只是普通的单机手游,广告比较多,所以分析处理了下,校验流程蛮有意思的,所以就分享出来了
样本进行了加固,对其dump出dex后重打包出现崩溃
![](./upload/attach/202311/953698_NKYB9D4PCBB6DUE.png)
ida分析地址发现为jni函数引起
![](./upload/attach/202311/953698_39CAXT3R593WARQ.webp)
![](upload/attach/202311/953698_UNCQUWBCRBN9CKP.webp)
利用Xposed直接替换该函数,崩溃问题解决
但是出现了新的问题,游戏卡在了加载页面
![](upload/attach/202311/953698_VWGJFF9UQ37PMK3.webp)
![](upload/attach/202311/953698_VHKXD3WYQ4JEE9Z.webp)
对该类的其他jni函数进行分析,发现supportVulkan很明显进行了签名读取,对其去除签名校验。
此处参考项目:ApkSignatureKillerEx
去除完签名校验后,游戏能正常进入主页面,但是点击游戏地图没有任何反应。
在对原包进行多次测试发现,在首次启动游戏时,如果断网也会出现无法正常进入地图的问题,怀疑是游戏首次启动进行了网络请求进行数据校验
经过抓包对比定位到可疑数据包
![](upload/attach/202311/953698_HEW44MS2T8Z27XR.webp)
利用Frida的算法通杀脚本没有定位到相关内容,怀疑是so层进行了请求
![](upload/attach/202311/953698_C3TRDEBT5TYHUXU.webp)
通过调用栈可以很清晰看到请求是从unity引擎相关的so中发出的。
查阅资料,在unity中,网络请求主要通过UnityWebRequest
类来执行网络请求,利用frida-il2cpp-bridge对UnityWebRequest进行trace,打印调用栈得
在IDA中进行交叉引用分析定位到UnitySDKManager类
增加UnitySDKManager类重新对其trace(因为出现报错,把参数输出关了)
通过调用栈可以初步对校验流程进行了解,主要通过ServerVerifyApk函数进行校验,经过一系列字符串加解密,最后进行网络请求
对关键函数进行hook分析
发现之前抓包获得的请求体相对应,其中,appFileList还是密文,继续分析
![](upload/attach/202311/953698_MB4QVDF84E5GEZW.webp)
与dump.cs中的函数进行对照发现v14 由字符串转hex转base64获得
hook HexStringToHex 函数获得参数
IDA继续查找调用发现其中字符串由GetFileInfoList函数获得
很明显,调用了libUnitySDK.so中的GetFileInfoList函数获得
FileInfoListStr在writeFileJson函数中被赋值,而writeFileJson则是由java函数上文中的IsHDR_DisplayBoot调用(该函数首个参数为base.apk路径)
![](upload/attach/202311/953698_XESC7BKW8G25F93.webp)
很明显,ll11l1l1ll函数 对之前的明文字符串进行了加密,frida hook打印参数
其中 HashList 中文件对应的值为文件的 crc
至此,除了具体的字符串加密算法,游戏的校验流程已经很清晰
对该校验去除的思路:
ps.仅限于学习交流,切勿用于商业用途,若造成侵权,请联系作者处理。
样本链接:2e9K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6H3j5h3&6Q4x3X3g2T1j5h3W2V1N6g2)9J5k6h3y4G2L8g2)9J5c8Y4y4Q4x3V1j5I4j5i4N6i4h3f1y4r3x3X3&6f1y4e0m8I4f1q4u0B7z5q4)9#2k6V1y4d9N6q4)9J5k6p5q4Q4x3@1k6H3N6$3c8Q4x3@1c8V1z5s2N6F1
XposedHelpers.findAndHookMethod(
"com.unity3d.player.UnityPlayerActivity"
, classLoader,
"IsHDR_DisplayBoot"
, java.lang.String.
class
, java.lang.String.
class
,
new
XC_MethodReplacement() {
@Override
protected
Object replaceHookedMethod(MethodHookParam methodHookParam)
throws
Throwable {
return
null
;
}
});
XposedHelpers.findAndHookMethod(
"com.unity3d.player.UnityPlayerActivity"
, classLoader,
"IsHDR_DisplayBoot"
, java.lang.String.
class
, java.lang.String.
