[原创]某咖啡(二)sign参数逆向分析-Android安全-看雪安全社区

[原创]某咖啡(二)sign参数逆向分析

发表于: 2025-10-7 20:07 11190

[原创]某咖啡(二)sign参数逆向分析

nianchu

2025-10-7 20:07

11190

# 某咖啡sign逆向

上文中我们分析了参数q，这里我们继续来看看sign 我们可以通过q参数的堆栈或者getbyte，hasmap的hook得到

![](upload/attach/202510/949800_F4ASN2S6FBKHS8K.png)

最终跟到a方法 调用md5_crypt 方法 hook一下传参可以得到结果 找到加密点后 写个unidbg调用跑一下

![](./upload/attach/202510/949800_X438HKN63JQR2E5.png)

```
public void md5_crypt(){
        DvmClass CryptoHelper = vm.resolveClass("com/luckincoffee/safeboxlib/CryptoHelper");
        byte[] bytes = "hello".getBytes();
        String a2  = "u7Su25kSE9PxcTgQZkRgL0kJ+lDaV2IQcqdsfGGuNDs=" ;
        byte[] bytes2 = Base64.getDecoder().decode(a2.replace('-', '+').replace('_', '/').getBytes());
        ByteArray reval = CryptoHelper.callStaticJniMethodObject(emulator, "md5_crypt([BI[B)[B",  bytes,1,bytes2);
        System.out.println("md5_crypt:" + new String(reval.getValue()));
    }
    =================================================
    JNIEnv->FindClass(com/luckincoffee/safeboxlib/CryptoHelper) was called from RX@0x400450c8[libcryptoDD.so]0x450c8
JNIEnv->RegisterNatives(com/luckincoffee/safeboxlib/CryptoHelper, RW@0x4004bce0[libcryptoDD.so]0x4bce0, 3) was called from RX@0x40044968[libcryptoDD.so]0x44968
RegisterNative(com/luckincoffee/safeboxlib/CryptoHelper, localAESWork([BI[B)[B, RX@0x40041ed8[libcryptoDD.so]0x41ed8)
RegisterNative(com/luckincoffee/safeboxlib/CryptoHelper, localConnectWork([B[B)[B, RX@0x40041bb0[libcryptoDD.so]0x41bb0)
RegisterNative(com/luckincoffee/safeboxlib/CryptoHelper, md5_crypt([BI[B)[B, RX@0x40043bbc[libcryptoDD.so]0x43bbc)
Find native function Java_com_luckincoffee_safeboxlib_CryptoHelper_md5_1crypt => RX@0x40043bbc[libcryptoDD.so]0x43bbc
JNIEnv->GetArrayLength([B@6cd8737 => 5) was called from RX@0x40043c18[libcryptoDD.so]0x43c18
JNIEnv->GetArrayLength([B@22f71333 => 32) was called from RX@0x40041288[libcryptoDD.so]0x41288
JNIEnv->NewByteArray(16) was called from RX@0x400415a4[libcryptoDD.so]0x415a4
JNIEnv->SetByteArrayRegion([B@6aaa5eb0, 0, 16, RW@0x40398080) was called from RX@0x400419d8[libcryptoDD.so]0x419d8
JNIEnv->GetArrayLength([B@6aaa5eb0 => 16) was called from RX@0x40044244[libcryptoDD.so]0x44244
JNIEnv->NewByteArray(37) was called from RX@0x400442b0[libcryptoDD.so]0x442b0
JNIEnv->SetByteArrayRegion([B@1a407d53, 0, 37, RW@0x40393060) was called from RX@0x400441a8[libcryptoDD.so]0x441a8
md5_crypt:7391766891689134774185162898388901200
    
    
    
```

可以看到md5_crypt函数的信息打印出来了 我们去到0x43bbc 处  就是我们运算sign的方法 也有ollvm代码不算多 总共发现2个方法  sub_4559C  sub_4095C

![](./upload/attach/202510/949800_YW4RMYQ3HG5Z4EV.png)

我们先改下JNIEnv 让他正确识别一些方法

![](./upload/attach/202510/949800_ETYU5R7CMV86KYB.png)

