-
-
[分享]unidbg-ibox-wtoken-授人以渔不如授人以鱼
-
发表于: 2022-5-10 15:12
-
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 | package ibox;import com.github.unidbg.AndroidEmulator;import com.github.unidbg.Emulator;import com.github.unidbg.file.FileResult;import com.github.unidbg.file.IOResolver;import com.github.unidbg.file.linux.AndroidFileIO;import com.github.unidbg.linux.android.AndroidEmulatorBuilder;import com.github.unidbg.linux.android.AndroidResolver;import com.github.unidbg.linux.android.dvm.*;import com.github.unidbg.linux.android.dvm.array.ByteArray;import com.github.unidbg.memory.Memory;import com.github.unidbg.spi.SyscallHandler;import java.io.File;import java.io.IOException;import java.nio.charset.StandardCharsets;public class TigerTallyAPI extends AbstractJni implements IOResolver<AndroidFileIO> { private final AndroidEmulator emulator; private final VM vm; public TigerTallyAPI(String apkPath) { emulator = AndroidEmulatorBuilder.for64Bit().build(); SyscallHandler<AndroidFileIO> syscallHandler = emulator.getSyscallHandler(); syscallHandler.setVerbose(true); syscallHandler.addIOResolver(this); Memory memory = emulator.getMemory(); memory.setLibraryResolver(new AndroidResolver(23)); vm = emulator.createDalvikVM(new File(apkPath)); vm.setJni(this); vm.setVerbose(true); } public static void main(String[] args) { TigerTallyAPI tigerTallyAPI = new TigerTallyAPI("D:\\apk\\ibox.apk"); AndroidEmulator emulator = tigerTallyAPI.emulator; DalvikModule dalvikModule = tigerTallyAPI.vm.loadLibrary(new File("D:\\apk\\libtiger_tally.so"), true); dalvikModule.callJNI_OnLoad(emulator); VM vm = tigerTallyAPI.vm; DvmClass dvmClass = vm.resolveClass("com/aliyun/TigerTally/TigerTallyAPI"); dvmClass.callStaticJniMethodObject(emulator,"_genericNt1(I)I",2); dvmClass.callStaticJniMethodObject(emulator,"_genericNt2(ILjava/lang/String;)I",2,new StringObject(vm,"EWA40T3eMNVkLmj8Ur9CuQExbcOti8c3yd-I8xDkLhvphNMuRujkY7V6lKbvAtE2qXa4kTWSnXmo0HXfuUXRgyFNXYwhwvvf7yUYQ-DjWjAa34fjA9yJCam4Llddmcu3D8BQKw4gR-nkYzzOx0uGj9OkfgUHoFxF00akZNyeMrs=")); DvmObject<?> dvmObject = dvmClass.callStaticJniMethodObject(emulator,"_genericNt3(I[B)Ljava/lang/String;",2,new ByteArray(vm,"{\"phoneNumber\":\"18888888888\",\"code\":\"188888\"}".getBytes(StandardCharsets.UTF_8))); System.out.println(dvmObject.getValue().toString()); tigerTallyAPI.destroy(); } @Override public DvmObject<?> callStaticObjectMethodV(BaseVM vm, DvmClass dvmClass, String signature, VaList vaList) { switch (signature){ case "com/aliyun/TigerTally/A->ct()Landroid/content/Context;": return vm.resolveClass("android/app/Application",vm.resolveClass("android/content/ContextWrapper",vm.resolveClass("android/content/Context"))).newObject(signature); case "com/aliyun/TigerTally/A->pb(Ljava/lang/String;[B)Ljava/lang/String;": return new StringObject(vm,"wS8O4RYy64fZSJqmsPYWVT3K5+hweouz0YPvsxAs7x1mfWj0mqidyOwOBffV+mDcI9L0i2JLGp3YHbJYhxir0A=="); } return super.callStaticObjectMethodV(vm, dvmClass, signature, vaList); } @Override public DvmObject<?> callObjectMethodV(BaseVM vm, DvmObject<?> dvmObject, String signature, VaList vaList) { switch (signature){ case "android/content/pm/PackageManager->getApplicationInfo(Ljava/lang/String;I)Landroid/content/pm/ApplicationInfo;": return vm.resolveClass("Landroid/content/pm/ApplicationInfo;").newObject(signature); case "android/content/pm/PackageManager->getApplicationLabel(Landroid/content/pm/ApplicationInfo;)Ljava/lang/CharSequence;": return new StringObject(vm,"Ljava/lang/CharSequence;"); case "android/app/Application->getFilesDir()Ljava/io/File;": return vm.resolveClass("Ljava/io/File;"); case "java/lang/String->getAbsolutePath()Ljava/lang/String;": return new StringObject(vm,"Ljava/lang/String;"); case "android/app/Application->getSharedPreferences(Ljava/lang/String;I)Landroid/content/SharedPreferences;": return vm.resolveClass("Landroid/content/SharedPreferences;"); case "java/lang/Class->getAbsolutePath()Ljava/lang/String;": return new StringObject(vm,"Ljava/lang/String;"); } return super.callObjectMethodV(vm, dvmObject, signature, vaList); } @Override public DvmObject<?> getStaticObjectField(BaseVM vm, DvmClass dvmClass, String signature) { switch (signature){ case "android/os/Build->BRAND:Ljava/lang/String;": return new StringObject(vm,"Ljava/lang/String;"); case "android/os/Build->MODEL:Ljava/lang/String;": return new StringObject(vm,"Ljava/lang/String;"); case "android/os/Build$VERSION->RELEASE:Ljava/lang/String;": return new StringObject(vm,"Ljava/lang/String;"); case "android/os/Build->DEVICE:Ljava/lang/String;": return new StringObject(vm,"Ljava/lang/String;"); } return super.getStaticObjectField(vm,dvmClass,signature); } public void destroy() { try { emulator.close(); } catch (IOException e) { e.printStackTrace(); } } @Override public FileResult<AndroidFileIO> resolve(Emulator<AndroidFileIO> emulator, String pathname, int oflags) { return null; }} |
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
最后于 2022-5-10 15:15
被猫盾科技编辑
，原因：
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
hook掉证书+转发请求 |
|
|
github下载最新un |
|
|
|
|
|
能带带吗 |
|
|
|
|
|
|
|
|
|
|
|
更新了 |
|
|
新版本的 sdk 貌似更新了，自己改代码 |
|
|
知道现在签名的方法改成啥了吗？我脱壳脱不出来 
|
|
|
拖出来了，_genericNt1变成两个参数了，但是按照签名规则传进去生成的wtoken还是不能用。。 |
|
|
JNIEnv->FindClass(com/aliyun/TigerTally/NaitveAPI) 可能加了检测unidbg环境吧 |
|
|
大佬们，能整个群一起玩吗 |
|
|
意思是unidbg也不行了。。那还有其他办法破解吗 
|
|
|
|
|
|
确实 改成2个参数后还是不能用的被拦截 吐了 |
|
|
|
|
|
|
