题一：
Sp4rkDr0idKit
用IDA逆向文件，找到ViewController - (void)onClick 函数，F5一下得到伪代码
 v2 = CFSTR("mrMZAbjtZozDOGI9UeeH6g0iLHNnTNsFyzS0tYca4R3KkaQ0doxdDVuxZ7HoqYOcxFhgDiEvdGKix95VJNEUP8rdox4cm7GHVkbVcTJPmrTtH7hompW+xjTgGg2zQhs0tUGQ8lCggev2SNoWcaUOUU==");
  v3 = 5;
  do
  {
    v4 = objc_msgSend(&OBJC_CLASS___Ceasar_CipherModel, "alloc");
    --v3;
    v5 = objc_msgSend(v4, "initWithCipherKey:", v3);
    objc_msgSend(v5, "setCodedMessage:", v2);
    objc_msgSend(v5, "decrypt");
    v6 = objc_msgSend(v5, "originalMessage");
    v2 = (__CFString *)objc_msgSend(&OBJC_CLASS___AESCrypt, "decrypt:password:", v6, CFSTR("ZGlhb2RhX2ppYW5rYW5nCg=="));
  }
  while ( v3 > 0 );

就是这个样子：
$src= "mrMZAbjtZozDOGI9UeeH6g0iLHNnTNsFyzS0tYca4R3KkaQ0doxdDVuxZ7HoqYOcxFhgDiEvdGKix95VJNEUP8rdox4cm7GHVkbVcTJPmrTtH7hompW+xjTgGg2zQhs0tUGQ8lCggev2SNoWcaUOUU==";
$v3=5
do
$v3--;
$src = ceasar_decrypt( $src, $v3);
$src=decrypt($src,"ZGlhb2RhX2ppYW5rYW5nCg==");
while ($v3>0);

再在 IDA中找到decrypt:password:，再F5一个看代码：
// AESCrypt + (id)decrypt:(id) password:(id) 
id __cdecl +[AESCrypt decrypt:password:](struct AESCrypt *self, SEL a2, id a3, id a4)
{
  id v4; // r4@1
  void *v5; // r5@1
  void *v6; // r0@1
  void *v7; // r0@1
  int v8; // r0@1

  v4 = a4;
  v5 = objc_msgSend(&OBJC_CLASS___NSData, "base64DataFromString:", a3);
  v6 = objc_msgSend(v4, "dataUsingEncoding:", 4);
  v7 = objc_msgSend(v6, "SHA256Hash");
  objc_msgSend(v5, "decryptedAES256DataUsingKey:error:", v7, 0);
  v8 = (int)objc_msgSend(&OBJC_CLASS___NSString, "alloc");
  return (id)sub_179C0(v8, (int)"initWithData:encoding:");
}

就是
$v5=ecode_Base64($src);
$v5=sha256($key);
AES256_decrypted($v5,$v5,"\x00" x 16);

答案是：Sp4rkDr0idKit，完整的perl代码如下：

use Crypt::Mode::CBC;
use MIME::Base64;
use Digest::SHA qw(sha256);

sub caesar_decrypt{
  my($s,$n)=@_;
  my($i,$t);
  for($i=0;$i<length($s);$i++){
    $t=substr($s,$i,1);
    if((ord('a')<=ord($t)) && (ord($t)<=ord('z'))){
      $t= chr(((ord($t)-ord('a') - $n) % 26) + ord('a'));
    }elsif((ord('A')<=ord($t)) && (ord($t)<=ord('Z'))){
      $t= chr(((ord($t)-ord('A') - $n) % 26) + ord('A'));
    }  
    substr $s,$i,1,$t;
  }
  return $s;
}

sub decrypt{
  my($a3,$a4)=@_;
  my $v5=decode_base64($a3);
  my $v7=sha256($a4);
  my $m = Crypt::Mode::CBC->new('AES');
  return $m->decrypt($v5, $v7, "\x00" x 16);
   
}


$key="ZGlhb2RhX2ppYW5rYW5nCg==";
$src="mrMZAbjtZozDOGI9UeeH6g0iLHNnTNsFyzS0tYca4R3KkaQ0doxdDVuxZ7HoqYOcxFhgDiEvdGKix95VJNEUP8rdox4cm7GHVkbVcTJPmrTtH7hompW+xjTgGg2zQhs0tUGQ8lCggev2SNoWcaUOUU==";
$count=5;
do {
  $count--;
  $src=caesar_decrypt($src,$count);
  $src=decrypt($src,$key);
} while($count>0) ;
print $src;
<>;

题二：0x02、kernelcache
0x800c0ea1#0x800c0e39#0x800c0e05#0x802873ad#0x802873ad#0x80149d19#0x80292251#0x80292661#0x8029298d

结构体cdevsw：
struct cdevsw {
   open_close_fcn_t *d_open;
   open_close_fcn_t *d_close;
   read_write_fcn_t *d_read;
   read_write_fcn_t *d_write;
   ioctl_fcn_t      *d_ioctl;
   stop_fcn_t       *d_stop;
   reset_fcn_t      *d_reset;
   struct tty       **d_ttys;
   select_fcn_t     *d_select;
   mmap_fcn_t       *d_mmap;
   strategy_fcn_t   *d_strategy;
   void             *d_reserved_1;
   void             *d_reserved_2;
   int              d_type;
};

设备什么的会调用cdevsw_add( , &cdevsw)，通过 IDA的Exports 找到 _cdevsw_add，地址是0x82c7988:

查看_cdevsw_add里查看 xref:

看调用_cdevsw_add所的函数的代码，就会发现 random, pf, ptmx设备...