代码中就出现了2个方法 那我们先hook下 4559C函数 可以看到java传过来的a5 也就是我们u7Su25kSE9PxcTgQZkRgL0kJ+lDaV2IQcqdsfGGuNDs= 这个值 被传进了4559C 跑下hook打印下入参返回

```
  public void HookByConsoleDebugger(){
        emulator.attach().addBreakPoint(module.base + 0x4559C, new BreakPointCallback() {
            @Override
            public boolean onHit(Emulator<?> emulator, long address) {
                RegisterContext context = emulator.getContext();
                UnidbgPointer input = context.getPointerArg(1);
                DvmObject<?> dvmbytes = vm.getObject(input.toIntPeer());
                byte[] result = (byte[]) dvmbytes.getValue();
                System.out.println("传入数据: " + bytesTohexString(result));
                emulator.attach().addBreakPoint(context.getLRPointer().peer, new BreakPointCallback() {
                    @Override
                    public boolean onHit(Emulator<?> emulator, long address) {
                        RegisterContext returnContext = emulator.getContext();
                        UnidbgPointer v12Value = returnContext.getPointerArg(0);
                        DvmObject<?> v12Obj = vm.getObject(v12Value.toIntPeer());
                        byte[] v12Data = (byte[]) v12Obj.getValue();
                        System.out.println("结果: " + new String(v12Data));
                        return true;
                    }
                });
                return true;
            }
        });
    }
```

![](./upload/attach/202510/949800_XG55RZ3898U2KZK.png)

hook 得到入参是  bbb4aedb991213d3f17138106644602f4909fa50da57621072a76c7c61ae343b  hex转下也就是我们的u7Su25kSE9PxcTgQZkRgL0kJ+lDaV2IQcqdsfGGuNDs= 这个值 得到 ooL1Bqoa8lF6ZE54

继续看  sub_4095C  有三个参数 hook看看  第一个参数是helloooL1Bqoa8lF6ZE54 也就是 我们的传参1 加上函数4559C 运行传参2 得到的结果拼接   4095C  运行得到结果与md5_crypt 函数运行结果一致 那么继续进入4095C  看啊看

```
    public void HookByConsoleDebugger1(){
        emulator.attach().addBreakPoint(module.base + 0x4095C, new BreakPointCallback() {
            @Override
            public boolean onHit(Emulator<?> emulator, long address) {
                RegisterContext context = emulator.getContext();
                UnidbgPointer input = context.getPointerArg(0);
                UnidbgPointer output = context.getPointerArg(2);
                System.out.println("传入数据: " + input.getString(0));
                emulator.attach().addBreakPoint(context.getLRPointer().peer, new BreakPointCallback() {
                    @Override
                    public boolean onHit(Emulator<?> emulator, long address) {
                        byte[] v27Data = output.getPointer(0).getByteArray(0,37);
                        System.out.println("结果: " + new String(v27Data));
                        return true;
                    }
                });
                return true;
            }
        });
    }
```

![](./upload/attach/202510/949800_V85KTP5X9265PBJ.png)

进入后 代码不算多 跟踪我们入参a1 发现被传入41084 方法 由前方代码可得知a1是入参 a2是长度 那我们hook看下返回时第三个参数

![](./upload/attach/202510/949800_JEHNBEE34GVG3D6.png)

```
   public void HookByConsoleDebugger2(){
        emulator.attach().addBreakPoint(module.base + 0x41084, new BreakPointCallback() {
            @Override
            public boolean onHit(Emulator<?> emulator, long address) {
                RegisterContext context = emulator.getContext();
                UnidbgPointer input = context.getPointerArg(0);
                UnidbgPointer output = context.getPointerArg(2);
                System.out.println("传入数据: " + input.getString(0));
                emulator.attach().addBreakPoint(context.getLRPointer().peer, new BreakPointCallback() {
                    @Override
                    public boolean onHit(Emulator<?> emulator, long address) {
                        Inspector.inspect(output.getByteArray(0, 16), "0x41084 arg3");
                        return true;
                    }
                });
                return true;
            }
        });
    }
```

![](./upload/attach/202510/949800_GRCWB7RRCCT9GAR.png)

hook 结果可以看出 41084函数 就是一个md5算法 但是与我们结果不一样说明 md5的结果 继续做了处理

方便分析 ida 给41084 rename下 md5 记录下 继续ida分析下 发先有几个函数有点可疑，先看4108C 发现也是调用了3D1F4

![](./upload/attach/202510/949800_RMQ9ZBVA5FVMCXT.png)

```
// attributes: thunk
__int64 __fastcall sub_4108C(__int64 a1, __int64 a2)
{
  return sub_3D1F4(a1, a2);
}

__int64 __fastcall sub_4109C(__int64 result)
{
  if ( result >= 0 )
    return result;
  else
    return -result;
}

