某茅台App算法分析还原
1.目标某茅台软件的actParam算法分析还原。2.使用工具
[*]mac系统
[*]frida-ios-dump：砸壳
[*]已越狱iOS设备：脱壳及frida调试
[*]IDA Pro：静态分析
[*]Charles：抓包工具
[*]Shadowrocket：小火箭，配合Charles使用
3.流程处理启动闪退在IDA Pro搜索SVC得到如下函数列表：https://tva1.sinaimg.cn/large/e6c9d24ely1h6k3c4lv5hj20y0058ab3.jpgNOP掉sub_函数的最后一行汇编后，即可正常运行Apphttps://tva1.sinaimg.cn/large/e6c9d24ely1h6k3c3o75uj20j00800t9.jpg处理登录闪退启动App，在登录页使用命令frida-trace -UF -m "-"，然后进入到任意页后再返回登录页，获取到当前类为XXLoginViewController，再使用命令frida-trace -UF -m "-[*LoginViewController *]"，跟踪该类。点击登录后，啥也没获取到，呵呵。不过，看LoginViewController类有loginButton，在该方法看到登录按钮绑定的事件为LoginViewController类的login方法。使用IDA Pro打开该方法：void __cdecl -(XXLoginViewController *self, SEL a2)
{
if ( qword_100F492E0 )
exit(0);
}这么大的exit函数，查看该条件是在什么地方赋值，查看该变量的交叉引用https://tva1.sinaimg.cn/large/e6c9d24ely1h6k3c2idncj21ay0ho0x6.jpg在sub_1002F52F44函数里对该变量进行赋值。接下来就是处理该函数的赋值逻辑（该方法仅是保证检测环境的qword_100F492E0为0，不排除有其他地方仍然有越狱检测等操作）：1、处理embedded.mobileprovision文件。（重签名后会生成该文件）{
onEnter(log, args, state) {
this.fileName = new ObjC.Object(args);
log(`-)} ofType:${new ObjC.Object(args)}]`);
},
onLeave(log, retval, state) {
if (this.fileName.toString().toLowerCase().indexOf("embedded") != -1 ) {
retval.replace(0x0)
}
log(`-=${new ObjC.Object(retval)}=`);
}
}2、对sub_1002F52F44函数里，对该变量进行赋值的地方，一一处理。保证不会执行qword_100F492E0=1，处理完后即可正常登录：https://tva1.sinaimg.cn/large/e6c9d24ely1h6k3c44xyuj20ku0adq30.jpg寻找actParam算法在IDA Pro搜索actParam字符串，没有发现该字符，说明该字符串被处理过了。按之前的套路，既然这在body里，那我们就使用命令frida-trace -U -f com.xxx.xxx -m "*" -m "*"获取到关键日志如下：-[NSMutableURLRequest setHTTPBody:<7b226163 74506172 616d223a 22496469 77776474 52644542 68646548 6b614a62 71314a35 3972386a 35684c6a 33653334 76576d74 67523374 47486170 4e4c7752 73326237 31495435 614f6c32 42506a44 4f386277 7a793270 34664c34 6f483878 746c3048 78337069 716c6b50 4a4a5555 54677950 6a39397a 6c455750 34375c2f 596f397a 414b7762 6e726768 47585351 526a4f51 706c3636 31694541 347a6157 42657a51 3d3d222c 22697465 6d496e66 6f4c6973 74223a5b 7b22636f 756e7422 3a312c22 6974656d 4964223a 22313030 3536227d 5d2c2273 65737369 6f6e4964 223a3336 362c2273 686f7049 64223a22 31353135 31303132 32303031 227d>
NSMutableURLRequest setHTTPBody called from:
0x1007b8090 /var/containers/Bundle/Application/AFABDD2B-D35D-4F60-A4A1-DFC92CCC3251/iXX_1_2_15.app/XXX!-
0x1007b3a24 /var/containers/Bundle/Application/AFABDD2B-D35D-4F60-A4A1-DFC92CCC3251/iXX_1_2_15.app/XXX!-
0x1007ab270 /var/containers/Bundle/Application/AFABDD2B-D35D-4F60-A4A1-DFC92CCC3251/iXX_1_2_15.app/XXX!-
0x1009557dc /var/containers/Bundle/Application/AFABDD2B-D35D-4F60-A4A1-DFC92CCC3251/iXX_1_2_15.app/XXX!-
0x100a1b724 /var/containers/Bundle/Application/AFABDD2B-D35D-4F60-A4A1-DFC92CCC3251/iXX_1_2_15.app/XXX!-
