-
-
某易手游反外挂产品原理浅析
-
发表于: 2019-8-9 08:17
-
作者: 我是小三
博客: http://www.cnblogs.com/2014asm/
环境 : ida7.2 jeb3 android4.4.4 dnSpy (5.0.9.0)
由于时间和水平有限，本文会存在诸多不足，希望得到您的及时反馈与指正，多谢!
0x01：反外挂系统基本架构
1. 该反外挂系统主要在U3D、反调试器、代码检验方面，反静态方面做了防护，主要技术用到混淆，内联、字符串加密、SMC等技术，大致框架如图1所示。
图1
0x02：反外挂技术细节分析
1.反外挂系统主要是通过对libmono.so加壳来启动反外挂功能，当游戏启动后加载libmono.so时会先执行initarray中的初始化函数，有三个函数，第三个函数是主要的。
2.反调试：主要通过svc 0指令来获取进程状态，找到所有svc指令,找到open函数，patch掉就过了，让它返回失败.，代码如下:
1 2 3 4 5 6 7 8 9 10 11 | "/proc/self/status"LOAD:003E11D4 NR_openat ; CODE XREF: sub_3D2630+1E↑pLOAD:003E11D4 ; __unwind {LOAD:003E11D4 07 C0 A0 E1 MOV R12, R7LOAD:003E11D8 14 70 9F E5 LDR R7, =322LOAD:003E11DC 00 00 00 EF SVC 0LOAD:003E11E0 0C 70 A0 E1 MOV R7, R12LOAD:003E11E4 01 0A 70 E3 CMN R0, #0x1000LOAD:003E11E8 1E FF 2F 91 BXLS LRLOAD:003E11EC 00 00 60 E2 RSB R0, R0, #0LOAD:003E11F0 00 04 00 EA B sub_3E21F8 |
3.第一次解密代码，计算crc值、判断crc、再次解密其它函数。
解密函数指令(前32字节)，解密后指令计算crc、比较crc，相同后再解密其它函数指令，代码如下：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 | LOAD:762CB7B8LOAD:762CB7B8 ; 指令加解密LOAD:762CB7B8LOAD:762CB7B8 DecCode LOAD:762CB7B8 ; __unwind {LOAD:762CB7B8 2D E9 F0 41 PUSH.W {R4-R8,LR}LOAD:762CB7BC 01 EB 02 08 ADD.W R8, R1, R2LOAD:762CB7C0 0D 46 MOV R5, R1LOAD:762CB7C2 21 F4 7F 64 BIC.W R4, R1, #0xFF0LOAD:762CB7C6 08 F6 FF 71 ADDW R1, R8, #0xFFFLOAD:762CB7CA 83 68 LDR R3, [R0,#8]LOAD:762CB7CC 21 F4 7F 61 BIC.W R1, R1, #0xFF0LOAD:762CB7D0 24 F0 0F 04 BIC.W R4, R4, #0xFLOAD:762CB7D4 21 F0 0F 01 BIC.W R1, R1, #0xFLOAD:762CB7D8 06 46 MOV R6, R0LOAD:762CB7DA 0F 1B SUBS R7, R1, R4LOAD:762CB7DC 9B 68 LDR R3, [R3,#8]LOAD:762CB7DE 20 46 MOV R0, R4LOAD:762CB7E0 07 22 MOVS R2, #7LOAD:762CB7E2 39 46 MOV R1, R7LOAD:762CB7E4 98 47 BLX R3LOAD:762CB7E6 2B 46 MOV R3, R5LOAD:762CB7E8LOAD:762CB7E8 loc_762CB7E8 LOAD:762CB7E8 43 45 CMP R3, R8 ; 解密指令LOAD:762CB7EA 03 F1 01 01 ADD.W R1, R3, #1LOAD:762CB7EE 06 D0 BEQ loc_762CB7FELOAD:762CB7F0 1A 78 LDRB R2, [R3] ; 加密后的指令LOAD:762CB7F2 0B 46 MOV R3, R1LOAD:762CB7F4 82 F0 58 02 EOR.W R2, R2, #0x58LOAD:762CB7F8 01 F8 01 2C STRB.W R2, [R1,#-1]LOAD:762CB7FC F4 E7 B loc_762CB7E8 ; 解密指令LOAD:762CB7FE