10,733 views

Android閫嗗悜绯诲垪涔嬪姩鎬佽皟璇(鍏)–IDA璋冭瘯so鏂囦欢

111111111

涓銆佸墠濂
1.demo.apk銆両DA6.6浠ヤ笂銆乤db绛夊伐鍏凤紝鍏蜂綋鍙弬鑰冨伐鍏风瘒
demo.apk鐨勪富閫昏緫浠g爜濡備笅:

浠g爜閫昏緫

2.浠涔堟槸so鏂囦欢锛

so鏂囦欢鏄痷nix鐨勫姩鎬佽繛鎺ュ簱锛屾垜浠煡閬揂ndroid绯荤粺鏄被linux锛屾墍浠ヨ繖閲屼篃娌跨敤鍏跺姩鎬侀摼鎺ュ簱so锛屼竴鑸敤c璇█瀹炵幇锛屾槸浜岃繘鍒舵枃浠讹紝浣滅敤鐩稿綋浜巜indows涓嬬殑.dll鏂囦欢锛屽湪Android涓皟鐢ㄥ姩鎬佸簱鏂囦欢(*.so)閮芥槸閫氳繃jni鐨勬柟寮忋

Android涓姞杞絪o鏂囦欢鐨勬彁渚涚殑API: void System.load(String pathName);

Android绯荤粺鐩墠鏀寔浠ヤ笅涓冪涓嶅悓鐨凜PU鏋舵瀯锛欰RMv5锛孉RMv7 (浠2010骞磋捣)锛寈86 (浠2011骞磋捣)锛孧IPS (浠2012骞磋捣)锛孉RMv8锛孧IPS64鍜寈86_64 (浠2014骞磋捣)锛屾瘡涓绉嶉兘鍏宠仈鐫涓涓浉搴旂殑ABI銆傛垜浠皢apk瑙e帇鍚庯紝鍦/lib鐩綍涓嬪彲浠ョ湅鍒颁笉鍚宑pu鏋舵瀯鐨勬枃浠跺す锛屽叾涓殑so鏂囦欢鏄姛鑳界浉鍚岀殑锛屽彧鏄疄鐜扮殑鎸囦护绛夌粏鑺備笉鍚岋紝涓绘祦鏄疉RM鏋舵瀯锛屾墍浠ヨ繖閲屾垜浠篃鏄噸鐐瑰垎鏋恆rm涓嬬殑so鏂囦欢銆

3.鍒嗘瀽so鏂囦欢

涓鑸嗗悜so鏂囦欢锛屽厜鍔ㄦ佸垎鏋愪粛鏃ф槸涓嶅鐨勶紝涓鑸垜浠渶瑕佸厛闈欐佺畝鍗曞垎鏋愪竴涓嬶紝鍐嶇粨鍚堝姩鎬佽皟璇曪紝杩欐牱鎵嶈兘浜嬪崐鍔熷嶃

鎴戜滑鐩存帴灏唋ibencrypt.so鏂囦欢鎷栬繘IDA锛屽涓嬪浘:
闈欐乮da

杩欓噷鎴戜滑鎵惧埌 Java_绫诲悕_鏂规硶鍚 鐨勫嚱鏁帮紝閲嶇偣鍒嗘瀽杩欎釜鍑芥暟(褰撶劧鏈夋椂鍊欏苟娌℃湁java寮澶达紝杩欐椂鍙互鍊熷姪jd-gui绛夊伐鍏锋壘鍑哄嚱鏁板悕)

鎴戜滑绠鍗曞垎鏋愪笅arm浠g爜锛孊LX璋冪敤鍑芥暟锛岀劧鍚庢湁涓涓垽鏂烦杞紝鍐嶄娇鐢˙L璋冪敤 get_encrypt_str鍑芥暟锛岀劧鍚庢湁涓甯搁噺瀛楃涓诧紝鍐嶈皟鐢╯trcmp杩涜姣旇緝
(杩欓噷涓轰簡婕旂ず锛岀浉瀵归昏緫绠鍗曪紝褰撶劧闈欐佸垎鏋愬氨鍙互浜嗭紝浣嗚繖骞朵笉鏄洰鐨)

