《2015移动安全挑战赛----自毁程序密码(第二题)》分析
本帖最后由 nsnj 于 2015-1-29 12:38 编辑这是阿里巴巴和看雪一起搞的一起活动, 活动主页: http://msc.pediy.com/timu.htm第二个题目要求分析程序, 获取正确的密码. 这里就不贴截图了(因为论坛限制帖子最多1w字节, 已经超了-_-!)(更新: 现在已经支持100w字节了, 感谢鬼哥, 感谢 Hm)
APK文件下载链接: http://pan.baidu.com/s/1ntiKXg1 密码: 37xw其中, AliCrackme_2.apk是原安装包, signed.apk是包含修改后so文件的安装包.
这是第一次分析调试so, 并且该程序还使用了反调试手段, 因此写在这里记录一下, 发在这里也可以让大家指点一下, 谢谢~
调试so:1, 将so拖到IDA中;2, 启动调试: adb shell am start -D -ncom.yaotong.crackme/com.yaotong.crackme.MainActivity;3, 将IDA 中的 dbgsrv 目录下的 android_server 上传到Android中并以root权限执行:adb push IDA安装目录\dbgsrv\android_server /data/local/tmp
adb shell
su
chmod 774 /data/local/tmp/android_server
/data/local/tmp/android_server
4, 端口转发: adb forward tcp:23946tcp:23946;5, 设置IDA的 Debugger Options, 选中在加载so时暂停程序, 然后附加到被调试进程中, 之后按 F9 开始执行程序;6, 执行命令 "c:\ProgramFiles\Java\jdk1.7.0_71\bin\jdb.exe" -connect com.sun.jdi.SocketAttach:hostname=127.0.0.1,port=8700, 稍等一下IDA就会有反应了, 此时在 JNI_OnLoad 函数上下断点即可.
分析 JNI_OnLoad 函数可知,其在函数 sub_750ADCA8 获取 dlsym, getpid, sprintf, fopen, kill 等函数地址.
然后通过以上函数检查当前进程是否被调试, 检测方法: 读取 /proc/<pid>/status 的 TracePid 字段, 如果程序没有被调试, 该字段值为0, 否则就是调试器的进程PID.如果该值不为0, 则给当前进程发送信号 SIGKILL,结束进程.
OK, 我们修改so文件, 将 SIGKILL 信号修改为 0 信号(0信号没有任何副作用, 只用来检测进程是否存在), 将偏移为 0x15D8 的 B G E loc_1600 (机器码 为 08 00 00 AA) 修改为 BLE loc_1600(机器码为 08 00 00 DA ).重新打包并调试, 在验证用户输入的函数 Java_com_yaotong_crackme_MainActivity_securityCheck 下断点, 等程序停下来后, 查看原字符串为 wojiushidaan 的位置, 这里就是密钥了~密钥是 aiyou,bucuoo
另外, IDA分析so时, IDA不能识别参数类型, 需要手动设置一下, 例如导出表中java调用的函数的前两个参数固定是 JNIEnv* 和 jobject, 然后像这种 v5 = (*(int (__fastcall**)(int, int, _DWORD))(*(_DWORD *)v3 + 676))(v3, v4, 0); 就会识别为 v5 = ((int (__fastcall*)(JNIEnv *, int, _DWORD))(*v3)->GetStringUTFChars)(v3, v4, 0);, 否则根本没法看, 你说是不?(求大牛轻喷~)
参考链接:· Ida调试so文件· 调试smail(解密所有APP运行过程中的内部逻辑)
附录:1. JNI_OnLoad函数:signed int __fastcall JNI_OnLoad(JavaVM *a1)
{
int v1; // r4@0
int v2; // r5@0
int v3; // r6@0
int v4; // r7@0
int v5; // r8@0
int v6; // r9@0
int v7; // lr@0
JavaVM *vm; // r4@1
int v9; // r5@1
int v10; // r6@3
int v11; // r6@5
int v12; // r0@7
signed int v13; // r6@7
_DWORD handle; // @1
char vars0; // @1
int _24; // @1
handle = v1;
handle = v2;
handle = v3;
handle = v4;
handle = v5;
handle = v6;
*(_DWORD *)&vars0 = &vars0;
_24 = v7;
vm = a1;
dword_752612C8 = 0;
v9 = dword_752612C4;
if ( dword_752612C4 )
{
do
{
if ( *(_DWORD *)v9 >= 1 )
{
v10 = 0;
do
(*(void (**)(void))(v9 + 4 + 4 * v10++))(); // 获取 getpid, sprintf, fopen, kill, strstr等函数地址
while ( v10 < *(_DWORD *)v9 );
}
v11 = *(_DWORD *)(v9 + 44);
free((void *)v9);
v9 = v11;
}
while ( v11 );
dword_752612C4 = 0;
}
handle[-2] = 0;
v12 = func_pthread_create(handle, 0, sub_7525C6A4, 0); // 创建新线程, 死循环检测是否被调试