LOAD:762CB7FELOAD:762CB7FE loc_762CB7FE LOAD:762CB7FE B3 68 LDR R3, [R6,#8]LOAD:762CB800 28 46 MOV R0, R5LOAD:762CB802 00 22 MOVS R2, #0LOAD:762CB804 D3 F8 D8 30 LDR.W R3, [R3,#0xD8]LOAD:762CB808 98 47 BLX R3LOAD:762CB80A B3 68 LDR R3, [R6,#8]LOAD:762CB80C 20 46 MOV R0, R4LOAD:762CB80E 39 46 MOV R1, R7LOAD:762CB810 05 22 MOVS R2, #5LOAD:762CB812 5B 68 LDR R3, [R3,#4]LOAD:762CB814 98 47 BLX R3LOAD:762CB816 BD E8 F0 81 POP.W {R4-R8,PC}<font color="#000000" face=""><span style="font-size:15px;"></span></font> |
4.下面是解密后代码，计算并比较代码crc值，直接nop掉,因为该指令是被加密存放的，如果要文件pathc，须先将nop指令加密再进行patch。代码如下：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 | LOAD:762CB8F4 sub_762CB8F4LOAD:762CB8F4LOAD:762CB8F4 arg_140= 0x140LOAD:762CB8F4 arg_160= 0x160LOAD:762CB8F4LOAD:762CB8F4 00 F0 9A FD BL sub_762CC42CLOAD:762CB8F8 20 46 MOV R0, R4LOAD:762CB8FA 29 46 MOV R1, R5LOAD:762CB8FC 00 F0 EE FB BL crc22 ; 计算并比较代码crc值,直接nop掉LOAD:762CB900 C0 46 NOP //如果crc值不一样就不走解密函数流程LOAD:762CB900 ; End of function sub_762CB8F4LOAD:762CB900LOAD:762CB902 01 AE ADD R6, SP, #4LOAD:762CB904 29 46 MOV R1, R5LOAD:762CB906 01 22 MOVS R2, #1LOAD:762CB908 30 46 MOV R0, R6LOAD:762CB90A 00 F0 9D F8 BL DecFuncLOAD:762CB90E 30 46 MOV R0, R6LOAD:762CB910 00 F0 5C FA BL sub_762CBDCCLOAD:762CB914 20 46 MOV R0, R4LOAD:762CB916 00 F0 AB FD BL sub_762CC470LOAD:762CB91A 0D F5 84 6D ADD.W SP, SP, #0x420LOAD:762CB91E 70 BD POP {R4-R6,PC}<font color="#000000" face=""><span style="font-size:15px;"></span></font> |
5.计算代码crc值，代码如下：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 | LOAD:762CBF94LOAD:762CBF94 ; 计算crc A2E12890LOAD:762CBF94LOAD:762CBF94 GetCodeCrc LOAD:762CBF94 ; __unwind {LOAD:762CBF94 70 B5 PUSH {R4-R6,LR}LOAD:762CBF96 4F F0 FF 33 MOV.W R3, #0xFFFFFFFFLOAD:762CBF9A 00 24 MOVS R4, #0LOAD:762CBF9CLOAD:762CBF9C loc_762CBF9C LOAD:762CBF9C 94 42 CMP R4, R2LOAD:762CBF9E 09 D0 BEQ loc_762CBFB4LOAD:762CBFA0 0E 5D LDRB R6, [R1,R4] ; 取代码字节LOAD:762CBFA2 DD B2 UXTB R5, R3LOAD:762CBFA4 01 34 ADDS R4, #1LOAD:762CBFA6 75 40 EORS R5, R6LOAD:762CBFA8 02 35 ADDS R5, #2LOAD:762CBFAA 50 F8 25 50 LDR.W R5, [R0,R5,LSL#2] ; 查表LOAD:762CBFAE 85 EA 13 23 EOR.W R3, R5, R3,LSR#8LOAD:762CBFB2 F3 E7 B loc_762CBF9CLOAD:762CBFB4LOAD:762CBFB4LOAD:762CBFB4 loc_762CBFB4LOAD:762CBFB4 D8 43 MVNS R0, R3LOAD:762CBFB6 70 BD POP {R4-R6,PC}<font color="#000000" face=""><span style="font-size:15px;"></span></font> |