```

我们发现 它调用了3D1F4方法 每次处理md5加密结果的4字节 然后运算的结果经过 sub_4109C 取绝对值或者经过与0比较取本身或取反的操作取绝对值 格式化输出后通过strcat 拼接得到最后结果 那么核心就是函数3D1F4

```
v17 = sub_3D1F4(v32, 0LL);
v19 = sub_3D1F4(v32, 4LL);
v10 = sub_3D1F4(v32, 8LL);
v13 = sub_3D1F4(v32, 12LL);
```

来到3D1F4,代码虽然少但是看不出啥玩意  debugger看一下先

![](./upload/attach/202510/949800_8BX7HEQVKMR9ZU9.png)

![](./upload/attach/202510/949800_RUBVU5NGCEK3MXT.png)

断点后可以看见传参第一个x1 是我们md5的结果，第二个参数就是x1=0x0 也就是 v17 = sub_3D1F4(v32, 0LL);运行了

然后我们blr断点返回 然后按c运行 查看 在这里我们能发现一个关键的地方 观察x0 可以发现是 x0=0xd3f10f0f(-739176689) 其中 739176689 正好是我们md5_crypt 结果的前面一部分 继续debugger 他会运行v19 = sub_3D1F4(v32, 4LL);

![](./upload/attach/202510/949800_RUBVU5NGCEK3MXT.png)

我们看此时返回的结果  x0=0x64ae26b6   0x64ae26b6  转十进制正好是1689134774 是加密结果的第二部分 继续

![](./upload/attach/202510/949800_GQQ4DXBJABRVGDX.png)

得到结果   x0=0xb095c92    x0=0x172e2950 转换后 依次为185162898    388901200

对应结果 7391766891689134774185162898388901200   185162898388901200

![](./upload/attach/202510/949800_T9X49KUGBF5DN34.png)

