能力值:
( LV2,RANK:10 )
2 楼
没有安装app 大概看了一下 签名应该是 listToStr().encode().convert().toString()
能力值:
( LV2,RANK:10 )
3 楼
sha256
能力值:
( LV2,RANK:10 )
4 楼
hexToUnitList 然后 aesSetKeys 不知道对不对 我也是新手
能力值:
( LV2,RANK:10 )
5 楼
大致改完是这样把 手机没电了 没安装 流程对了剩下就是hook的事情了
能力值:
( LV2,RANK:10 )
6 楼
666
能力值:
( LV2,RANK:10 )
7 楼
湘子zyx
大致改完是这样把 手机没电了 没安装 流程对了剩下就是hook的事情了
大神给你发私信了,也加你QQ了 麻烦看下
能力值:
( LV12,RANK:219 )
8 楼
湘子zyx
大致改完是这样把 手机没电了 没安装 流程对了剩下就是hook的事情了
我挺好奇的 现在dart快照没有反编译 你这是怎么搞出来的
能力值:
( LV3,RANK:20 )
9 楼
湘子zyx
大致改完是这样把 手机没电了 没安装 流程对了剩下就是hook的事情了
牛皮
能力值:
( LV1,RANK:0 )
10 楼
湘子zyx
大致改完是这样把 手机没电了 没安装 流程对了剩下就是hook的事情了
tql
能力值:
( LV2,RANK:10 )
11 楼
逆出来了 没有雪币 私信不了
能力值:
( LV2,RANK:10 )
12 楼
KEY hex 9开头 IV hex 5开头
能力值:
( LV2,RANK:10 )
13 楼
你QQ设置了 只允许通过email添加
能力值:
( LV1,RANK:0 )
14 楼
大佬 可否讲解一下过程
能力值:
( LV1,RANK:0 )
15 楼
湘子zyx
没有安装app 大概看了一下 签名应该是 listToStr().encode().convert().toString()
大佬
可否讲解一下过程
能力值:
( LV1,RANK:0 )
16 楼
湘子zyx
大致改完是这样把 手机没电了 没安装 流程对了剩下就是hook的事情了
大佬 有没有过程可以讲解一下
能力值:
( LV1,RANK:0 )
17 楼
你们这群新手都去哪里看教程,我想成为新手~
能力值:
( LV2,RANK:10 )
18 楼
我猜因为没加密和混淆 reflutter + ida就可以逆出来
能力值:
( LV2,RANK:10 )
19 楼
long _MyHomePageState@581501071__d(long param0, long param1, long param2, long param3, long param4, long param5, long param6, long param7) { long* ptr0, ptr1, ptr2, ptr3; long v0, v1, v2; long* ptr4; long v3; *(ptr0 - 2) = v0; *(ptr0 - 1) = v2; unsigned long* ptr5 = (unsigned long*)(ptr0 - 2); unsigned long* ptr6 = (unsigned long*)(ptr0 - 2); long* ptr7 = ptr0 - 6; long v4 = 62L; if((unsigned long)(ptr0 - 6) <= *(ptr4 + 8)) { v4 = sub_1E7838(62L, 60L, param2, param3, param4, param5, param6, param7); } *(ptr0 - 7) = *ptr0; long* ptr8 = ptr0 - 7; long v5 = __base64Decode(v4); long* ptr9 = ptr0 - 6; *(ptr0 - 3) = v5; sub_12FBB8(); *(unsigned long*)(ptr0 - 4) = ptr1; *(unsigned long*)(ptr0 - 7) = ptr1; long* ptr10 = ptr0 - 7; long v6 = _Aes@17455385___Aes@17455385.((long)ptr1); long* ptr11 = ptr0 - 6; sub_12FA90(); long* ptr12 = ptr1; long v7 = *(ptr0 - 4); *(unsigned long*)(ptr0 - 5) = ptr1; *(long*)((char*)ptr1 + 7L) = v7; long v8 = ___StringExtension|toUtf16Bytes@17455385(v7, (long)ptr1); *(ptr0 - 7) = *(ptr0 - 5); long* ptr13 = ptr0 - 7; long v9 = AesCrypt__setUserData(v8); long* ptr14 = ptr0 - 6; long* ptr15 = (long*)sub_1E75E8(v9, v3, 64L); *(long*)((char*)ptr15 + 23L) = *(ptr3 + 0x1416); *(long*)((char*)ptr15 + 31L) = *(ptr3 + 0x1417); *(long*)((char*)ptr15 + 39L) = *(ptr3 + 0x1418); *(long*)((char*)ptr15 + 47L) = *(ptr3 + 0x1419); *(long*)((char*)ptr15 + 55L) = *(ptr3 + 0x1416); *(long*)((char*)ptr15 + 63L) = *(ptr3 + 0x141a); *(long*)((char*)ptr15 + 71L) = *(ptr3 + 0x141b); *(long*)((char*)ptr15 + 79L) = *(ptr3 + 0x141c); *(long*)((char*)ptr15 + 87L) = *(ptr3 + 0x141d); *(long*)((char*)ptr15 + 95L) = *(ptr3 + 0x1419); *(long*)((char*)ptr15 + 103L) = *(ptr3 + 0x1418); *(long*)((char*)ptr15 + 111L) = *(ptr3 + 0x141c); *(long*)((char*)ptr15 + 119L) = *(ptr3 + 0x1419); *(long*)((char*)ptr15 + 127L) = *(ptr3 + 0x1417); *(long*)((char*)ptr15 + 135L) = *(ptr3 + 0x1418); *(long*)((char*)ptr15 + 143L) = *(ptr3 + 0x141d); *(long*)((char*)ptr15 + 151L) = *(ptr3 + 0x1418); *(long*)((char*)ptr15 + 159L) = *(ptr3 + 0x141b); *(long*)((char*)ptr15 + 167L) = *(ptr3 + 0x1416); *(long*)((char*)ptr15 + 175L) = *(ptr3 + 0x141c); *(long*)((char*)ptr15 + 183L) = *(ptr3 + 0x141e); *(long*)((char*)ptr15 + 191L) = *(ptr3 + 0x1418); *(long*)((char*)ptr15 + 199L) = *(ptr3 + 0x141b); *(long*)((char*)ptr15 + 207L) = *(ptr3 + 0x1417); *(long*)((char*)ptr15 + 215L) = *(ptr3 + 0x1417); *(long*)((char*)ptr15 + 223L) = *(ptr3 + 0x141c); *(long*)((char*)ptr15 + 231L) = *(ptr3 + 0x1418); *(long*)((char*)ptr15 + 239L) = *(ptr3 + 0x141b); *(long*)((char*)ptr15 + 247L) = *(ptr3 + 0x1417); *(long*)((char*)ptr15 + 0xffL) = *(ptr3 + 0x1419); *(long*)((char*)ptr15 + 263L) = *(ptr3 + 0x141a); *(long*)((char*)ptr15 + 271L) = *(ptr3 + 0x1416); *(unsigned long*)(ptr0 - 8) = ptr15; *(ptr0 - 7) = v3; long* ptr16 = ptr0 - 8; long* ptr17 = (long*)_GrowableList@0150898___GrowableList@0150898._withData@0150898(); long* ptr18 = ptr0 - 6; *(unsigned long*)(ptr0 - 4) = ptr17; long v10 = 64L; *(long*)((char*)ptr17 + 15L) = 64L; long v11 = *(ptr0 + 1); *(ptr0 - 8) = *(ptr3 + 0x133c); *(ptr0 - 7) = v11; long* ptr19 = ptr0 - 8; long v12 = _MyHomePageState@581501071__listToStr((long)ptr17); long* ptr20 = ptr0 - 6; *(ptr0 - 6) = v12; long v13 = *(ptr0 + 1); *(ptr0 - 8) = *(ptr0 - 4); *(ptr0 - 7) = v13; long* ptr21 = ptr0 - 8; long v14 = _MyHomePageState@581501071__listToStr(v12); long* ptr22 = ptr0 - 6; *(ptr0 - 4) = v14; long v15 = *(ptr3 + 169); *(ptr0 - 8) = *(ptr0 - 6); *(ptr0 - 7) = v15; long* ptr23 = ptr0 - 8; long v16 = Codec__encode(v14); long* ptr24 = ptr0 - 6; long v17 = *(ptr3 + 5151); *(ptr0 - 8) = v16; *(ptr0 - 7) = v17; long* ptr25 = ptr0 - 8; long v18 = Hash__convert(v16); long* ptr26 = ptr0 - 6; *(ptr0 - 7) = v18; long* ptr27 = ptr0 - 7; long* ptr28 = (long*)Digest__toString(v18); long* ptr29 = ptr0 - 6; long v19 = (unsigned long)*(short*)((char*)ptr28 + 1L); *(unsigned long*)(ptr0 - 7) = ptr28; long* ptr30 = ptr0 - 7; long v20 = v19 - 0xff6L; long v21 = *(long*)((v19 - 0xff6L) * 8L + (long)ptr2)(v19 - 0xff6L, v19); long* ptr31 = ptr0 - 6; long v22 = *(ptr3 + 9); *(ptr0 - 8) = v21; *(ptr0 - 7) = v22; long* ptr32 = ptr0 - 8; long v23 = _StringBase@0150898__+(v21); long* ptr33 = ptr0 - 6; *(ptr0 - 6) = v23; if(v23 != v3) { sub_8B16C(); long* ptr34 = ptr1; long v24 = *(ptr0 - 6); *(long*)((char*)ptr1 + 15L) = *(ptr0 - 6); *(unsigned long*)(ptr0 - 8) = ptr1; *(ptr0 - 7) = v3; long* ptr35 = ptr0 - 8; long v25 = Uint8List__Uint8List.fromList(v24, (long)ptr1); long* ptr36 = ptr0 - 6; long v26 = *(ptr0 - 5); *(ptr0 - 8) = v25; *(ptr0 - 7) = v26; long* ptr37 = ptr0 - 8; long v27 = AesCrypt__sha256(v25, v1, param2, param3, param4, param5, param6, param7); long* ptr38 = ptr0 - 6; *(ptr0 - 6) = v27; long v28 = *(ptr0 + 1); *(ptr0 - 8) = *(ptr0 - 4); *(ptr0 - 7) = v28; long* ptr39 = ptr0 - 8; long v29 = _MyHomePageState@581501071__hexToUnitList(v27); long* ptr40 = ptr0 - 6; long v30 = *(ptr0 - 5); *(ptr0 - 8) = *(ptr0 - 6); *(ptr0 - 7) = v30; long* ptr41 = ptr0 - 8; *(ptr0 - 9) = v29; long* ptr42 = ptr0 - 9; long v31 = AesCrypt__aesSetKeys(v29, v1, param2, param3, param4, param5, param6, param7); long* ptr43 = ptr0 - 6; *(ptr0 - 7) = *(ptr0 - 5); long* ptr44 = ptr0 - 7; long v32 = AesCrypt__aesSetMode(v31); long* ptr45 = ptr0 - 6; v22 = *(ptr0 - 5); *(ptr0 - 8) = *(ptr0 - 3); *(ptr0 - 7) = v22; long* ptr46 = ptr0 - 8; long v33 = AesCrypt__aesDecrypt(v32); long* ptr47 = ptr0 - 6; *(ptr0 - 8) = 0L; *(ptr0 - 7) = v33; long* ptr48 = ptr0 - 8; *(ptr0 - 10) = v3; *(ptr0 - 9) = v3; long v34 = _StringBase@0150898__createFromCharCodes(v33, 0L); unsigned long* ptr49 = (unsigned long*)(ptr0 - 2); ptr6 = *(unsigned long*)(ptr0 - 2); v2 = *(ptr0 - 1); ptr33 = ptr0; jump *(ptr0 - 1); } 我也是初学,学安卓破解一个礼拜。使用jeb反编译libapp.so的符号表中5个函数中的某个,然后加密函数就在列表里,查交叉引用很快就查到了,因为就一处加密调用,都不用分析。
最后于 2022-11-21 19:01
被rehai编辑
,原因: