Android APP破解利器Frida之反调试对抗
本文讲的是
Android APP破解利器Frida之反调试对抗，
在我发表了关于Frida的第二个博文后不久，
@muellerberndt
决定发布另外一个新的OWASP Android
破解
APP，我很想知道我是否可以再次使用Frida解决这个CrackMe。如果你想跟随我一起操作，你需要做以下准备：
Error: access violation accessing 0xebad8082
michael@sixtyseven:~/Development$ frida -U sg.vantagepoint.uncrackable2 ____ / _ | Frida 9.1.27 - A world-class dynamic instrumentation framework | (_| | > _ | Commands: /_/ |_| help -> Displays the help system . . . . object? -> Display information about 'object' . . . . exit/quit -> Exit . . . . . . . . More info at http://www.frida.re/docs/home/ Failed to attach: ambiguous name; it matches: sg.vantagepoint.uncrackable2 (pid: 5184), sg.vantagepoint.uncrackable2 (pid: 5201)
5184 sg.vantagepoint.uncrackable2 5201 sg.vantagepoint.uncrackable2
michael@sixtyseven:~/Development$ frida -U 5184 ____ / _ | Frida 9.1.27 - A world-class dynamic instrumentation framework | (_| | > _ | Commands: /_/ |_| help -> Displays the help system . . . . object? -> Display information about 'object' . . . . exit/quit -> Exit . . . . . . . . More info at http://www.frida.re/docs/home/ Failed to attach: unable to access process with pid 5184 due to system restrictions; try `sudo sysctl kernel.yama.ptrace_scope=0`, or run Frida as root
package sg.vantagepoint.uncrackable2;
import android.app.AlertDialog;
import android.content.Context;
import android.content.DialogInterface;
import android.os.AsyncTask;
import android.os.Bundle;
import android.support.v7.app.c;
import android.text.Editable;
import android.view.View;
import android.widget.EditText;
import sg.vantagepoint.a.a;
import sg.vantagepoint.a.b;
import sg.vantagepoint.uncrackable2.CodeCheck;
import sg.vantagepoint.uncrackable2.MainActivity;
public class MainActivity
extends c {
private CodeCheck m;
static {
System.loadLibrary("foo"); //[1]
}
private void a(String string) {
AlertDialog alertDialog = new AlertDialog.Builder((Context)this).create();
alertDialog.setTitle((CharSequence)string);
alertDialog.setMessage((CharSequence)"This in unacceptable. The app is now going to exit.");
alertDialog.setButton(-3, (CharSequence)"OK", (DialogInterface.OnClickListener)new /* Unavailable Anonymous Inner Class!! */);
alertDialog.setCancelable(false);
alertDialog.show();
}
static /* synthetic */ void a(MainActivity mainActivity, String string) {
mainActivity.a(string);
}
private native void init(); //[2]
protected void onCreate(Bundle bundle) {
this.init(); //[3]
if (b.a() || b.b() || b.c()) {
this.a("Root detected!");
}
if (a.a((Context)this.getApplicationContext())) {
this.a("App is debuggable!");
}
new /* Unavailable Anonymous Inner Class!! */.execute((Object[])new Void[]{null, null, null});
this.m = new CodeCheck();
super.onCreate(bundle);
this.setContentView(2130968603);
}
public void verify(View view) {
String string = ((EditText)this.findViewById(2131427422)).getText().toString();
AlertDialog alertDialog = new AlertDialog.Builder((Context)this).create();
if (this.m.a(string)) {
alertDialog.setTitle((CharSequence)"Success!");
alertDialog.setMessage((CharSequence)"This is the correct secret.");
} else {
alertDialog.setTitle((CharSequence)"Nope...");
alertDialog.setMessage((CharSequence)"That's not it. Try again.");
}
alertDialog.setButton(-3, (CharSequence)"OK", (DialogInterface.OnClickListener)new /* Unavailable Anonymous Inner Class!! */);
alertDialog.show();
}
}