经过断点查看我们发现如果是负值 结果就会变化 如果是正值结果就是MD5传入的字节部分转十进制的结果，到此我们还是不能分析出这玩意到底咋搞的 在运行函数时 trace一下汇编看看

```
    public void HookByConsoleDebugger2(){
        emulator.attach().addBreakPoint(module.base + 0x3D1F4, new BreakPointCallback() {
            @Override
            public boolean onHit(Emulator<?> emulator, long address) {
                emulator.traceCode(module.base,module.base+module.size);
                RegisterContext context = emulator.getContext();
                int a2 = context.getIntArg(1);
                System.out.println("===========入参=================");
                System.out.println("传入数据: " + a2);
                emulator.attach().addBreakPoint(context.getLRPointer().peer, new BreakPointCallback() {
                    @Override
                    public boolean onHit(Emulator<?> emulator, long address) {
                        RegisterContext returnContext = emulator.getContext();
                        int Value = returnContext.getIntArg(0);
                        System.out.println("============出参================"+ Value);
                        return true;
                    }
                });
                return true;
            }
        });
    }
```

```
传入数据: 0

[19:36:50 506][libcryptoDD.so 0x3d1f4] [09486138] 0x4003d1f4: "ldrb w9, [x0, w1, uxtw]" x0=0xbffff4a0 w1=0x0 => w9=0xd3
[19:36:50 510][libcryptoDD.so 0x3d1f8] [28040011] 0x4003d1f8: "add w8, w1, #1" w1=0x0 => w8=0x1
[19:36:50 510][libcryptoDD.so 0x3d1fc] [0b486838] 0x4003d1fc: "ldrb w11, [x0, w8, uxtw]" x0=0xbffff4a0 w8=0x1 => w11=0xf1
[19:36:50 520][libcryptoDD.so 0x3d200] [2a080011] 0x4003d200: "add w10, w1, #2" w1=0x0 => w10=0x2
[19:36:50 520][libcryptoDD.so 0x3d204] [291d0853] 0x4003d204: "lsl w9, w9, #0x18" w9=0xd3 => w9=0xd3000000
[19:36:50 520][libcryptoDD.so 0x3d208] [280c0011] 0x4003d208: "add w8, w1, #3" w1=0x0 => w8=0x3
[19:36:50 520][libcryptoDD.so 0x3d20c] [691d1033] 0x4003d20c: "bfi w9, w11, #0x10, #8" w9=0xd3000000 w11=0xf1 => w9=0xd3f10000
[19:36:50 526][libcryptoDD.so 0x3d210] [e92bbe29] 0x4003d210: "stp w9, w10, [sp, #-0x10]!" w9=0xd3f10000 w10=0x2 sp=0xbffff4a0 => w9=0xd3f10000 w10=0x2 sp=0xbffff490
[19:36:50 526][libcryptoDD.so 0x3d214] [aab98d52] 0x4003d214: "movz w10, #0x6dcd" w10=0x2 => w10=0x6dcd
[19:36:50 528][libcryptoDD.so 0x3d218] [ea09a972] 0x4003d218: "movk w10, #0x484f, lsl #16" w10=0x6dcd => w10=0x484f6dcd
[19:36:50 528][libcryptoDD.so 0x3d21c] [03000014] 0x4003d21c: "b #0x4003d228"
[19:36:50 531][libcryptoDD.so 0x3d228] [e9030a2a] 0x4003d228: "mov w9, w10" w10=0x484f6dcd => w9=0x484f6dcd
[19:36:50 533][libcryptoDD.so 0x3d22c] [8a488452] 0x4003d22c: "movz w10, #0x2244" w10=0x484f6dcd => w10=0x2244
[19:36:50 533][libcryptoDD.so 0x3d230] [eaf2ad72] 0x4003d230: "movk w10, #0x6f97, lsl #16" w10=0x2244 => w10=0x6f972244
[19:36:50 533][libcryptoDD.so 0x3d234] [3f010a6b] 0x4003d234: "cmp w9, w10" w10=0x6f972244 => nzcv: N=1, Z=0, C=0, V=0 w9=0x484f6dcd
[19:36:50 537][libcryptoDD.so 0x3d238] [6c020054] 0x4003d238: "b.gt #0x4003d284" nzcv: N=1, Z=0, C=0, V=0
[19:36:50 537][libcryptoDD.so 0x3d23c] [6a9b9d52] 0x4003d23c: "movz w10, #0xecdb" w10=0x6f972244 => w10=0xecdb
[19:36:50 539][libcryptoDD.so 0x3d240] [4af0a772] 0x4003d240: "movk w10, #0x3f82, lsl #16" w10=0xecdb => w10=0x3f82ecdb
[19:36:50 541][libcryptoDD.so 0x3d244] [3f010a6b] 0x4003d244: "cmp w9, w10" w10=0x3f82ecdb => nzcv: N=0, Z=0, C=1, V=0 w9=0x484f6dcd
[19:36:50 541][libcryptoDD.so 0x3d248] [0c040054] 0x4003d248: "b.gt #0x4003d2c8" nzcv: N=0, Z=0, C=1, V=0
[19:36:50 541][libcryptoDD.so 0x3d2c8] [8a9b9d52] 0x4003d2c8: "movz w10, #0xecdc" w10=0x3f82ecdb => w10=0xecdc
