-
-
[原创]frida基础 闯关训练 七层关卡
-
发表于: 2023-7-14 18:23
-
打开app首先映入眼前是一个常规的登录界面，输入用户名和密码，提示Login filed.显然用户名和密码随便输入肯定是不行了。
首先我们用objection定位到他的页面位置activity,再结合反编译工具对源码进行分析。
可以发现当前类的类已经找到了，objection hook这个类，再触发按钮，观察情况，打印出调用的方法，再hook之。
通过返回值可以大胆猜测，密码经过了加密，将返回值输入的确通过了第一关，不过还需要结合源码分析下。
发现是 HmacSHA256 加密，然后我们可以hmac在线加密输入加密对比下结果没问题，输入密码进入下一关。
界面提示点击进入下一关，肯定没那么简单，不出意外提示报错了。
这里只能结合源码分析了。
将 R4jSLLLLLLLLLLOrLE7/5B+Z6fsl65yj6BgC6YWz66gO6g2t65Pk6a+P65NK44NNROl0wNOLLLL= 反向还原得到输入的密码，再用frida hook住b方法，则可进入到下一题。
a()b()方法的源码：
正规的算法还原，这里直接Hook通过了，后续在还原这个算法。
修改 静态成员变量和非静态成员变量的值 即可通过，但是给出来了2个函数，出题人的想法应该是让我们触发按钮的时候，主动调用这2个函数，来改变成员变量的值。
观察代码：
只要将三个成员变量的值改为true 即可通向下一关。
看源码：
将check的值全部改为 true,即可通过下一关。
代码：
代码：
将调用的三个class的方法改成true，即可通关。
adb shell dumpsys window | grep CurrentFocus#返回mCurrentFocus=Window{5b2914b u0 com.example.androiddemo/com.example.androiddemo.Activity.LoginActivity}adb shell dumpsys window | grep CurrentFocus#返回mCurrentFocus=Window{5b2914b u0 com.example.androiddemo/com.example.androiddemo.Activity.LoginActivity}android hooking list activities #返回 com.example.androiddemo.Activity.BaseFridaActivitycom.example.androiddemo.Activity.FridaActivity1com.example.androiddemo.Activity.FridaActivity2com.example.androiddemo.Activity.FridaActivity3com.example.androiddemo.Activity.FridaActivity4com.example.androiddemo.Activity.FridaActivity5com.example.androiddemo.Activity.FridaActivity6com.example.androiddemo.Activity.FridaActivity7com.example.androiddemo.Activity.LoginActivitycom.example.androiddemo.MainActivityandroid hooking watch class com.example.androiddemo.Activity.LoginActivity --dump-args --dump-backtrace --dump-return#返回(agent) [vv23m49gobd] Called com.example.androiddemo.Activity.LoginActivity.access$100(java.lang.Strinjava.lang.String)(agent) [vv23m49gobd] Called com.example.androiddemo.Activity.LoginActivity.a(java.lang.String, java.lang.String)(agent) [vv23m49gobd] Called com.example.androiddemo.Activity.LoginActivity.a([B)(agent) [vv23m49gobd] Called com.example.androiddemo.Activity.LoginActivity.access$000(com.example.androiddemo.Activity.LoginActivity) android hooking watch class_method com.example.androiddemo.Activity.LoginActivity.a --dump-args --dump-return#返回：(agent) [810lsp00gmj] Arguments com.example.androiddemo.Activity.LoginActivity.a([object Object])(agent) [810lsp00gmj] Return Value: 82d476df642d6c882dcc438e028c6e0908af286439b7cd18975dc971387eb33a(agent) [810lsp00gmj] Return Value: 82d476df642d6c882dcc438e028c6e0908af286439b7cd18975dc971387eb33aandroid hooking list activities #返回 com.example.androiddemo.Activity.BaseFridaActivitycom.example.androiddemo.Activity.FridaActivity1com.example.androiddemo.Activity.FridaActivity2com.example.androiddemo.Activity.FridaActivity3com.example.androiddemo.Activity.FridaActivity4com.example.androiddemo.Activity.FridaActivity5com.example.androiddemo.Activity.FridaActivity6com.example.androiddemo.Activity.FridaActivity7com.example.androiddemo.Activity.LoginActivitycom.example.androiddemo.MainActivityandroid hooking watch class com.example.androiddemo.Activity.LoginActivity --dump-args --dump-backtrace --dump-return#返回(agent) [vv23m49gobd] Called com.example.androiddemo.Activity.LoginActivity.access$100(java.lang.Strinjava.lang.String)(agent) [vv23m49gobd] Called com.example.androiddemo.Activity.LoginActivity.a(java.lang.String, java.lang.String)(agent) [vv23m49gobd] Called com.example.androiddemo.Activity.LoginActivity.a([B)(agent) [vv23m49gobd] Called com.example.androiddemo.Activity.LoginActivity.access$000(com.example.androiddemo.Activity.LoginActivity) android hooking watch class_method com.example.androiddemo.Activity.LoginActivity.a --dump-args --dump-return#返回：(agent) [810lsp00gmj] Arguments com.example.androiddemo.Activity.LoginActivity.a([object Object])(agent) [810lsp00gmj] Return Value: 82d476df642d6c882dcc438e028c6e0908af286439b7cd18975dc971387eb33a(agent) [810lsp00gmj] Return Value: 82d476df642d6c882dcc438e028c6e0908af286439b7cd18975dc971387eb33apublic