Random:
:800C0D88 sub_800C0D88                            ; DATA XREF: __DATA:__const:8039CF70o
__TEXT:__text:800C0D88
__TEXT:__text:800C0D88 perms           = -0x18
__TEXT:__text:800C0D88 fmt             = -0x14
__TEXT:__text:800C0D88 var_10          = -0x10
__TEXT:__text:800C0D88
__TEXT:__text:800C0D88                 PUSH            {R4-R7,LR}
__TEXT:__text:800C0D8A                 ADD             R7, SP, #0xC
__TEXT:__text:800C0D8C                 SUB             SP, SP, #0xC
__TEXT:__text:800C0D8E                 MOV             R0, #(off_803BD360 - 0x800C0D9A)
__TEXT:__text:800C0D96                 ADD             R0, PC ; off_803BD360
__TEXT:__text:800C0D98                 ADDW            R1, R0, #0xB14
__TEXT:__text:800C0D9C                 MOV.W           R0, #0xFFFFFFFF
__TEXT:__text:800C0DA0                 BL              _cdevsw_add

0x803BD360+0xB14 得到 0x803BDE74
在0x803BDE74地址就 设备random的结构体cdevsw的
__DATA:__data:803BDE74 off_803BDE74    DCD sub_800C0E18+1
__DATA:__data:803BDE78                 DCD sub_800C0E34+1
__DATA:__data:803BDE7C                 DCD sub_800C0EA0+1  ;d_read
__DATA:__data:803BDE80                 DCD sub_800C0E38+1   ;d_write
__DATA:__data:803BDE84                 DCD sub_800C0E04+1   ;d_d_ioctl
__DATA:__data:803BDE88                 DCD _nulldev+1
__DATA:__data:803BDE8C                 DCD _nulldev+1
__DATA:__data:803BDE90                 DCB    0
。。。
/dev/random
0x800c0ea1#0x800c0e39#0x800c0e05

Pf:
__TEXT:__text:8024B516                 CMP             R0, #0
__TEXT:__text:8024B518                 BNE             loc_8024B5BA
__TEXT:__text:8024B51A                 MOV             R0, #(off_803BD360 - 0x8024B526)
__TEXT:__text:8024B522                 ADD             R0, PC ; off_803BD360
__TEXT:__text:8024B524                 ADDW            R1, R0, #0xBBC
__TEXT:__text:8024B528                 MOV.W           R0, #0xFFFFFFFF
__TEXT:__text:8024B52C                 BL              _cdevsw_add
__TEXT:__text:8024B530                 MOV             R5, R0
__TEXT:__text:8024B532                 CMP.W           R5, #0xFFFFFFFF
__TEXT:__text:8024B536                 BEQ             loc_8024B5BA
__TEXT:__text:8024B538                 MOVW            R0, #(:lower16:(aPf - 0x8024B54E)) ; "pf"

0x803BD360+0xBBC=0x803BDF1C
0x803BDF1C 是pf设备的 cdevsw结构体的地址
__DATA:__data:803BDF1C off_803BDF1C    DCD sub_80152C64+1
__DATA:__data:803BDF20                 DCD sub_80152BF4+1
__DATA:__data:803BDF24                 DCD _enodev+1    ;d_read 802873AC+1
__DATA:__data:803BDF28                 DCD _enodev+1    ;d_write 802873AC+1
__DATA:__data:803BDF2C                 DCD sub_80149D18+1  ;d_d_ioctl 0x80149d19
0x802873ad#0x802873ad#0x80149d19

Ptmx:

__TEXT:__text:8029333E                 MOV             R0, #0xFFFFFFF1
__TEXT:__text:80293342                 MOVT.W          R4, #(:upper16:(off_803BD360 - 0x8029334A))
__TEXT:__text:80293346                 ADD             R4, PC ; off_803BD360
__TEXT:__text:80293348                 ADDW            R1, R4, #0xC2C
0x803BD360+0xC2C=0x803BDF8C

G到地址803BDF8C
__DATA:__data:803BDF8C off_803BDF8C    DCB 0x9D                ; DATA XREF: sub_80293330+50r
__DATA:__data:803BDF8D                 DCB 0x1F
__DATA:__data:803BDF8E                 DCB 0x29 ; )
__DATA:__data:803BDF8F                 DCB 0x80 ; €
__DATA:__data:803BDF90                 DCD sub_802920D4+1
__DATA:__data:803BDF94                 DCD sub_80292250+1  ;d_read
__DATA:__data:803BDF98                 DCD sub_80292660+1  ;d_write
__DATA:__data:803BDF9C                 DCD sub_8029298C+1  ;d_ioctl

0x80292251#0x80292661#0x8029298d

所以三个连在一起是：
0x800c0ea1#0x800c0e39#0x800c0e05#0x802873ad#0x802873ad#0x80149d19#0x80292251#0x80292661#0x8029298d

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！

上传的附件：

• msc 2015 iOS解题报告[ 题01和题02 ] (elyt).doc （143.54kb，11次下载）
• iOS 01(perl_src).zip （0.66kb，15次下载）