class
,
new
XC_MethodReplacement() {
@Override
protected
Object replaceHookedMethod(MethodHookParam methodHookParam)
throws
Throwable {
return
null
;
}
});
0x0247db9c ┌─UnityEngine.Networking.UnityWebRequest::.ctor(
this
= UnityEngine.Networking.UnityWebRequest, url =
"5c9K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5H3y4W2)9J5k6e0f1@1i4K6u0W2x3e0V1@1i4K6u0W2x3e0j5%4i4K6y4m8z5o6l9%4y4#2)9J5c8V1y4Z5k6h3y4C8g2i4m8V1j5i4c8W2"
, method =
"POST"
)
0x0247db00 │ ┌─UnityEngine.Networking.UnityWebRequest::set_url(
this
= UnityEngine.Networking.UnityWebRequest, value =
"f37K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5H3y4W2)9J5k6e0f1@1i4K6u0W2x3e0V1@1i4K6u0W2x3e0j5%4i4K6y4m8z5o6l9%4y4#2)9J5c8V1y4Z5k6h3y4C8g2i4m8V1j5i4c8W2"
)
0x0247ef38 │ │ ┌─UnityEngine.Networking.UnityWebRequest::InternalSetUrl(
this
= UnityEngine.Networking.UnityWebRequest, url =
"146K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5H3y4W2)9J5k6e0f1@1i4K6u0W2x3e0V1@1i4K6u0W2x3e0j5%4i4K6y4m8z5o6l9%4y4#2)9J5c8V1y4Z5k6h3y4C8g2i4m8V1j5i4c8W2"
)
0x0247ef38 │ │ └─UnityEngine.Networking.UnityWebRequest::InternalSetUrl
0x0247db00 │ └─UnityEngine.Networking.UnityWebRequest::set_url
0x0247dc1c │ ┌─UnityEngine.Networking.UnityWebRequest::set_method(
this
= UnityEngine.Networking.UnityWebRequest, value =
"POST"
)
0x0247e4e0 │ │ ┌─UnityEngine.Networking.UnityWebRequest::InternalSetMethod(
this
= UnityEngine.Networking.UnityWebRequest, methodType = Post)
0x0247e4e0 │ │ └─UnityEngine.Networking.UnityWebRequest::InternalSetMethod
0x0247dc1c │ └─UnityEngine.Networking.UnityWebRequest::set_method
0x0247db9c └─UnityEngine.Networking.UnityWebRequest::.ctor
0x0247db9c ┌─UnityEngine.Networking.UnityWebRequest::.ctor(
this
= UnityEngine.Networking.UnityWebRequest, url =
"5c9K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5H3y4W2)9J5k6e0f1@1i4K6u0W2x3e0V1@1i4K6u0W2x3e0j5%4i4K6y4m8z5o6l9%4y4#2)9J5c8V1y4Z5k6h3y4C8g2i4m8V1j5i4c8W2"
, method =
"POST"
)
0x0247db00 │ ┌─UnityEngine.Networking.UnityWebRequest::set_url(
this
= UnityEngine.Networking.UnityWebRequest, value =
"f37K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5H3y4W2)9J5k6e0f1@1i4K6u0W2x3e0V1@1i4K6u0W2x3e0j5%4i4K6y4m8z5o6l9%4y4#2)9J5c8V1y4Z5k6h3y4C8g2i4m8V1j5i4c8W2"
)
0x0247ef38 │ │ ┌─UnityEngine.Networking.UnityWebRequest::InternalSetUrl(
this
= UnityEngine.Networking.UnityWebRequest, url =
"146K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5H3y4W2)9J5k6e0f1@1i4K6u0W2x3e0V1@1i4K6u0W2x3e0j5%4i4K6y4m8z5o6l9%4y4#2)9J5c8V1y4Z5k6h3y4C8g2i4m8V1j5i4c8W2"
)
0x0247ef38 │ │ └─UnityEngine.Networking.UnityWebRequest::InternalSetUrl
0x0247db00 │ └─UnityEngine.Networking.UnityWebRequest::set_url
0x0247dc1c │ ┌─UnityEngine.Networking.UnityWebRequest::set_method(
this
= UnityEngine.Networking.UnityWebRequest, value =
"POST"
)
0x0247e4e0 │ │ ┌─UnityEngine.Networking.UnityWebRequest::InternalSetMethod(
this
= UnityEngine.Networking.UnityWebRequest, methodType = Post)
0x0247e4e0 │ │ └─UnityEngine.Networking.UnityWebRequest::InternalSetMethod
0x0247dc1c │ └─UnityEngine.Networking.UnityWebRequest::set_method
0x0247db9c └─UnityEngine.Networking.UnityWebRequest::.ctor
追踪调用定位到
class
UnitySDK.UnitySDKManager.<PostData>d__25 : System.