static String a(byte[] bArr) throws Exception { StringBuilder sb = new StringBuilder(); for (int i = 0; i <= bArr.length - 1; i += 3) { byte[] bArr2 = new byte[4]; byte b = 0; for (int i2 = 0; i2 <= 2; i2++) { int i3 = i + i2; if (i3 <= bArr.length - 1) { bArr2[i2] = (byte) (b | ((bArr[i3] & 255) >>> ((i2 * 2) + 2))); b = (byte) ((((bArr[i3] & 255) << (((2 - i2) * 2) + 2)) & 255) >>> 2); } else { bArr2[i2] = b; b = 64; } } bArr2[3] = b; for (int i4 = 0; i4 <= 3; i4++) { if (bArr2[i4] <= 63) { sb.append(table[bArr2[i4]]); } else { sb.append('='); } } } return sb.toString(); } public static byte[] b(String str) { try { ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream(); GZIPOutputStream gZIPOutputStream = new GZIPOutputStream(byteArrayOutputStream); gZIPOutputStream.write(str.getBytes()); gZIPOutputStream.finish(); gZIPOutputStream.close(); byte[] byteArray = byteArrayOutputStream.toByteArray(); try { byteArrayOutputStream.close(); return byteArray; } catch (Exception e) { e.printStackTrace(); return byteArray; } } catch (Exception unused) { return null; } }public static String a(byte[] bArr) throws Exception { StringBuilder sb = new StringBuilder(); for (int i = 0; i <= bArr.length - 1; i += 3) { byte[] bArr2 = new byte[4]; byte b = 0; for (int i2 = 0; i2 <= 2; i2++) { int i3 = i + i2; if (i3 <= bArr.length - 1) { bArr2[i2] = (byte) (b | ((bArr[i3] & 255) >>> ((i2 * 2) + 2))); b = (byte) ((((bArr[i3] & 255) << (((2 - i2) * 2) + 2)) & 255) >>> 2); } else { bArr2[i2] = b; b = 64; } } bArr2[3] = b; for (int i4 = 0; i4 <= 3; i4++) { if (bArr2[i4] <= 63) { sb.append(table[bArr2[i4]]); } else { sb.append('='); } } } return sb.toString(); } public static byte[] b(String str) { try { ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream(); GZIPOutputStream gZIPOutputStream = new GZIPOutputStream(byteArrayOutputStream); gZIPOutputStream.write(str.getBytes()); gZIPOutputStream.finish(); gZIPOutputStream.close(); byte[] byteArray = byteArrayOutputStream.toByteArray(); try { byteArrayOutputStream.close(); return byteArray; } catch (Exception e) { e.printStackTrace(); return byteArray; } } catch (Exception unused) { return null; } }var FridaActivity1 = Java.use("com.example.androiddemo.Activity.FridaActivity1");FridaActivity1["b"].implementation = function (str) { console.log("FridaActivity1.b is called: str=${str}", str); var result = this["b"](str); console.log("FridaActivity1.b result=${result}", JSON.stringify(result)); return result;};FridaActivity1["a"].implementation = function (bArr) { console.log("FridaActivity1.a is called: bArr=${bArr}", JSON.stringify(bArr)); var result = this["a"](bArr); console.log("FridaActivity1.a result=${result}", result); result = 'R4jSLLLLLLLLLLOrLE7/5B+Z6fsl65yj6BgC6YWz66gO6g2t65Pk6a+P65NK44NNROl0wNOLLLL=' return result;};var FridaActivity1 = Java.use("com.example.androiddemo.Activity.FridaActivity1");FridaActivity1["b"].implementation = function (str) { console.log("FridaActivity1.b is called: str=${str}", str); var result = this["b"](str); console.log("FridaActivity1.b result=${result}", JSON.stringify(result)); return result;};FridaActivity1["a"].implementation = function (bArr) { console.log("FridaActivity1.a is called: bArr=${bArr}", JSON.stringify(bArr)); var result = this["a"](bArr); console.log("FridaActivity1.a result=${result}", result); result = 'R4jSLLLLLLLLLLOrLE7/5B+Z6fsl65yj6BgC6YWz66gO6g2t65Pk6a+P65NK44NNROl0wNOLLLL='[培训]Windows内核深度攻防：从Hook技术到Rootkit实战！
最后于 2023-7-17 18:19
被kanxue编辑
，原因： 将百度网盘附件转本地
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
链接：cd3K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6H3j5h3&6Q4x3X3g2T1j5h3W2V1N6g2)9J5k6h3y4G2L8g2)9J5c8Y4y4Q4x3V1j5I4P5W2c8K9y4i4l9#2i4K6u0V1k6s2c8V1d9s2S2c8k6h3p5@1c8W2W2S2f1W2m8%4i4K6t1$3L8X3u0K6M7q4)9K6b7R3`.`. 提取码：a5ho --来自百度网盘超级会员V1的分享 |
|
|
|
|
|
|
|
|
感谢分享
|
|
|
|
|
|
|
|
|
|
|
|
是因为same_name_bool_var字段名与same_name_bool_var函数名相同，所以需要在前面加个下划线 |
|
|
|