6.比较crc值，相同返回0，代码如下：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 | LOAD:762CB67A ; 比较crc值LOAD:762CB67ALOAD:762CB67A cmpcrcLOAD:762CB67A 02 44 ADD R2, R0LOAD:762CB67C 03 46 MOV R3, R0LOAD:762CB67E 10 B5 PUSH {R4,LR}LOAD:762CB680LOAD:762CB680 loc_762CB680LOAD:762CB680 93 42 CMP R3, R2LOAD:762CB682 1C D2 BCS loc_762CB6BELOAD:762CB684 1C 78 LDRB R4, [R3]LOAD:762CB686 08 78 LDRB R0, [R1]LOAD:762CB688 20 1A SUBS R0, R4, R0LOAD:762CB68A 19 D1 BNE locret_762CB6C0LOAD:762CB68C 5C 1C ADDS R4, R3, #1LOAD:762CB68E A2 42 CMP R2, R4LOAD:762CB690 16 D9 BLS locret_762CB6C0LOAD:762CB692 5C 78 LDRB R4, [R3,#1]LOAD:762CB694 48 78 LDRB R0, [R1,#1]LOAD:762CB696 20 1A SUBS R0, R4, R0LOAD:762CB698 12 D1 BNE locret_762CB6C0LOAD:762CB69A 9C 1C ADDS R4, R3, #2LOAD:762CB69C A2 42 CMP R2, R4LOAD:762CB69E 0F D9 BLS locret_762CB6C0LOAD:762CB6A0 9C 78 LDRB R4, [R3,#2]LOAD:762CB6A2 88 78 LDRB R0, [R1,#2]LOAD:762CB6A4 20 1A SUBS R0, R4, R0LOAD:762CB6A6 0B D1 BNE locret_762CB6C0LOAD:762CB6A8 DC 1C ADDS R4, R3, #3LOAD:762CB6AA A2 42 CMP R2, R4LOAD:762CB6AC 08 D9 BLS locret_762CB6C0LOAD:762CB6AE DC 78 LDRB R4, [R3,#3]LOAD:762CB6B0 04 31 ADDS R1, #4LOAD:762CB6B2 11 F8 01 0C LDRB.W R0, [R1,#-1]LOAD:762CB6B6 04 33 ADDS R3, #4LOAD:762CB6B8 20 1A SUBS R0, R4, R0LOAD:762CB6BA E1 D0 BEQ loc_762CB680LOAD:762CB6BC 10 BD POP {R4,PC}LOAD:762CB6BE LOAD:762CB6BELOAD:762CB6BE loc_762CB6BELOAD:762CB6BE 00 20 MOVS R0, #0LOAD:762CB6C0LOAD:762CB6C0 locret_762CB6C0LOAD:762CB6C0 LOAD:762CB6C0 10 BD POP {R4,PC}<font color="#000000" face=""><span style="font-size:15px;"></span></font> |