sub_7525C7F4(v12); // 解密密钥
v13 = 65540;
if ( ((int (__fastcall *)(JavaVM *, _DWORD *, signed int))(*vm)->GetEnv)(vm,&handle[-2], 65540) )
v13 = -1;
return v13;
}
2. 获取 getpid, sprintf, fopen, kill, strstr等函数地址的函数:int (*sub_4BE36CA8())(void)
{
void *v0; // r4@3
int (*func_lrand48)(void); // r0@27
if ( !byte_4BE3B35F )
{
sub_4BE374F4((int)&str_dlsym, 6, (int)&unk_4BE39509, (int)"9HbB", 4u, 197);
byte_4BE3B35F = 1;
}
v0 = dlsym((void *)0xFFFFFFFF, (const char *)&str_dlsym);
if ( !flag_getpid )
{
sub_4BE374F4((int)&str_getpid, 7, (int)&unk_4BE3948B, (int)"m7", 2u, 213);
flag_getpid = 1;
}
func_getpid = (int (*)(void))((int (__fastcall *)(signed int, _UNKNOWN *))v0)(-1, &str_getpid);
if ( !flag_sprintf )
{
sub_4BE3739C((int)&str_sprintf, 8, (int)&unk_4BE394F3, (int)"LNAt", 4u);
flag_sprintf = 1;
}
func_sprintf = ((int (__fastcall *)(signed int, _UNKNOWN *))v0)(-1, &str_sprintf);
if ( !flag_fopen )
{
sub_4BE3739C((int)&str_fopen, 6, (int)"0磢w湧", (int)"cOXt", 4u);
flag_fopen = 1;
}
func_fopen = ((int (__fastcall *)(_DWORD, _UNKNOWN *))v0)(-1, &str_fopen);
if ( !flag_fgets )
{
sub_4BE374F4((int)&str_fgets, 6, (int)"┑阜罸", (int)"BMT", 3u, 1);
flag_fgets = 1;
}
func_fgets = (int (__fastcall *)(_DWORD, _DWORD, _DWORD))((int (__fastcall *)(_DWORD, _UNKNOWN *))v0)(-1, &str_fgets);
if ( !flag_strstr )
{
sub_4BE3739C((int)&str_strstr, 7, (int)&unk_4BE394C4, (int)&unk_4BE394C1, 2u);
flag_strstr = 1;
}
func_strstr = ((int (__fastcall *)(_DWORD, _UNKNOWN *))v0)(-1, &str_strstr);
if ( !flag_sscanf )
{
sub_4BE3754C((int)&str_sscanf, 7, (int)"构73€", (int)&unk_4BE394FC, 0, 1);
flag_sscanf = 1;
}
func_sscanf = ((int (__fastcall *)(_DWORD, _UNKNOWN *))v0)(-1, &str_sscanf);
if ( !flag_kill )
{
sub_4BE3754C((int)&str_kill, 5, (int)"66€", (int)&unk_4BE394FC, 0, 1);
flag_kill = 1;
}
func_kill = ((int (__fastcall *)(_DWORD, _UNKNOWN *))v0)(-1, &str_kill);
if ( !flag_sleep )
{
sub_4BE3754C((int)&str_sleep, 6, (int)"9恫28€", (int)&unk_4BE394FC, 0, 1);
flag_sleep = 1;
}
func_sleep = (int (__fastcall *)(_DWORD))((int (__fastcall *)(_DWORD, _UNKNOWN *))v0)(-1, &str_sleep);
if ( !flag_pthread_create )
{
sub_4BE3758C(&str_pthread_create, 15, "3:*8(-&\x1B\"@%%7)B", "BMAE");
flag_pthread_create = 1;
}
func_pthread_create = (int (__fastcall *)(_DWORD, _DWORD, _DWORD, _DWORD))((int (__fastcall *)(_DWORD, _UNKNOWN *))v0)(
-1,
&str_pthread_create);
if ( !flag_mprotect )
{
sub_4BE3758C(&str_mprotect, 9, &unk_4BE394E4, "7?s");
flag_mprotect = 1;
}
func_mprotect = (int (__fastcall *)(_DWORD))((int (__fastcall *)(_DWORD, _UNKNOWN *))v0)(-1, &str_mprotect);
if ( !flag_cacheflush )
{
sub_4BE3754C((int)&str_cacheflush, 11, (int)"卑13逗94€", (int)&unk_4BE394FC, 0, 1);
flag_cacheflush = 1;