Object
, System.Collections.Generic.IEnumerator<System.
Object
>, System.Collections.IEnumerator, System.IDisposable
private Boolean MoveNext() { }
追踪调用定位到
class
UnitySDK.UnitySDKManager.<PostData>d__25 : System.
Object
, System.Collections.Generic.IEnumerator<System.
Object
>, System.Collections.IEnumerator, System.IDisposable
private Boolean MoveNext() { }
0x00b15b44
┌─UnitySDK.UnitySDKManager::ServerVerifyApk
0x00b04b3c
│ ┌─UnitySDK.UnitySDKManager::GetFileInfoList
0x00b04b3c
│ └─UnitySDK.UnitySDKManager::GetFileInfoList
0x00b06ec0
│ ┌─UnitySDK.UnitySDKManager::GetGamePackageName
0x00b06ec0
│ └─UnitySDK.UnitySDKManager::GetGamePackageName
0x00b06204
│ ┌─UnitySDK.UnitySDKManager::GetSDKVersion
0x00b06204
│ └─UnitySDK.UnitySDKManager::GetSDKVersion
0x00b06278
│ ┌─UnitySDK.UnitySDKManager::HexStringToHex
0x00b06278
│ └─UnitySDK.UnitySDKManager::HexStringToHex
0x00b10fcc
│ ┌─UnitySDK.UnitySDKManager::EncryptString
0x00b10fcc
│ └─UnitySDK.UnitySDKManager::EncryptString
0x00b100a4
│ ┌─UnitySDK.UnitySDKManager::PostData
0x00a341fc
│ │ ┌─UnitySDK.UnitySDKManager.<PostData>d__25::.ctor
0x00a341fc
│ │ └─UnitySDK.UnitySDKManager.<PostData>d__25::.ctor
0x00b100a4
│ └─UnitySDK.UnitySDKManager::PostData
0x00a3422c
│ ┌─UnitySDK.UnitySDKManager.<PostData>d__25::MoveNext
0x00b12be4
│ │ ┌─UnitySDK.UnitySDKManager::GetUrl
0x00b12be4
│ │ └─UnitySDK.UnitySDKManager::GetUrl
0x0247db9c
│ │ ┌─UnityEngine.Networking.UnityWebRequest::.ctor
0x0247db00
│ │ │ ┌─UnityEngine.Networking.UnityWebRequest::set_url
0x0247ef38
│ │ │ │ ┌─UnityEngine.Networking.UnityWebRequest::InternalSetUrl
0x0247ef38
│ │ │ │ └─UnityEngine.Networking.UnityWebRequest::InternalSetUrl
0x0247db00
│ │ │ └─UnityEngine.Networking.UnityWebRequest::set_url
0x0247dc1c
│ │ │ ┌─UnityEngine.Networking.UnityWebRequest::set_method
0x0247e4e0
│ │ │ │ ┌─UnityEngine.Networking.UnityWebRequest::InternalSetMethod
0x0247e4e0
│ │ │ │ └─UnityEngine.Networking.UnityWebRequest::InternalSetMethod
0x0247dc1c
│ │ │ └─UnityEngine.Networking.UnityWebRequest::set_method
0x0247db9c
│ │ └─UnityEngine.Networking.UnityWebRequest::.ctor
0x0247e0f4
│ │ ┌─UnityEngine.Networking.UnityWebRequest::set_uploadHandler
0x0247e0f4
│ │ └─UnityEngine.Networking.UnityWebRequest::set_uploadHandler
0x0247dfdc
│ │ ┌─UnityEngine.Networking.UnityWebRequest::set_downloadHandler
0x0247dfdc
│ │ └─UnityEngine.Networking.UnityWebRequest::set_downloadHandler
0x0247f66c
│ │ ┌─UnityEngine.Networking.UnityWebRequest::SetRequestHeader
0x0247f66c
│ │ └─UnityEngine.Networking.UnityWebRequest::SetRequestHeader