0x100a1b0fc XXX!0x2770fc (0x1002770fc)
0x100b0b6e4 /var/containers/Bundle/Application/AFABDD2B-D35D-4F60-A4A1-DFC92CCC3251/iXX_1_2_15.app/XXX!-
0x100af3654 /var/containers/Bundle/Application/AFABDD2B-D35D-4F60-A4A1-DFC92CCC3251/iXX_1_2_15.app/XXX!-
0x1aeca8ac4 UIKitCore!-
0x1aecb0ccc UIKitCore!_UIGestureRecognizerSendTargetActions
0x1aecae670 UIKitCore!_UIGestureRecognizerSendActions
0x1aecadb9c UIKitCore!-
0x1aeca1c78 UIKitCore!_UIGestureEnvironmentUpdate
0x1aeca13a8 UIKitCore!-
0x1aeca1188 UIKitCore!-
0x1af0b97d0 UIKitCore!-body里正是我们提交里的参数，根据堆栈可知网络请求是在发起的，使用IDA Pro查看对应的代码可知网络请求类是XXReserveRequest。使用命令frida-trace -U -f com.xxx.xxx -m "*" -m "*"跟踪该类，获取到的日志如下：-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-={
actParam = "IdiwwdtRdEBhdeHkaJbq1J59r8j5hLj3e34vWXXgR3sN9Cp03vhtPomwYoD2EtZM6dvuKXTI3BIjWffzkuwBXUIsms+sHaMW2D+1CMCwdZe2sLG0FXnHUIJIpXblOBJrlRAHk9Bn3fFSZsjYhaJoNw==";
}=
-
-
+
+
+
+
-根据日志可发现actParam在requestParams方法里返回的，继续使用IDA Pro查看该代码https://tva1.sinaimg.cn/large/e6c9d24ely1h6k3c36lfuj20zm0u0mzp.jpgsub函数一直点进去，就会发现(unsigned int)CCCrypt(v6, 0LL, 1LL, &v43, 32LL, v27, v28, v29, v41, v26, &v42) ，接下来就是对该函数进行调试，由于该方法，需要特写时间段才能使用。所以在此，我们查看此sub函数的交叉引用，发现在下单时，也有调用该加密函数。使用命令frida-trace -U -f com.xxx.xxx -m "*" -i CCCrypt打印该参数，在创建订单时，获取到日志如下：js代码{
onEnter: function(log, args, state) {
this.op = args
this.alg = args
this.options = args
this.key = args
this.keyLength = args
this.iv = args
this.dataIn = args
this.dataInLength = args
this.dataOut = args
this.dataOutAvailable = args
this.dataOutMoved = args
log('CCCrypt(' +
'op: ' + this.op + '' + ', ' +
'alg: ' + this.alg + '' + ', ' +
'options: ' + this.options + '' + ', ' +
'key: ' + this.key + ', ' +
'keyLength: ' + this.keyLength + ', ' +
'iv: ' + this.iv + ', ' +
'dataIn: ' + this.dataIn + ', ' +
'inLength: ' + this.inLength + ', ' +
'dataOut: ' + this.dataOut + ', ' +
'dataOutAvailable: ' + this.dataOutAvailable + ', ' +
'dataOutMoved: ' + this.dataOutMoved + ')')
if (this.op == 0) {
log("dataIn:")
log(hexdump(ptr(this.dataIn), {
length: this.dataInLength.toInt32(),
header: true,
ansi: true
}))
log("key: ")
log(hexdump(ptr(this.key), {
length: this.keyLength.toInt32(),
header: true,
ansi: true
}))
log("iv: ")
log(hexdump(ptr(this.iv), {
length: this.keyLength.toInt32(),
header: true,
ansi: true
}))
}
},
onLeave: function(log, retval, state) {
if (this.op == 1) {
log("dataOut:")
log(hexdump(ptr(this.dataOut), {
length: Memory.readUInt(this.dataOutMoved),
header: true,
ansi: true
}))
log("key: ")
log(hexdump(ptr(this.key), {
length: this.keyLength.toInt32(),
header: true,
ansi: true
}))
log("iv: ")