7.如果crc值一样，就解密其它8个函数，并修复mono导出、hook函数mono_image_open_from_data_with_name、加载libNetHTProtect.so，调用libNetHTProtect.so中函数，反函数指令加密回去，代码如下：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 | 解密8个函数(解密前32字节)LOAD:762CB9C8 loc_762CB9C8LOAD:762CB9C8 55 F8 04 1F LDR.W R1, [R5,#4]!LOAD:762CB9CC 29 B1 CBZ R1, loc_762CB9DA ; 比较是否解密结束LOAD:762CB9CE 23 68 LDR R3, [R4]LOAD:762CB9D0 20 46 MOV R0, R4LOAD:762CB9D2 39 44 ADD R1, R7LOAD:762CB9D4 EA 69 LDR R2, [R5,#0x1C]LOAD:762CB9D6 5B 68 LDR R3, [R3,#4]LOAD:762CB9D8 98 47 BLX R3 ; 解密函数前32字节,R1要解密的函数,R2大小,R3解密函数LOAD:762CB9DALOAD:762CB9DA loc_762CB9DA LOAD:762CB9DA B5 42 CMP R5, R6 ; 比较是否解密结束LOAD:762CB9DC F4 D1 BNE loc_762CB9C8LOAD:762CB9DE BD E8 F0 41 POP.W {R4-R8,LR}LOAD:762CB9E2 04 B0 ADD SP, SP, #0x10LOAD:762CB9E4 70 47 BX LR//解密函数LOAD:762CB9E6 DecCode_0LOAD:762CB9E6 ; __unwind {LOAD:762CB9E6 2D E9 F0 41 PUSH.W {R4-R8,LR}LOAD:762CB9EA 01 EB 02 08 ADD.W R8, R1, R2LOAD:762CB9EE 0D 46 MOV R5, R1LOAD:762CB9F0 21 F4 7F 64 BIC.W R4, R1, #0xFF0LOAD:762CB9F4 08 F6 FF 71 ADDW R1, R8, #0xFFFLOAD:762CB9F8 43 68 LDR R3, [R0,#4]LOAD:762CB9FA 21 F4 7F 61 BIC.W R1, R1, #0xFF0LOAD:762CB9FE 24 F0 0F 04 BIC.W R4, R4, #0xFLOAD:762CBA02 21 F0 0F 01 BIC.W R1, R1, #0xFLOAD:762CBA06 06 46 MOV R6, R0LOAD:762CBA08 0F 1B SUBS R7, R1, R4LOAD:762CBA0A 5B 68 LDR R3, [R3,#4]LOAD:762CBA0C 20 46 MOV R0, R4LOAD:762CBA0E 07 22 MOVS R2, #7LOAD:762CBA10 39 46 MOV R1, R7LOAD:762CBA12 98 47 BLX R3LOAD:762CBA14 29 46 MOV R1, R5LOAD:762CBA16LOAD:762CBA16 loc_762CBA16LOAD:762CBA16 41 45 CMP R1, R8LOAD:762CBA18 05 D0 BEQ loc_762CBA26LOAD:762CBA1A 0A 78 LDRB R2, [R1]LOAD:762CBA1C 82 F0 58 02 EOR.W R2, R2, #0x58 ; 解密代码LOAD:762CBA20 01 F8 01 2B STRB.W R2, [R1],#1LOAD:762CBA24 F7 E7 B loc_762CBA16LOAD:762CBA26 LOAD:762CBA26LOAD:762CBA26 loc_762CBA26LOAD:762CBA26 72 68 LDR R2, [R6,#4]LOAD:762CBA28 A5 F1 10 00 SUB.W R0, R5, #0x10LOAD:762CBA2C 20 31 ADDS R1, #0x20 ; ' 'LOAD:762CBA2E D2 F8 D8 C0 LDR.W R12, [R2,#0xD8]LOAD:762CBA32 00 22 MOVS R2, #0LOAD:762CBA34 E0 47 BLX R12LOAD:762CBA36 73 68 LDR R3, [R6,#4]LOAD:762CBA38 20 46 MOV R0, R4LOAD:762CBA3A 39 46 MOV R1, R7LOAD:762CBA3C 05 22 MOVS R2, #5LOAD:762CBA3E 5B 68 LDR R3, [R3,#4]LOAD:762CBA40 98 47 BLX R3LOAD:762CBA42 BD E8 F0 81 POP.W {R4-R8,PC}<font color="#000000" face=""><span style="font-size:15px;"></span></font> |