michael@sixtyseven:~/Development/UnCrackable2/lib/x86_64$ r2 libfoo.so -- Don't look at the code. Don't look. [0x000007a0]> aaa [x] Analyze all flags starting with sym. and entry0 (aa) [x] Analyze len bytes of instructions for references (aar) [x] Analyze function calls (aac) [ ] [*] Use -AA or aaaa to perform additional experimental analysis. [x] Constructing a function name for fcn.* and sym.func.* functions (aan)) [0x000007a0]> iE [Exports] vaddr=0x00001060 paddr=0x00001060 ord=004 fwd=NONE sz=183 bind=GLOBAL type=FUNC name=Java_sg_vantagepoint_uncrackable2_CodeCheck_bar vaddr=0x00001050 paddr=0x00001050 ord=006 fwd=NONE sz=15 bind=GLOBAL type=FUNC name=Java_sg_vantagepoint_uncrackable2_MainActivity_init vaddr=0x00004008 paddr=0x00003008 ord=014 fwd=NONE sz=0 bind=GLOBAL type=NOTYPE name=__bss_start vaddr=0x00004008 paddr=0x00003008 ord=015 fwd=NONE sz=0 bind=GLOBAL type=NOTYPE name=__bss_start vaddr=0x0000400d paddr=0x0000400d ord=016 fwd=NONE sz=0 bind=GLOBAL type=NOTYPE name=_end 5 exports [0x000007a0]>
[0x000007a0]> s 0x00001050 [0x00001050]> V
[0x00001050 29% 848 libfoo.so]> pd $r @ sym.Java_sg_vantagepoint_uncrackable2_MainActivity_init / (fcn) sym.Java_sg_vantagepoint_uncrackable2_MainActivity_init 15 | sym.Java_sg_vantagepoint_uncrackable2_MainActivity_init (); | 0x00001050 50 push rax | 0x00001051 e8caf7ffff call sub.fork_820 ;[1] | 0x00001056 c605af2f0000. mov byte [0x0000400c], 1 ; [0x400c:1]=58 ; ": (GNU) 4.9.x 20150123 (prerelease)" | 0x0000105d 58 pop rax 0x0000105e c3 ret 0x0000105f 90 nop
[0x00000820 14% 265 libfoo.so]> pd $r @ sub.fork_820
/ (fcn) sub.fork_820 242
| sub.fork_820 ();
| ; var int local_8h @ rsp+0x8
| ; var int local_10h @ rsp+0x10
| ; CALL XREF from 0x00001051 (sym.Java_sg_vantagepoint_uncrackable2_MainActivity_init)
| 0x00000820 4156 push r14
| 0x00000822 53 push rbx
| 0x00000823 4883ec18 sub rsp, 0x18
| 0x00000827 64488b042528. mov rax, qword fs:[0x28] ; [0x28:8]=0x3180 ; '('
| 0x00000830 4889442410 mov qword [local_10h], rax
| 0x00000835 e806ffffff call sym.imp.fork ;[1]
| 0x0000083a 8905c8370000 mov dword loc.__bss_start, eax ; [0x4008:4]=0x43434700 ; loc.__bss_start
| 0x00000840 85c0 test eax, eax
| ,=< 0x00000842 741a je 0x85e ;[2]
| | 0x00000844 488d15a5ffff. lea rdx, 0x000007f0 ; 0x7f0
| | 0x0000084b 488d7c2408 lea rdi, [local_8h] ; 0x8
| | 0x00000850 31f6 xor esi, esi
| | 0x00000852 31c9 xor ecx, ecx
| | 0x00000854 e8f7feffff call sym.imp.pthread_create ;[3]; ssize_t read(int fildes, void *buf, size_t nbyte)
| ,==< 0x00000859 e990000000 jmp 0x8ee ;[4]
| || ; JMP XREF from 0x00000842 (sub.fork_820)
| |`-> 0x0000085e e8fdfeffff call sym.imp.getppid ;[5]
| | 0x00000863 89c3 mov ebx, eax
| | 0x00000865 bf10000000 mov edi, 0x10
| | 0x0000086a 31d2 xor edx, edx
| | 0x0000086c 31c9 xor ecx, ecx
| | 0x0000086e 31c0 xor eax, eax
| | 0x00000870 89de mov esi, ebx
| | 0x00000872 e8f9feffff call sym.imp.ptrace ;[6]
| | 0x00000877 4885c0 test rax, rax
| |,=< 0x0000087a 7572 jne 0x8ee ;[4]
| || 0x0000087c 4c8d742408 lea r14, [local_8h] ; 0x8
| || 0x00000881 31d2 xor edx, edx
| || 0x00000883 89df mov edi, ebx
| || 0x00000885 4c89f6 mov rsi, r14
| || 0x00000888 e883feffff call sym.imp.waitpid ;[7]
frida -U -f sg.vantagepoint.uncrackable2
michael@sixtyseven:~/Development/UnCrackable2/lib/x86_64$ frida -U -f sg.vantagepoint.uncrackable2 --no-pause ____ / _ | Frida 9.1.27 - A world-class dynamic instrumentation framework | (_| | > _ | Commands: /_/ |_| help -> Displays the help system . . . . object? -> Display information about 'object' . . . . exit/quit -> Exit . . . . . . . . More info at http://www.frida.re/docs/home/ Spawned `sg.vantagepoint.uncrackable2`. Resuming main thread! [USB::Android Emulator 5554::['sg.vantagepoint.uncrackable2']]->
michael@sixtyseven:~/Disassembly$ /opt/apktool/apktool.sh -r d UnCrackable-Level2.apk I: Using Apktool 2.2.0 on UnCrackable-Level2.apk I: Copying raw resources... I: Baksmaling classes.dex... I: Copying assets and libs... I: Copying unknown files... I: Copying original files...