log(hexdump(ptr(this.iv), {
length: this.keyLength.toInt32(),
header: true,
ansi: true
}))
} else {
log("dataOut:")
log(hexdump(ptr(this.dataOut), {
length: Memory.readUInt(this.dataOutMoved),
header: true,
ansi: true
}))
}
log("CCCrypt did finish")
}
}日志 96341 msCCCrypt(op: 0x0, alg: 0x0, options: 0x1, key: 0x16eecea70, keyLength: 0x20, iv: 0x2821adbe0, dataIn: 0x2815a80c0, inLength: undefined, dataOut: 0x281794580, dataOutAvailable: 0xa4, dataOutMoved: 0x16eecea68)
96341 msdataIn:
96341 ms 0123456789ABCDEF0123456789ABCDEF
2815a80c07b 22 64 65 6c 69 76 65 72 4d 65 74 68 6f 64 22{"deliverMethod"
2815a80d03a 2d 31 2c 22 61 64 64 72 65 73 73 49 6e 66 6f:-1,"addressInfo
2815a80e022 3a 7b 22 73 68 69 70 41 64 64 72 65 73 73 49":{"shipAddressI
2815a80f064 22 3a 22 33 37 39 36 31 36 30 22 7d 2c 22 75d":"3711160"},"u
2815a810073 65 72 49 64 22 3a 22 31 30 36 39 38 36 36 32serId":"10008662
2815a811038 30 22 2c 22 69 74 65 6d 4c 69 73 74 22 3a 5b80","itemList":[
2815a81207b 22 63 6f 75 6e 74 22 3a 31 2c 22 73 70 75 49{"count":1,"spuI
2815a813064 22 3a 22 34 32 35 22 2c 22 73 74 6f 72 65 49d":"425","storeI
2815a814064 22 3a 22 32 35 31 35 31 30 31 38 38 30 31 30d":"251510182010
2815a815022 7d 5d 7d "}]}
96341 mskey:
96341 ms 0123456789ABCDEF0123456789ABCDEF
16eecea7071 62 68 61 6a 69 6e 6c 64 65 70 6d 75 63 73 6fqbhajinldepmucso
16eecea806e 61 61 61 63 63 67 79 70 77 75 76 63 6a 61 61naaaccgypwuvcjaa
96341 msiv:
96341 ms 0123456789ABCDEF0123456789ABCDEF
2821adbe032 30 31 38 35 33 34 37 34 39 39 36 33 35 31 352018534749963515
2821adbf000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
96345 msdataOut:
96345 ms 0123456789ABCDEF0123456789ABCDEF
281794580b0 fd c3 5f a8 e8 de 45 80 ac 23 e6 2b d1 3f 2c..._...E..#.+.?,
2817945905d 4b 88 e9 88 99 7a 76 ab 7b c2 c5 88 40 fd 4f]K....zv.{...@.O
2817945a038 37 c5 48 61 06 b1 a9 33 0d 1a 7d a7 59 3d fb87.Ha...3..}.Y=.
2817945b005 88 cc 18 b8 68 cb ce a7 33 1e 32 f1 1f a2 ae.....h.....2....
2817945c00b 50 04 75 ed 19 36 eb 64 bd d7 79 a8 13 6a 4d.P.u..6.d..y..jM
2817945d09c bf 72 1c 42 6c 41 cc 76 86 85 cf bd 58 5b db..r.BlA.v....X[.
2817945e005 74 ec e6 55 6e 84 10 ae zz 61 b8 64 81 7b 6f.t..Un....a.d.{o
2817945f002 df 42 a6 13 8e a6 41 ee 1a 0a b5 65 cb 45 29..B....F....e.E)
2817946009b 86 ea 63 f6 8e 92 6c 1a 11 8b 70 09 b7 b5 ad...c...l...p....
281794610c6 f7 2c 70 91 12 eb 62 45 a4 0e b5 75 29 c4 be..,p...bE...u)..
96345 msCCCrypt did finish日志里的dataOut数据，转换为base64后，和接口里的参数一致(注：日志里的敏感信息被我处理过)。
结果见CCCrypt日志。在分析过程中，当我们发现参数是base64的时候，也可以先拦截base64EncodedStringWithOptions或CCCrypt函数，运气好的话，也能快速定位到加密算法。
End
阅读此文档的过程中遇到任何问题，请关注公众号【移动端Android和iOS开发技术分享】
页:
[1]