寮哄ぇ鐨凢5锛屽鏋淎RM鎸囦护鐪嬬潃璐瑰姴锛屽彲浠ヤ娇鐢‵5鏌ョ湅瀵瑰簲鐨刢璇█
Shirt+F12蹇嵎閿紝閫熷害鎵撳紑so涓墍鏈夌殑瀛楃涓插唴瀹圭獥鍙
c浼唬鐮
鍏蜂綋灏变笉鍒嗘瀽浜咰璇█浣犱滑姣旀垜鍘夊澶氫簡銆

闂鍒嗘瀽:杩欓噷鎴戜滑鐪嬩竴涓嬪垝绾垮锛屾槸涓嶆槸瑙夊緱鏈夌偣濂囪懇銆
瑙e喅鏂规硶:

杩樺師JNI鍑芥暟鏂规硶鍚嶏紝涓鑸琂NI鍑芥暟鏂规硶鍚嶉鍏堟槸涓涓寚閽堝姞涓婁竴涓暟瀛楋紝姣斿v3+676銆傜劧鍚庡皢杩欎釜鍦板潃浣滀负涓涓柟娉曟寚閽堣繘琛屾柟娉曡皟鐢紝骞朵笖绗竴涓弬鏁板氨鏄寚閽堣嚜宸憋紝姣斿(v3+676)(v3鈥)銆傝繖瀹為檯涓婂氨鏄垜浠湪JNI閲岀粡甯哥敤鍒扮殑JNIEnv鏂规硶銆傚洜涓篒da骞朵笉浼氳嚜鍔ㄧ殑瀵硅繖浜涙柟娉曡繘琛岃瘑鍒紝鎵浠ュ綋鎴戜滑瀵箂o鏂囦欢杩涜璋冭瘯鐨勬椂鍊欑粡甯镐細瑙佸埌鍗存悶涓嶆竻妤氳繖涓嚱鏁扮┒绔熷湪骞蹭粈涔堬紝鍥犱负杩欎釜鍑芥暟瀹炲湪鏄お鎶借薄浜嗐傝В鍐虫柟娉曢潪甯哥畝鍗曪紝鍙渶瑕佸JNIEnv鎸囬拡鍋氫竴涓被鍨嬭浆鎹㈠嵆鍙
閫変腑a1鍙橀噺锛岀劧鍚庢寜涓涓媦閿紝杈撳叆:JNIEnv*,纭畾鍗冲彲銆

浜屻佸噯澶囪皟璇
1.璋冭瘯鍑嗗
鍦↖DA鐩綍涓嬬殑dbgsrv鐩綍涓嬫壘鍒癮ndroid_server,鏄笉鏄湁鐐圭溂鐔燂紝鏄殑锛屾病閿欙紒鏈夌偣绫讳技gdbserver锛屾搷浣滀篃鏄被浼硷紝鍏蜂綋鍙煡鐪嬩笂涓绡囨枃绔;
adb remount
adb push android_server /system/bin
adb shell chmod 755 /system/bin/android_server
adb shell android_server
adb forward tcp:23946 tcp:23946

2.IDA-attach
妯℃嫙鍣ㄩ噷鍚姩瑕佽皟璇曠殑APP
鍚姩IDA锛屾墦寮debugger->attach->remote Armlinux/andoid debugger
濉啓hostname涓127.0.0.1鎴杔ocalhost(鎺ㄨ崘)锛岀鍙g‘瀹氫负23946鎴栦綘鑷畾涔夎浆鍙戠殑绔彛锛屽叾浠栭粯璁わ紝鐐瑰嚮纭畾
寮瑰嚭Choose process to attach to绐楀彛锛屾壘鍒癮pp鐨勮繘绋嬪悕锛岀偣鍑籵k锛岀瓑寰呭垎鏋愬悗鍗冲彲杩涘叆璋冭瘯鐣岄潰
杩涘叆璋冭瘯鐣岄潰