# virtual methods
.method protected onCreate(Landroid/os/Bundle;)V
.locals 4
const/4 v3, 0x0
# invoke-direct {p0}, Lsg/vantagepoint/uncrackable2/MainActivity;->init()V
invoke-static {}, Lsg/vantagepoint/a/b;->a()Z
michael@sixtyseven:~/Disassembly/UnCrackable-Level2$ /opt/apktool/apktool.sh b I: Using Apktool 2.2.0 I: Checking whether sources has changed... I: Smaling smali folder into classes.dex... [Fatal Error] AndroidManifest.xml:1:1: Content ist nicht zulässig in Prolog. I: Checking whether resources has changed... I: Copying raw resources... I: Copying libs... (/lib) I: Building apk file... I: Copying unknown files/dir...
michael@sixtyseven:~/Disassembly/UnCrackable-Level2$ zipalign -v 4 dist/UnCrackable-Level2.apk UnCrackable2.recompiled.aligned.apk Verifying alignment of UnCrackable2.recompiled.aligned.apk (4)... 49 AndroidManifest.xml (OK - compressed) 914 classes.dex (OK - compressed) 269899 lib/arm64-v8a/libfoo.so (OK - compressed) 273297 lib/armeabi-v7a/libfoo.so (OK - compressed) 279346 lib/armeabi/libfoo.so (OK - compressed)
michael@sixtyseven:~/Disassembly/UnCrackable-Level2$ jarsigner -verbose -keystore ~/.android/debug.keystore UnCrackable2.recompiled.aligned.apk signkey Enter Passphrase for keystore: adding: META-INF/MANIFEST.MF adding: META-INF/SIGNKEY.SF adding: META-INF/SIGNKEY.RSA signing: AndroidManifest.xml signing: classes.dex signing: lib/arm64-v8a/libfoo.so signing: lib/armeabi-v7a/libfoo.so signing: lib/armeabi/libfoo.so signing: lib/mips/libfoo.so [...]
adb uninstall sg.vantagepoint.uncrackable2 adb install UnCrackable2.recompiled.aligned.apk
29996 sg.vantagepoint.uncrackable2
michael@sixtyseven:~/Disassembly/UnCrackable-Level2$ frida -U sg.vantagepoint.uncrackable2 ____ / _ | Frida 9.1.27 - A world-class dynamic instrumentation framework | (_| | > _ | Commands: /_/ |_| help -> Displays the help system . . . . object? -> Display information about 'object' . . . . exit/quit -> Exit . . . . . . . . More info at http://www.frida.re/docs/home/ [USB::Android Emulator 5554::sg.vantagepoint.uncrackable2]->
setImmediate(function() {
console.log("[*] Starting script");
Java.perform(function() {
exitClass = Java.use("java.lang.System");
exitClass.exit.implementation = function() {
console.log("[*] System.exit called");
}
console.log("[*] Hooking calls to System.exit");
});
});
frida -U -f sg.vantagepoint.uncrackable2 -l uncrackable2.js --no-pause
michael@sixtyseven:~/Development/frida$ frida -U -f sg.vantagepoint.uncrackable2 --no-pause -l uncrackable2.js ____ / _ | Frida 9.1.27 - A world-class dynamic instrumentation framework | (_| | > _ | Commands: /_/ |_| help -> Displays the help system . . . . object? -> Display information about 'object' . . . . exit/quit -> Exit . . . . . . . . More info at http://www.frida.re/docs/home/ Spawned `sg.vantagepoint.uncrackable2`. Resuming main thread! [USB::Android Emulator 5554::['sg.vantagepoint.uncrackable2']]-> [*] Hooking calls to System.exit [*] System.exit called
this.m = new CodeCheck();
[...]