}
*(_DWORD *)func_cacheflush = ((int (__fastcall *)(_DWORD, _UNKNOWN *))v0)(-1, &str_cacheflush);
if ( !flag_lrand48 )
{
sub_4BE3758C(&str_lrand48, 8, &unk_4BE394B8, ".6gq");
flag_lrand48 = 1;
}
func_lrand48 = (int (*)(void))((int (__fastcall *)(_DWORD, _UNKNOWN *))v0)(-1, &str_lrand48);
lrand48__dword_4BE3D2C0 = func_lrand48;
return func_lrand48;
}
3. 检测是否被调试的函数:int sub_4BE3830C()
{
int v0; // r4@0
int v1; // r5@0
int v2; // r6@0
int v3; // r7@0
int v4; // r8@0
int v5; // r9@0
int v6; // r10@0
int v7; // r11@0
int v8; // lr@0
int pid; // r8@1
int func_sprintf_; // r4@1
int (__fastcall *func_fopen_)(_DWORD, _DWORD); // r5@3
unsigned int v12; // r6@5
char *v13; // r4@6
int (__fastcall *func_strstr_)(_DWORD, _DWORD); // r5@7
char *v15; // r11@8
unsigned int v16; // r4@8
char *v17; // r6@8
void (__fastcall *func_sscanf_)(_DWORD, _DWORD, _DWORD, _DWORD); // r11@10
int result; // r0@16
int fd; // @5
int v21; // @10
char v22; // @6
char buf; // @5
char filename; // @1
int v25; // @1
int v26; // @1
int v27; // @1
int v28; // @1
int v29; // @1
int v30; // @1
int v31; // @1
int v32; // @1
int v33; // @1
int v34; // @1
v26 = v0;
v27 = v1;
v28 = v2;
v29 = v3;
v30 = v4;
v31 = v5;
v32 = v6;
v33 = v7;
v34 = v8;
v25 = _stack_chk_guard;
_aeabi_memset(&filename, 100, 0);
pid = func_getpid();
func_sprintf_ = func_sprintf;
if ( !byte_4BE3D35B )
{
sub_4BE3939C((int)&unk_4BE3D349, 16, (int)&unk_4BE3B550,(int)"s!#L", 4u);
byte_4BE3D35B = 1;
}
((void (__fastcall *)(char *, _UNKNOWN *, int))func_sprintf_)(&filename,&unk_4BE3D349, pid);
func_fopen_ = (int (__fastcall *)(_DWORD, _DWORD))func_fopen;
if ( !unk_4BE3D35C )
{
sub_4BE3954C((int)&fopen_mode, 2, (int)&unk_4BE3B54A,(int)&unk_4BE3B4FC, 0, 1);
unk_4BE3D35C = 1;
}
fd = func_fopen_(&filename, &fopen_mode);
_aeabi_memset(&buf, 512, 0);
v12 = 0x2D4u;
if ( func_fgets(&buf, 512, fd) )
{
v13 = &v22;
while ( 1 )
{
func_strstr_ = (int (__fastcall *)(_DWORD, _DWORD))func_strstr;
if ( !unk_4BE3D35D )
{
v15 = v13;
v16 = v12;
v17 = (char *)&GLOBAL_OFFSET_TABLE_ + v12;
sub_4BE394F4((int)(v17 + 149), 10, (int)"9X,+(X=!),(int)&unk_4BE3B493, 2u, 157);
v17 = 1;
v12 = v16;
v13 = v15;
}
if ( func_strstr_(&buf, &unk_4BE3D325) )
{
_aeabi_memset(v13, 128, 0);
v21 = 0;
func_sscanf_ = (void (__fastcall *)(_DWORD, _DWORD, _DWORD,_DWORD))func_sscanf;
if ( !unk_4BE3D35E )
{
sub_4BE3939C((int)((char *)&GLOBAL_OFFSET_TABLE_ + v12 + 65), 6,(int)&unk_4BE3B461, (int)"L79", 3u);
*((_BYTE *)&GLOBAL_OFFSET_TABLE_ + v12 + 206) = 1;
}
func_sscanf_(&buf, &unk_4BE3D2D1, v13, &v21);
if ( v21 >= 1 )
break;
}
if ( !func_fgets(&buf, 512, fd) )
goto LABEL_16;
}
(*(void (__fastcall **)(int, signed int))((char *)&GLOBAL_OFFSET_TABLE_ +v12 + 28))(pid, 9);
}
LABEL_16:
result = _stack_chk_guard - v25;
if ( _stack_chk_guard != v25 )
_stack_chk_fail(result);
return result;
}
4. 验证用户输入是否正确的函数:signed int __fastcall Java_com_yaotong_crackme_MainActivity_securityCheck(JNIEnv*env, jobject thiz, int str)
{
JNIEnv *env_; // r5@1
int str_; // r4@1
int user_input_str; // r0@5
char *key; // r2@5
int key_char; // r3@6
signed int v8; // r1@7
env_ = env;
str_ = str;
if ( !byte_4BE3D359 )
{
sub_4BE39494(&unk_4BE3D304, 8, &unk_4BE3B46B, &unk_4BE3B468);
byte_4BE3D359 = 1;
}
if ( !unk_4BE3D35A )
{
sub_4BE394F4(&unk_4BE3D36C);
unk_4BE3D35A = 1;
}
user_input_str = ((int (__fastcall *)(JNIEnv *, int,_DWORD))(*env_)->GetStringUTFChars)(env_, str_, 0);
key = off_4BE3D28C;
while ( 1 )
{
key_char = (unsigned __int8)*key;
if ( key_char != *(_BYTE *)user_input_str )
break;
++key;
++user_input_str;
v8 = 1;
if ( !key_char )
return v8;
}
return 0;
}
5. 解密密钥的函数:int sub_4BE387F4()
{
signed int v0; // r0@1
int v1; // r0@1
int v2; // r0@1
int v3; // r0@1
signed int v4; // r2@1
int v5; // r1@1
signed int v6; // r0@1
int (**v7)(void); // r0@4
int (*v8)(void); // r3@16
unsigned int v9; // r0@16
int v10; // r0@16
func_mprotect((unsigned int)&jolin & -_page_size& 0xFFFFFFFE);
v0 = lrand48__dword_4BE3D2C0();
v1 = _floatsidf(8 * (v0 % 100) + 184);
v2 = _muldf3(v1);
v3 = _fixdfsi(v2);
v4 = ((v3 + 3) * v3 + 2) * v3;
v5 = v4 % 6 + 4;
v6 = 0u;
if ( v5 != 4 && (unsigned int)(v4 % 6) <0xFFFFFFFC )
{
do
{
LABEL_3:
*(_BYTE *)(v6 + ((unsignedint)&jolin & 0xFFFFFFFE)) ^= byte_4BE3D070;
++v6;
}
while ( v6 != 212 );
v7 = &GLOBAL_OFFSET_TABLE_;
}
else
{
switch ( v5 )
{
case 0:
do
{
*(_BYTE *)(v6 + ((unsigned int)&jolin & 0xFFFFFFFE)) ^=byte_4BE3D1B4;
++v6;
}
while ( v6 != 212);
v7 =&GLOBAL_OFFSET_TABLE_;
break;
case 1:
do
{
*(_BYTE *)(v6 + ((unsigned int)&jolin & 0xFFFFFFFE)) ^=byte_4BE3D148;
++v6;
}
while ( v6 != 212);
v7 =&GLOBAL_OFFSET_TABLE_;
break;
case 2:
do
{
*(_BYTE *)(v6 + ((unsigned int)&jolin & 0xFFFFFFFE)) ^=byte_4BE3D220;
++v6;
}
while ( v6 != 212);
v7 =&GLOBAL_OFFSET_TABLE_;
break;
case 3:
do
{
*(_BYTE *)(v6 + ((unsigned int)&jolin & 0xFFFFFFFE)) ^=byte_4BE3D0DC;
++v6;
}
while ( v6 != 212);
v7 =&GLOBAL_OFFSET_TABLE_;
break;
case 4:
do
{
*(_BYTE *)(v6 + ((unsigned int)&jolin & 0xFFFFFFFE)) ^=byte_4BE3D004;
++v6;
}
while ( v6 != 212);
v7 =&GLOBAL_OFFSET_TABLE_;
break;
default:
goto LABEL_3;
}
}
v8 = v7;
v9 = *(unsigned int *)((char *)v7 + 0xFFFFFFE0) &0xFFFFFFFE;
v10 = v8();
return ((int (__fastcall *)(_DWORD))jolin)(v10);
}
前排支持，很详细，不错 很好很强大！！ 回头仔细看看！！ 看来我写博客的时候得参考你的了，好详细的说！{:4_87:} 写得很详细，前来学习。 多谢分享！论坛有你更精彩！ 小白路过纯支持{:4_87:} 谢谢大家支持, 但是看来我的功力还是不足, 大家一起加油{:4_86:} PT哥，你抢了我的台词，让我怎么说。
页:
[1]
2