Youpk是一款针对Dex整体加固+各式各样的Dex抽取的脱壳机
基本流程如下:
DEX文件在art虚拟机中使用DexFile对象表示, 而ClassLinker中引用了这些对象, 因此可以采用从ClassLinker中遍历DexFile对象并dump的方式来获取.
另外, 为了避免dex做任何形式的优化影响dump下来的dex文件, 在dex2oat中设置 CompilerFilter 为仅验证
创建脱壳线程
在脱壳线程中遍历DexFile的所有ClassDef
解析并初始化Class
主动调用Class的所有Method, 并修改ArtMethod::Invoke使其强制走switch型解释器
在解释器中插桩, 在每条指令执行前设置回调
在回调中做针对性的CodeItem的dump, 这里仅仅是简单的示例了直接dump, 实际上, 针对某些厂商的抽取, 可以真正的执行几条指令等待CodeItem解密后再dump
将dump下来的CodeItem填充到DEX的相应位置中即可. 主要是基于google dx工具修改.
FUPK3: https://bbs.pediy.com/thread-246117.htm
FART: https://bbs.pediy.com/thread-252630.htm
该工具仅仅用来学习交流, 请勿用于非法用途, 否则后果自付！
配置待脱壳的app包名, 准确来讲是进程名称
启动apk等待脱壳
每隔10秒将自动重新脱壳(已完全dump的dex将被忽略), 当日志打印unpack end时脱壳完成
pull出dump文件, dump文件路径为 /data/data/包名/unpacker
调用修复工具 dexfixer.jar, 两个参数, 第一个为dump文件目录(必须为有效路径), 第二个为重组后的DEX目录(不存在将会创建)
仓库地址: 755K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6&6L8%4g2D9L8%4u0Q4x3V1k6#2L8Y4m8S2j5$3E0W2M7R3`.`.
//unpacker.cc
std::list<const DexFile*> Unpacker::getDexFiles() {
std::list<const DexFile*> dex_files;
Thread* const self = Thread::Current();
ClassLinker* class_linker = Runtime::Current()->GetClassLinker();
ReaderMutexLock mu(self, *class_linker->DexLock());
const std::list<ClassLinker::DexCacheData>& dex_caches = class_linker->GetDexCachesData();
for (auto it = dex_caches.begin(); it != dex_caches.end(); ++it) {
ClassLinker::DexCacheData data = *it;
const DexFile* dex_file = data.dex_file;
dex_files.push_back(dex_file);
}
return dex_files;
}
//unpacker.cc
std::list<const DexFile*> Unpacker::getDexFiles() {
std::list<const DexFile*> dex_files;
Thread* const self = Thread::Current();
ClassLinker* class_linker = Runtime::Current()->GetClassLinker();
ReaderMutexLock mu(self, *class_linker->DexLock());
const std::list<ClassLinker::DexCacheData>& dex_caches = class_linker->GetDexCachesData();
for (auto it = dex_caches.begin(); it != dex_caches.end(); ++it) {
ClassLinker::DexCacheData data = *it;
const DexFile* dex_file = data.dex_file;
dex_files.push_back(dex_file);
}
return dex_files;
}
//dex2oat.cc
compiler_options_->SetCompilerFilter(CompilerFilter::kVerifyAtRuntime);
//dex2oat.cc
compiler_options_->SetCompilerFilter(CompilerFilter::kVerifyAtRuntime);
//unpacker.java
public static void unpack() {
if (Unpacker.unpackerThread != null) {
return;
}
//开启线程调用
Unpacker.unpackerThread = new Thread() {
@Override public void run() {
while (true) {
try {
Thread.sleep(UNPACK_INTERVAL);
}
catch (InterruptedException e) {
e.printStackTrace();
}
if (shouldUnpack()) {
Unpacker.unpackNative();
}
}
}
};
Unpacker.unpackerThread.start();
}
//unpacker.java
public static void unpack() {
if (Unpacker.unpackerThread != null) {
return;
}
//开启线程调用
Unpacker.unpackerThread = new Thread() {
@Override public void run() {
while (true) {
try {
Thread.sleep(UNPACK_INTERVAL);
}
catch (InterruptedException e) {
e.printStackTrace();
}
if (shouldUnpack()) {
Unpacker.unpackNative();
}
}
}
};
Unpacker.unpackerThread.start();
}
//unpacker.cc
for (; class_idx < dex_file->NumClassDefs(); class_idx++) {
//unpacker.cc
for (; class_idx < dex_file->NumClassDefs(); class_idx++) {
//unpacker.cc
mirror::Class* klass = class_linker->ResolveType(*dex_file, dex_file->GetClassDef(class_idx).class_idx_, h_dex_cache, h_class_loader);
StackHandleScope<1> hs2(self);
Handle<mirror::Class> h_class(hs2.NewHandle(klass));
bool suc = class_linker->EnsureInitialized(self, h_class, true, true);
//unpacker.cc
mirror::Class* klass = class_linker->ResolveType(*dex_file, dex_file->GetClassDef(class_idx).class_idx_, h_dex_cache, h_class_loader);
StackHandleScope<1> hs2(self);
Handle<mirror::Class> h_class(hs2.NewHandle(klass));
bool suc = class_linker->EnsureInitialized(self, h_class, true, true);
//unpacker.cc
uint32_t args_size = (uint32_t)ArtMethod::NumArgRegisters(method->GetShorty());
if (!method->IsStatic()) {
args_size += 1;
}
JValue result;
std::vector<uint32_t> args(args_size, 0);
if (!method->IsStatic()) {
mirror::Object* thiz = klass->AllocObject(self);
args[0] = StackReference<mirror::Object>::FromMirrorPtr(thiz).AsVRegValue();
}
method->Invoke(self, args.data(), args_size, &result, method->GetShorty());
//art_method.cc
if (UNLIKELY(!runtime->IsStarted() || Dbg::IsForcedInterpreterNeededForCalling(self, this)
|| (Unpacker::isFakeInvoke(self, this) && !this->IsNative()))) {
if (IsStatic()) {
art::interpreter::EnterInterpreterFromInvoke(
self, this, nullptr, args, result, /*stay_in_interpreter*/ true);
} else {
mirror::Object* receiver =
reinterpret_cast<StackReference<mirror::Object>*>(&args[0])->AsMirrorPtr();
art::interpreter::EnterInterpreterFromInvoke(
self, this, receiver, args + 1, result, /*stay_in_interpreter*/ true);
}
}
//interpreter.cc
static constexpr InterpreterImplKind kInterpreterImplKind = kSwitchImplKind;
//unpacker.cc
uint32_t args_size = (uint32_t)ArtMethod::NumArgRegisters(method->GetShorty());
if (!method->IsStatic()) {
args_size += 1;
}
JValue result;
std::vector<uint32_t> args(args_size, 0);
if (!method->IsStatic()) {
mirror::Object* thiz = klass->AllocObject(self);
args[0] = StackReference<mirror::Object>::FromMirrorPtr(thiz).AsVRegValue();
}
method->Invoke(self, args.data(), args_size, &result, method->GetShorty());
//art_method.cc
[培训]传播安全知识、拓宽行业人脉——看雪讲师团队等你加入！
最后于 2021-5-31 13:41
被Youlor编辑
，原因： 开源
bluegatar