8.把比较crc与解密其它8个函数的指令加密回去，代码如下：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 | 加密函数指令(32字节)LOAD:762CB7B8LOAD:762CB7B8 ; 指令加密LOAD:762CB7B8LOAD:762CB7B8 DecCode LOAD:762CB7B8 ; __unwind {LOAD:762CB7B8 2D E9 F0 41 PUSH.W {R4-R8,LR}LOAD:762CB7BC 01 EB 02 08 ADD.W R8, R1, R2LOAD:762CB7C0 0D 46 MOV R5, R1LOAD:762CB7C2 21 F4 7F 64 BIC.W R4, R1, #0xFF0LOAD:762CB7C6 08 F6 FF 71 ADDW R1, R8, #0xFFFLOAD:762CB7CA 83 68 LDR R3, [R0,#8]LOAD:762CB7CC 21 F4 7F 61 BIC.W R1, R1, #0xFF0LOAD:762CB7D0 24 F0 0F 04 BIC.W R4, R4, #0xFLOAD:762CB7D4 21 F0 0F 01 BIC.W R1, R1, #0xFLOAD:762CB7D8 06 46 MOV R6, R0LOAD:762CB7DA 0F 1B SUBS R7, R1, R4LOAD:762CB7DC 9B 68 LDR R3, [R3,#8]LOAD:762CB7DE 20 46 MOV R0, R4LOAD:762CB7E0 07 22 MOVS R2, #7LOAD:762CB7E2 39 46 MOV R1, R7LOAD:762CB7E4 98 47 BLX R3LOAD:762CB7E6 2B 46 MOV R3, R5LOAD:762CB7E8LOAD:762CB7E8 loc_762CB7E8LOAD:762CB7E8 43 45 CMP R3, R8 ; 加密指令LOAD:762CB7EA 03 F1 01 01 ADD.W R1, R3, #1LOAD:762CB7EE 06 D0 BEQ loc_762CB7FELOAD:762CB7F0 1A 78 LDRB R2, [R3] ; 加密后的指令LOAD:762CB7F2 0B 46 MOV R3, R1LOAD:762CB7F4 82 F0 58 02 EOR.W R2, R2, #0x58LOAD:762CB7F8 01 F8 01 2C STRB.W R2, [R1,#-1]LOAD:762CB7FC F4 E7 B loc_762CB7E8 ; 加密指令LOAD:762CB7FE LOAD:762CB7FELOAD:762CB7FE loc_762CB7FELOAD:762CB7FE B3 68 LDR R3, [R6,#8]LOAD:762CB800 28 46 MOV R0, R5LOAD:762CB802 00 22 MOVS R2, #0LOAD:762CB804 D3 F8 D8 30 LDR.W R3, [R3,#0xD8]LOAD:762CB808 98 47 BLX R3LOAD:762CB80A B3 68 LDR R3, [R6,#8]LOAD:762CB80C 20 46 MOV R0, R4LOAD:762CB80E 39 46 MOV R1, R7LOAD:762CB810 05 22 MOVS R2, #5LOAD:762CB812 5B 68 LDR R3, [R3,#4]LOAD:762CB814 98 47 BLX R3LOAD:762CB816 BD E8 F0 81 POP.W {R4-R8,PC}<font color="#000000" face=""><span style="font-size:15px;"></span></font> |
9.解密so字符串还原导出表，代码如下：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 | LOAD:762B4EEE arg_4C= 0x4CLOAD:762B4EEELOAD:762B4EEE 70 B5 PUSH {R4-R6,LR}LOAD:762B4EF0LOAD:762B4EF0 04 46 MOV R4, R0LOAD:762B4EF2 43 68 LDR R3, [R0,#4]LOAD:762B4EF4 13 B9 CBNZ R3, loc_762B4EFCLOAD:762B4EF6LOAD:762B4EF6LOAD:762B4EF6 loc_762B4EF6LOAD:762B4EF6 4F F0 FF 30 MOV.W R0, #0xFFFFFFFFLOAD:762B4EFA 70 BD POP {R4-R6,PC}LOAD:762B4EFCLOAD:762B4EFCLOAD:762B4EFC