Android脱壳

1
2

private static final String[] targetPackages =  
        new String[]{"com.sfysoft.shellingtest", "com.sfysoft.shellingtest2", "com.example.how_debug"};  

1
2
3
4

$ adb logcat -s Xposed  
06-15 14:58:01.091  6048  6048 I Xposed  : Found com.SecShell.SecShell.ApplicationWrapper  
06-15 14:58:01.119  6048  6064 I Xposed  : Thread: 246, File: /data/data/com.example.how_debug/00246-01.dex  
06-15 14:58:01.228  6048  6064 I Xposed  : Thread: 246, File: /data/data/com.example.how_debug/00246-02.dex  

1
2

root@angler:/data/data/com.example.how_debug # cp 00246-01.dex /sdcard/01.dex  
root@angler:/data/data/com.example.how_debug # cp 00246-02.dex /sdcard/02.dex  

1
2
3
4
5
6
7
8

push frida-server-arm64 /data/local/tmp  
chmod 777 frida-server-arm64  
./frida-server-arm64  
# 端口转发  
adb forward tcp:27043 tcp:27043  
adb forward tcp:27042 tcp:27042  
# 检查是否成功  
frida-ps -U  

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

import frida, sys  
   
# hook代码，采用javascript编写  
jscode = """  
javascript代码，重点  
"""  
   
# 自定义回调函数  
def on_message(message, data):  
    if message['type'] == 'send':  
        print("[*] {0}".format(message['payload']))  
    else:  
        print(message)  
   
# 重点的4行代码  
# 获取手机设备并附加到进程  
process = frida.get_usb_device().attach('应用完整包名')  
script = process.create_script(jscode)  
# 回调  
script.on('message', on_message)  
# 在服务端就启动javascript脚本了  
script.load()  
sys.stdin.read()  

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

//Java.Perform 开始执行JavaScript脚本。  
Java.perform(function () {  
//定义变量MainActivity，Java.use指定要使用的类  
var MainActivity = Java.use('com.example.seccon2015.rock_paper_scissors.MainActivity');  
//hook该类下的onCreate方法，重新实现它  
MainActivity.onCreate.implementation = function () {  
    send("Hook Start...");  
    //调用calc()方法，获取返回值  
    var returnValue = this.calc();  
    send("Return:"+returnValue);  
    var result = (1000+returnValue)*107;  
    //解出答案  
    send("Flag:"+"SECCON{"+result.toString()+"}");  
}  
});  

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

import frida, sys  
   
def on_message(message, data):  
    if message['type'] == 'send':  
        print("[*] {0}".format(message['payload']))  
    else:  
        print(message)  
   
jscode = """  
Java.perform(function () {  
var MainActivity = Java.use('com.example.seccon2015.rock_paper_scissors.MainActivity');  
MainActivity.onCreate.implementation = function () {  
    send("Hook Start...");  
    var returnValue = this.calc();  
    send("Return:"+returnValue);  
    var result = (1000+returnValue)*107;  
    send("Flag:"+"SECCON{"+result.toString()+"}");  
}  
});  
"""  
  
process = frida.get_usb_device().attach('com.example.seccon2015.rock_paper_scissors')  
script = process.create_script(jscode)  
script.on('message', on_message)  
script.load()  
sys.stdin.read()  

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

Java.perform(function () {  
var MainActivity = Java.use('com.example.seccon2015.rock_paper_scissors.MainActivity');  
//hook onClick方法，此处要注意的是onClick方法是传递了一个View参数v  
MainActivity.onClick.implementation = function (v) {  
    send("Hook Start...");  
    //调用onClick,模拟点击事件  
    this.onClick(v);  
    //修改参数  
    this.n.value = 0;  
    this.m.value = 2;  
    this.cnt.value = 999;  
    send("Success!")  
}  
});  

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

import frida, sys  
   
def on_message(message, data):  
    if message['type'] == 'send':  
        print("[*] {0}".format(message['payload']))  
    else:  
        print(message)  
   
jscode = """  
Java.perform(function () {  
var MainActivity = Java.use('com.example.seccon2015.rock_paper_scissors.MainActivity');  
MainActivity.onClick.implementation = function (v) {  
    send("Hook Start...");  
    this.onClick(v);  
    this.n.value = 0;  
    this.m.value = 2;  
    this.cnt.value = 999;  
    send("Success!")  
}  
});  
"""  
   
process = frida.get_usb_device().attach('com.example.seccon2015.rock_paper_scissors')  
script = process.create_script(jscode)  
script.on('message', on_message)  
script.load()  
sys.stdin.read()