闂鍒嗘瀽:涓轰粈涔堜細鏂湪libc.so涓
闂瑙e喅:
android绯荤粺涓璴ibc鏄痗灞備腑鏈鍩烘湰鐨勫嚱鏁板簱锛宭ibc涓皝瑁呬簡io銆佹枃浠躲乻ocket绛夊熀鏈郴缁熻皟鐢ㄣ傛墍鏈変笂灞傜殑璋冪敤閮介渶瑕佺粡杩噇ibc灏佽灞傘傛墍浠ibc.so鏄渶鍩烘湰鐨勶紝鎵浠ヤ細鏂湪杩欓噷锛岃屼笖鎴戜滑杩橀渶瑕佺煡閬撲竴浜涘父鐢ㄧ殑绯荤粺so,姣斿linker;杩欎釜linker鏄敤浜庡姞杞絪o鏂囦欢鐨勬ā鍧楋紝濡備綍鍦.init_array澶勪笅鏂偣;杩樻湁涓涓氨鏄痩ibdvm.so鏂囦欢锛屼粬鍖呭惈浜咲VM涓墍鏈夌殑搴曞眰鍔犺浇dex鐨勪竴浜涙柟娉

3.瀹氫綅鍑芥暟
浣跨敤蹇嵎閿瓹trl+s鎵撳紑segment绐楀彛锛岄夋嫨so鏂囦欢锛岃繖閲屽彲浠ヤ娇鐢–trl+f杩涜鎼滅储锛涘悓鏃惰繖閲岄渶瑕佽涓媠o鏂囦欢鐨勮捣濮嬪湴鍧(A8924000)
鐢ㄥ彟涓涓狪DA鎵撳紑so鏂囦欢锛屾壘鍒板搴斿嚱鏁扮殑渚垮疁浣嶇疆锛屽湪涓婇潰鐨勫浘鍙互鐪嬪埌鍋忕Щ涓:00000E9C
缁濆鍦板潃=鍩哄潃+鍋忕Щ鍦板潃=A8924000+00000E9C=A8924E9C
鎸変笅蹇嵎閿瓽锛岃緭鍏8924E9C鍗冲彲璺宠浆鍒版纭殑鍑芥暟銆傜劧鍚庝娇鐢‵2鎴栬呯偣鍑诲墠闈㈢殑灏忓渾鐐 涓嬩竴涓柇鐐
G

闂鍒嗘瀽:绐楀彛閲屾湁澶氫釜so鏂囦欢鎬庝箞鍔烇紵搴旇閫夋嫨鍝竴涓紵
闂瑙e喅:
鍏跺疄杩欓噷骞朵笉鏄涓猻o鏂囦欢锛岃屾槸so鏂囦欢瀵瑰簲鐨勪笉鍚孲egement淇℃伅琚槧灏勫埌鍐呭瓨涓紝鍖呮嫭浠g爜娈碉紝鏁版嵁娈电瓑锛屽緢鏄庢樉锛屼唬鐮佹浼氭湁鎵ц鏉冮檺鐨勭壒鐐癸紝鎵浠ユ垜浠夋嫨甯︽湁X灞炴х殑so鏂囦欢锛屽嵆鏄垜浠兂瑕佽皟璇曠殑so鏂囦欢銆
so鏂囦欢杞

4.璋冭瘯
鎸塅9鎴栫偣鍑荤豢鑹蹭笁瑙掑舰鎸夐挳杩愯绋嬪簭
瑙﹀彂鏂偣:杩欓噷鏄偣鍑荤▼搴忕殑鎸夐挳锛屽叿浣撹搴旂敤涓嶅悓鑰屼笉鍚
鎺ョ潃灏辨槸F7/F8璋冭瘯鐨勫父瑙勬楠や簡锛侊紒

鍙傝冭祫鏂: http://blog.csdn.net/jiangwei0910410003/article/details/51500328

鏈枃灞炰簬鍘熷垱锛岃浆杞借娉ㄦ槑鏉ヨ嚜tasfa.cn 濡傛湁闂璇疯仈绯荤鐞嗗憳 root@tasfa.cn

鍙戣〃璇勮

鐢靛瓙閭欢鍦板潃涓嶄細琚叕寮銆

You must enable javascript to see captcha here!