//in method: public void verify
if (this.m.a(string)) {
alertDialog.setTitle((CharSequence)"Success!");
alertDialog.setMessage((CharSequence)"This is the correct secret.");
}
package sg.vantagepoint.uncrackable2;
public class CodeCheck {
private native boolean bar(byte[] var1);
public boolean a(String string) {
return this.bar(string.getBytes()); //Call to a native function
}
}
0x000010d8 83f817 cmp eax, 0x17 0x000010db 7519 jne 0x10f6 ;[1]
int strncmp ( const char * str1, const char * str2, size_t num );
var strncmp = undefined;
imports = Module.enumerateImportsSync("libfoo.so");
for(i = 0; i < imports.length; i++) {
if(imports[i].name == "strncmp") {
strncmp = imports[i].address;
break;
}
}
Interceptor.attach(strncmp, {
onEnter: function (args) {
if(args[2].toInt32() == 23 && Memory.readUtf8String(args[0],23) == "01234567890123456789012") {
console.log("[*] Secret string at " + args[1] + ": " + Memory.readUtf8String(args[1],23));
}
}
});
buf = Memory.readByteArray(args[0],32);
console.log(hexdump(buf, {
offset: 0,
length: 32,
header: true,
ansi: true
}));
buf = Memory.readByteArray(args[1],32);
console.log(hexdump(buf, {
offset: 0,
length: 32,
header: true,
ansi: true
}));
setImmediate(function() {
Java.perform(function() {
console.log("[*] Hooking calls to System.exit");
exitClass = Java.use("java.lang.System");
exitClass.exit.implementation = function() {
console.log("[*] System.exit called");
}
var strncmp = undefined;
imports = Module.enumerateImportsSync("libfoo.so");
for(i = 0; i < imports.length; i++) {
if(imports[i].name == "strncmp") {
strncmp = imports[i].address;
break;
}
}
Interceptor.attach(strncmp, {
onEnter: function (args) {
if(args[2].toInt32() == 23 && Memory.readUtf8String(args[0],23) == "01234567890123456789012") {
console.log("[*] Secret string at " + args[1] + ": " + Memory.readUtf8String(args[1],23));
}
},
});
console.log("[*] Intercepting strncmp");
});
});
frida -U -f sg.vantagepoint.uncrackable2 --no-pause -l uncrackable2.js
michael@sixtyseven:~/Development/frida$ frida -U -f sg.vantagepoint.uncrackable2 --no-pause -l uncrackable2.js ____ / _ | Frida 9.1.27 - A world-class dynamic instrumentation framework | (_| | > _ | Commands: /_/ |_| help -> Displays the help system . . . . object? -> Display information about 'object' . . . . exit/quit -> Exit . . . . . . . . More info at http://www.frida.re/docs/home/ Spawned `sg.vantagepoint.uncrackable2`. Resuming main thread! [USB::Android Emulator 5554::['sg.vantagepoint.uncrackable2']]-> [*] Hooking calls to System.exit [*] Intercepting strncmp [*] System.exit called [*] Secret string at 0x7fffa628f010: Thanks for all the fish
0x00001056 c605af2f0000. mov byte [0x0000400c], 1
0x0000107d 803d882f0000. cmp byte [0x0000400c], 1 ; [0x1:1]=69 0x00001084 7570 jne 0x10f6 ;[1]
//Get base address of library
var libfoo = Module.findBaseAddress("libfoo.so");
//Calculate address of variable
var initialized = libfoo.add(ptr("0x400C"));
//Write 1 to the variable
Memory.writeInt(initialized,1);
setImmediate(function() {
Java.perform(function() {
console.log("[*] Hooking calls to System.exit");
exitClass = Java.use("java.lang.System");
exitClass.exit.implementation = function() {
console.log("[*] System.exit called");
}
var strncmp = undefined;
imports = Module.enumerateImportsSync("libfoo.so");
for(i = 0; i < imports.length; i++) {
if(imports[i].name == "strncmp") {
strncmp = imports[i].address;
break;
}
}
//Get base address of library
var libfoo = Module.findBaseAddress("libfoo.so");
//Calculate address of variable
var initialized = libfoo.add(ptr("0x400C"));
//Write 1 to the variable
Memory.writeInt(initialized,1);
Interceptor.attach(strncmp, {
onEnter: function (args) {
if(args[2].toInt32() == 23 && Memory.readUtf8String(args[0],23) == "01234567890123456789012") {
console.log("[*] Secret string at " + args[1] + ": " + Memory.readUtf8String(args[1],23));
}
},
});
console.log("[*] Intercepting strncmp");
});
});
root@sixtyseven:/home/michael/Development/frida# frida -U sg.vantagepoint.uncrackable2 -l uncrackable2-final.js ____ / _ | Frida 9.1.27 - A world-class dynamic instrumentation framework | (_| | > _ | Commands: /_/ |_| help -> Displays the help system . . . . object? -> Display information about 'object' . . . . exit/quit -> Exit . . . . . . . . More info at http://www.frida.re/docs/home/ [USB::Android Emulator 5554::sg.vantagepoint.uncrackable2]-> [*] Hooking calls to System.exit [*] Intercepting strncmp [*] System.exit called [*] Secret string at 0x7fffd52c6570: Thanks for all the fish
原文发布时间为：2017年5月11日
本文作者：李白
本文来自云栖社区合作伙伴嘶吼，了解相关信息可以关注嘶吼网站。
