)的誉简，但是入?yún)⒛氐锞停磕憧偛荒芨嬖V我入?yún)⑹莻€(gè)Object吧？
搞SortedMap入?yún)?/h3>
入?yún)闹按蛴〉慕Y(jié)果可以看出來(lái)闷串，是個(gè) Ljava/util/SortedMap;, 那就so easy了瓮钥，把它打印出來(lái)即可。
半小時(shí)后…… 找了一圈google只告訴了我一個(gè) HashMap 的打印方法烹吵，不管了碉熄，先打出來(lái)
biliNative.s.implementation = function(HashMap){
var result = this.s(HashMap);
var keys = HashMap.keySet();
var key_set = keys.iterator();
while (key_set.hasNext()) {
var key = key_set.next().toString();
var value = HashMap.get(key).toString();
console.log(key + ": " + value);
}
console.log("biliNative s(" + HashMap + ") = " + result);
return result;
}
繼續(xù)跑，Duang.....
{'type': 'error', 'description': "TypeError: undefined not callable (property 'get' of [object Object])", 'stack': "TypeError: undefined not callable (property 'get' of [object Object])\n at [anon] (../../../frida-gum/bindings/gumjs/duktape.c:67616)\n at /script1.js:111\n at je (frida/node_modules/frida-java-bridge/lib/class-factory.js:633)\n at frida/node_modules/frida-java-bridge/lib/class-factory.js:616", 'fileName': '/script1.js', 'lineNumber': 111, 'columnNumber': 1}
貌似是說(shuō) SortedMap沒(méi)有g(shù)et()這個(gè)方法 ????
魯迅先生曾經(jīng)說(shuō)過(guò)：年輕人不能偷懶肋拔，到處抄代碼是不對(duì)的锈津。
lx.jpg
先查查java文檔，分析下 SortedMap 的成員函數(shù)凉蜂，其實(shí)奮飛也是個(gè)優(yōu)秀的java程序員琼梆。
- java.util.SortedMap.comparator() //接收比較器，用于Map排序
- java.util.SortedMap.entrySet() //后去Map中的entrySet集合
- java.util.SortedMap.firstKey() //第一個(gè)key
- java.util.SortedMap.headMap(K k) //在k之前的鍵值對(duì)
- java.util.SortedMap.keySet() //獲取key的set集合
- java.util.SortedMap.lastKey() //最后的key
- java.util.SortedMap.subMap(K k1, K k2) //k1窿吩，k2之間的鍵值對(duì)
- java.util.SortedMap.tailMap(K) //集合最后的鍵值對(duì)
- java.util.SortedMap.values() //集合所有的values
好吧茎杂，那就簡(jiǎn)單了，我們先把 key 遍歷出來(lái)纫雁，然后在把 values() 打印出來(lái)煌往。
哪位同學(xué)有更好的辦法，請(qǐng)給奮飛留言.Orz
TIP: 網(wǎng)友：飛雪的日子先较，提供了一個(gè)更帥的方式 console.log(map.entrySet().toArray());
biliNative.s.implementation = function(map){
var result = this.s(map);
var keyStr = ""
var keys = map.keySet();
var key_set = keys.iterator();
while (key_set.hasNext()) {
var key = key_set.next().toString();
keyStr += ","+key
}
console.log(keyStr)
console.log(map.values().toArray());
console.log("biliNative s(" + map + ") = " + result);
return result;
}
嗯嗯携冤，效果不錯(cuò)，打印出來(lái)了闲勺，收工
rc.png
三、總結(jié)
好東西要藏起來(lái)扣猫，逆向一下菜循，藏起來(lái)的肯定是好東西(^_~)