0x0247e42c
│ │ ┌─UnityEngine.Networking.UnityWebRequest::Send
0x0247e430
│ │ │ ┌─UnityEngine.Networking.UnityWebRequest::SendWebRequest
0x0247e42c
│ │ │ └─UnityEngine.Networking.UnityWebRequest::Send
0x0247e430
│ │ └─UnityEngine.Networking.UnityWebRequest::SendWebRequest
0x00a3422c
│ └─UnitySDK.UnitySDKManager.<PostData>d__25::MoveNext
0x00a34cd4
│ ┌─UnitySDK.UnitySDKManager.<PostData>d__25::System.Collections.IEnumerator.get_Current
0x00a34cd4
│ └─UnitySDK.UnitySDKManager.<PostData>d__25::System.Collections.IEnumerator.get_Current
0x00b15b44
└─UnitySDK.UnitySDKManager::ServerVerifyApk
0x00b15b44
┌─UnitySDK.UnitySDKManager::ServerVerifyApk
0x00b04b3c
│ ┌─UnitySDK.UnitySDKManager::GetFileInfoList
0x00b04b3c
│ └─UnitySDK.UnitySDKManager::GetFileInfoList
0x00b06ec0
│ ┌─UnitySDK.UnitySDKManager::GetGamePackageName
0x00b06ec0
│ └─UnitySDK.UnitySDKManager::GetGamePackageName
0x00b06204
│ ┌─UnitySDK.UnitySDKManager::GetSDKVersion
0x00b06204
│ └─UnitySDK.UnitySDKManager::GetSDKVersion
0x00b06278
│ ┌─UnitySDK.UnitySDKManager::HexStringToHex
0x00b06278
│ └─UnitySDK.UnitySDKManager::HexStringToHex
0x00b10fcc
│ ┌─UnitySDK.UnitySDKManager::EncryptString
0x00b10fcc
│ └─UnitySDK.UnitySDKManager::EncryptString
0x00b100a4
│ ┌─UnitySDK.UnitySDKManager::PostData
0x00a341fc
│ │ ┌─UnitySDK.UnitySDKManager.<PostData>d__25::.ctor
0x00a341fc
│ │ └─UnitySDK.UnitySDKManager.<PostData>d__25::.ctor
0x00b100a4
│ └─UnitySDK.UnitySDKManager::PostData
0x00a3422c
│ ┌─UnitySDK.UnitySDKManager.<PostData>d__25::MoveNext
0x00b12be4
│ │ ┌─UnitySDK.UnitySDKManager::GetUrl
0x00b12be4
│ │ └─UnitySDK.UnitySDKManager::GetUrl
0x0247db9c
│ │ ┌─UnityEngine.Networking.UnityWebRequest::.ctor
0x0247db00
│ │ │ ┌─UnityEngine.Networking.UnityWebRequest::set_url
0x0247ef38
│ │ │ │ ┌─UnityEngine.Networking.UnityWebRequest::InternalSetUrl
0x0247ef38
│ │ │ │ └─UnityEngine.Networking.UnityWebRequest::InternalSetUrl
0x0247db00
│ │ │ └─UnityEngine.Networking.UnityWebRequest::set_url
0x0247dc1c
│ │ │ ┌─UnityEngine.Networking.UnityWebRequest::set_method
0x0247e4e0
│ │ │ │ ┌─UnityEngine.Networking.UnityWebRequest::InternalSetMethod
0x0247e4e0
│ │ │ │ └─UnityEngine.Networking.UnityWebRequest::InternalSetMethod
0x0247dc1c
│ │ │ └─UnityEngine.Networking.UnityWebRequest::set_method
0x0247db9c
│ │ └─UnityEngine.Networking.UnityWebRequest::.ctor
0x0247e0f4
│ │ ┌─UnityEngine.Networking.UnityWebRequest::set_uploadHandler
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
最后于 2023-11-2 23:33
被wx_嗨编辑
,原因: 编辑标题