loc_762B4EFCLOAD:762B4EFC C0 68 LDR R0, [R0,#0xC]LOAD:762B4EFE 03 68 LDR R3, [R0]LOAD:762B4F00 1B 68 LDR R3, [R3]LOAD:762B4F02 98 47 BLX R3LOAD:762B4F04 01 46 MOV R1, R0LOAD:762B4F06 00 28 CMP R0, #0LOAD:762B4F08 F5 D0 BEQ loc_762B4EF6LOAD:762B4F0A 23 68 LDR R3, [R4]LOAD:762B4F0C 20 46 MOV R0, R4LOAD:762B4F0E 62 68 LDR R2, [R4,#4]LOAD:762B4F10 5B 68 LDR R3, [R3,#4]LOAD:762B4F12 98 47 BLX R3LOAD:762B4F14 23 68 LDR R3, [R4]LOAD:762B4F16 E0 68 LDR R0, [R4,#0xC]LOAD:762B4F18 5D 69 LDR R5, [R3,#0x14]LOAD:762B4F1A 03 68 LDR R3, [R0]LOAD:762B4F1C 9B 68 LDR R3, [R3,#8]LOAD:762B4F1E 98 47 BLX R3LOAD:762B4F20 06 46 MOV R6, R0LOAD:762B4F22 E0 68 LDR R0, [R4,#0xC]LOAD:762B4F24 02 68 LDR R2, [R0]LOAD:762B4F26 D2 68 LDR R2, [R2,#0xC]LOAD:762B4F28 90 47 BLX R2LOAD:762B4F2A 31 46 MOV R1, R6LOAD:762B4F2C 63 68 LDR R3, [R4,#4]LOAD:762B4F2E 02 46 MOV R2, R0LOAD:762B4F30 20 46 MOV R0, R4LOAD:762B4F32 A8 47 BLX R5 ; 解密字符串表LOAD:762B4F34 23 68 LDR R3, [R4]LOAD:762B4F36 E1 69 LDR R1, [R4,#0x1C]LOAD:762B4F38 20 46 MOV R0, R4LOAD:762B4F3A DB 6A LDR R3, [R3,#0x2C]LOAD:762B4F3C 98 47 BLX R3LOAD:762B4F3E 23 69 LDR R3, [R4,#0x10]LOAD:762B4F40 E0 68 LDR R0, [R4,#0xC]LOAD:762B4F42 5D 6F LDR R5, [R3,#0x74]LOAD:762B4F44 03 68 LDR R3, [R0]LOAD:762B4F46 9B 68 LDR R3, [R3,#8]LOAD:762B4F48 98 47 BLX R3LOAD:762B4F4A 63 68 LDR R3, [R4,#4]LOAD:762B4F4C D3 F8 8C 10 LDR.W R1, [R3,#0x8C]LOAD:762B4F50 A8 47 BLX R5 ; 解密so数据，还原导出LOAD:762B4F52 23 68 LDR R3, [R4]LOAD:762B4F54 20 46 MOV R0, R4LOAD:762B4F56 61 68 LDR R1, [R4,#4]LOAD:762B4F58 9B 68 LDR R3, [R3,#8]LOAD:762B4F5A 98 47 BLX R3LOAD:762B4F5C 00 20 MOVS R0, #0LOAD:762B4F5E 70 BD POP {R4-R6,PC} |
此时将libmono.so从内存中dump出来可以看到导出了。
10.获取libNetHTProtect.so中的函数(反调试)，代码如下：1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 | LOAD:762B7856 loc_762B7856 LOAD:762B7856 09 9E LDR R6, [SP,#0x24] ; dlopensoLOAD:762B7858 0F 98 LDR R0, [SP,#0x3C]LOAD:762B785A 33 68 LDR R3, [R6]LOAD:762B785C 5B 6D LDR R3, [R3,#0x54]LOAD:762B785E 98 47 BLX R3LOAD:762B7860 AD B1 CBZ R5, loc_762B788ELOAD:762B7862 33 68 LDR R3, [R6]LOAD:762B7864 0D F2 EC 40 ADDW R0, SP, #0x4ECLOAD:762B7868 00 21 MOVS R1, #0LOAD:762B786A 5B 6A LDR R3, [R3,#0x24]LOAD:762B786C 98 47 BLX R3 ; dlopen libNetHTProtect.soLOAD:762B786E 00 28 CMP R0, #0LOAD:762B7870 00 F0 12 81 BEQ.W loc_762B7A98<font color="#000000" face=""><span style="font-size:15px;"></span></font> |
11.hook函数mono_image_open_from_data_with_name，代码如下:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 | LOAD:762B8DF2 loc_762B8DF2LOAD:762B8DF2 21 68 LDR R1, [R4] ; hookLOAD:762B8DF4 53 00 LSLS R3, R2, #1LOAD:762B8DF6 4F F6 DF 00 MOVW R0, #0xF8DFLOAD:762B8DFA 21 F0 01 01 BIC.W R1, R1, #1LOAD:762B8DFE 21 F8 12 00 STRH.W R0, [R1,R2,LSL#1]LOAD:762B8E02 4F F4 70 41 MOV.W R1, #0xF000LOAD:762B8E06 22 68 LDR R2, [R4]LOAD:762B8E08 22 F0 01 02 BIC.W R2, R2, #1LOAD:762B8E0C 1A 44 ADD R2, R3LOAD:762B8E0E 51 80 STRH R1, [R2,#2]LOAD:762B8E10 22 68 LDR R2, [R4]LOAD:762B8E12 22 F0 01 02 BIC.W R2, R2, #1LOAD:762B8E16 99 18 ADDS R1, R3, R2LOAD:762B8E18 62 68 LDR R2, [R4,#4]LOAD:762B8E1A 8A 80 STRH R2, [R1,#arg_4]LOAD:762B8E1C 22 68 LDR R2, [R4,#(loc_762B8EF0 - 0x762B8EF0)]LOAD:762B8E1E 22 F0 01 02 BIC.W R2, R2, #1LOAD:762B8E22 13 44 ADD R3, R2LOAD:762B8E24 E2 88 LDRH R2, [R4,#6]LOAD:762B8E26 DA 80 STRH R2, [R3,#6]LOAD:762B8E28 04 E0 B loc_762B8E34LOAD:762B8E2A LOAD:762B8E2ALOAD:762B8E2A loc_762B8E2ALOAD:762B8E2A 60 4A LDR R2, =0xE51FF004LOAD:762B8E2C 1A 60 STR R2, [R3]LOAD:762B8E2E 62 68 LDR R2, [R4,#4]LOAD:762B8E30LOAD:762B8E30 loc_762B8E30LOAD:762B8E30 23 68 LDR R3, [R4]LOAD:762B8E32 5A 60 STR R2, [R3,#4]LOAD:762B8E34LOAD:762B8E34 loc_762B8E34 LOAD:762B8E34 A3 68 LDR R3, [R4,#8]LOAD:762B8E36 3B B1 CBZ R3, loc_762B8E48LOAD:762B8E38 22 68 LDR R2, [R4]LOAD:762B8E3A 12 F0 01 0F TST.W R2, #1LOAD:762B8E3E 62 6F LDR R2, [R4,#0x74]LOAD:762B8E40 18 BF IT NELOAD:762B8E42 42 F0 01 02 ORRNE.W R2, R2, #1LOAD:762B8E46 1A 60 STR R2, [R3]LOAD:762B8E48LOAD:762B8E48 loc_762B8E48 LOAD:762B8E48 LOAD:762B8E48 02 9E LDR R6, [SP,#8]LOAD:762B8E4A 00 22 MOVS R2, #0LOAD:762B8E4C 20 68 LDR R0, [R4,#arg_0]LOAD:762B8E4E A1 6F LDR R1, [R4,#0x78]LOAD:762B8E50LOAD:762B8E50 loc_762B8E50LOAD:762B8E50 33 68 LDR R3, [R6]LOAD:762B8E52 20 F0 01 00 BIC.W R0, R0, #1LOAD:762B8E56 01 44 ADD R1, R0LOAD:762B8E58 D3 F8 D8 30 LDR.W R3, [R3,#arg_D8]LOAD:762B8E5C 98 47 BLX R3 ; cacheflush<font color="#000000" face=""><span style="font-size:15px;"></span></font> |
12.再将解密的so数据加密加回去，代码如下:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 | LOAD:762B7B2A loc_762B7B2A LOAD:762B7B2A A1 42 CMP R1, R4LOAD:762B7B2C 17 D0 BEQ loc_762B7B5ELOAD:762B7B2E 01 33 ADDS R3, #(loc_762B7CA8+1 - 0x762B7CA8)LOAD:762B7B30 0D F6 EC 07 ADDW R7, SP, #0x8ECLOAD:762B7B34 DB B2 UXTB R3, R3LOAD:762B7B36 F8 5C LDRB R0, [R7,R3]LOAD:762B7B38 02 44 ADD R2, R0LOAD:762B7B3A D2 B2 UXTB R2, R2LOAD:762B7B3C BD 5C LDRB R5, [R7,R2]LOAD:762B7B3E FD 54 STRB R5, [R7,R3]LOAD:762B7B40 B8 54 STRB R0, [R7,R2]LOAD:762B7B42 FD 5C LDRB R5, [R7,R3]LOAD:762B7B44 28 44 ADD R0, R5LOAD:762B7B46 C0 B2 UXTB R0, R0LOAD:762B7B48 38 5C LDRB R0, [R7,R0]LOAD:762B7B4A 05 11 ASRS R5, R0, #arg_4LOAD:762B7B4C 45 EA 00 10 ORR.W R0, R5, R0,LSL#4LOAD:762B7B50 4D 78 LDRB R5, [R1,#1]LOAD:762B7B52 C0 B2 UXTB R0, R0LOAD:762B7B54 5C 38 SUBS R0, #0x5C ; '\'LOAD:762B7B56 68 40 EORS R0, R5LOAD:762B7B58 01 F8 01 0F STRB.W R0, [R1,#1]!<font color="#000000" face=""><span style="font-size:15px;"></span></font> |
13.调用libNetHTProtect.so中的函数(反调试)
1 2 3 4 | 直接patch让它返回libNetHTProtect.so:764DFA84 2D E9 F0 4F PUSH.W {R4-R11,LR}libNetHTProtect.so:764DFA88 BD E8 F0 8F POP.W {R4-R11,PC}<font color="#000000" face=""><span style="font-size:15px;"></span></font> |
14.再将解密的8个函数再加密回去，代码如下：
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
赞赏记录
参与人
雪币
留言
时间
东方玻璃
为你点赞~
2024-5-10 14:10
PLEBFE
为你点赞~
2022-7-27 22:10
飘零丶
为你点赞~
2022-7-17 02:49
LED007
为你点赞~
2019-11-18 00:27
symofeng
为你点赞~
2019-8-9 10:25
打赏
+ 103.00雪花
| 打赏次数 3 | 雪花 + 103.00 | 收起 |
LED007
|
+1.00 | 2019/11/18 | 寻移动端安卓逆向破解大神，可以做的话VC联系：七929七6542 |
ucantseeme
|
+100.00 | 2019/08/29 | 写得太乱了，给个次高打赏吧，不过楼主水平是肯定的 |
orz1ruo
|
+2.00 | 2019/08/09 | 感谢分享～ |
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
这种的网易还原方法体简单，另一种dump出来的DLL Pe格式都处理的需要还原难
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