[19:36:50 541][libcryptoDD.so 0x3d2cc] [4af0a772] 0x4003d2cc: "movk w10, #0x3f82, lsl #16" w10=0xecdc => w10=0x3f82ecdc
[19:36:50 541][libcryptoDD.so 0x3d2d0] [3f010a6b] 0x4003d2d0: "cmp w9, w10" w10=0x3f82ecdc => nzcv: N=0, Z=0, C=1, V=0 w9=0x484f6dcd
[19:36:50 541][libcryptoDD.so 0x3d2d4] [ca5b8d52] 0x4003d2d4: "movz w10, #0x6ade" w10=0x3f82ecdc => w10=0x6ade
[19:36:50 541][libcryptoDD.so 0x3d2d8] [2a1faf72] 0x4003d2d8: "movk w10, #0x78f9, lsl #16" w10=0x6ade => w10=0x78f96ade
[19:36:50 545][libcryptoDD.so 0x3d2dc] [60faff54] 0x4003d2dc: "b.eq #0x4003d228" nzcv: N=0, Z=0, C=1, V=0
[19:36:50 545][libcryptoDD.so 0x3d2e0] [aab98d52] 0x4003d2e0: "movz w10, #0x6dcd" w10=0x78f96ade => w10=0x6dcd
[19:36:50 547][libcryptoDD.so 0x3d2e4] [ea09a972] 0x4003d2e4: "movk w10, #0x484f, lsl #16" w10=0x6dcd => w10=0x484f6dcd
[19:36:50 547][libcryptoDD.so 0x3d2e8] [3f010a6b] 0x4003d2e8: "cmp w9, w10" w10=0x484f6dcd => nzcv: N=0, Z=1, C=1, V=0 w9=0x484f6dcd
[19:36:50 547][libcryptoDD.so 0x3d2ec] [ea03092a] 0x4003d2ec: "mov w10, w9" w9=0x484f6dcd => w10=0x484f6dcd
[19:36:50 547][libcryptoDD.so 0x3d2f0] [c1f9ff54] 0x4003d2f0: "b.ne #0x4003d228" nzcv: N=0, Z=1, C=1, V=0
[19:36:50 547][libcryptoDD.so 0x3d2f4] [aa488452] 0x4003d2f4: "movz w10, #0x2245" w10=0x484f6dcd => w10=0x2245
[19:36:50 547][libcryptoDD.so 0x3d2f8] [eaf2ad72] 0x4003d2f8: "movk w10, #0x6f97, lsl #16" w10=0x2245 => w10=0x6f972245
[19:36:50 547][libcryptoDD.so 0x3d2fc] [cbffff17] 0x4003d2fc: "b #0x4003d228"
[19:36:50 547][libcryptoDD.so 0x3d228] [e9030a2a] 0x4003d228: "mov w9, w10" w10=0x6f972245 => w9=0x6f972245
[19:36:50 547][libcryptoDD.so 0x3d22c] [8a488452] 0x4003d22c: "movz w10, #0x2244" w10=0x6f972245 => w10=0x2244
[19:36:50 547][libcryptoDD.so 0x3d230] [eaf2ad72] 0x4003d230: "movk w10, #0x6f97, lsl #16" w10=0x2244 => w10=0x6f972244
[19:36:50 547][libcryptoDD.so 0x3d234] [3f010a6b] 0x4003d234: "cmp w9, w10" w10=0x6f972244 => nzcv: N=0, Z=0, C=1, V=0 w9=0x6f972245
[19:36:50 547][libcryptoDD.so 0x3d238] [6c020054] 0x4003d238: "b.gt #0x4003d284" nzcv: N=0, Z=0, C=1, V=0
[19:36:50 547][libcryptoDD.so 0x3d284] [aa5b8d52] 0x4003d284: "movz w10, #0x6add" w10=0x6f972244 => w10=0x6add
[19:36:50 547][libcryptoDD.so 0x3d288] [2a1faf72] 0x4003d288: "movk w10, #0x78f9, lsl #16" w10=0x6add => w10=0x78f96add
[19:36:50 547][libcryptoDD.so 0x3d28c] [3f010a6b] 0x4003d28c: "cmp w9, w10" w10=0x78f96add => nzcv: N=1, Z=0, C=0, V=0 w9=0x6f972245
[19:36:50 547][libcryptoDD.so 0x3d290] [8c030054] 0x4003d290: "b.gt #0x4003d300" nzcv: N=1, Z=0, C=0, V=0
[19:36:50 547][libcryptoDD.so 0x3d294] [aa488452] 0x4003d294: "movz w10, #0x2245" w10=0x78f96add => w10=0x2245
[19:36:50 547][libcryptoDD.so 0x3d298] [eaf2ad72] 0x4003d298: "movk w10, #0x6f97, lsl #16" w10=0x2245 => w10=0x6f972245
[19:36:50 547][libcryptoDD.so 0x3d29c] [3f010a6b] 0x4003d29c: "cmp w9, w10" w10=0x6f972245 => nzcv: N=0, Z=1, C=1, V=0 w9=0x6f972245
[19:36:50 547][libcryptoDD.so 0x3d2a0] [e0040054] 0x4003d2a0: "b.eq #0x4003d33c" nzcv: N=0, Z=1, C=1, V=0
[19:36:50 555][libcryptoDD.so 0x3d33c] [e90740b9] 0x4003d33c: "ldr w9, [sp, #4]" sp=0xbffff490 => w9=0x2
[19:36:50 555][libcryptoDD.so 0x3d340] [2a379252] 0x4003d340: "movz w10, #0x91b9" w10=0x6f972245 => w10=0x91b9
[19:36:50 555][libcryptoDD.so 0x3d344] [6abfbc72] 0x4003d344: "movk w10, #0xe5fb, lsl #16" w10=0x91b9 => w10=0xe5fb91b9
[19:36:50 555][libcryptoDD.so 0x3d348] [09686938] 0x4003d348: "ldrb w9, [x0, x9]" x0=0xbffff4a0 x9=0x2 => w9=0xf
[19:36:50 555][libcryptoDD.so 0x3d34c] [e9230039] 0x4003d34c: "strb w9, [sp, #8]" w9=0xf sp=0xbffff490 => w9=0xf
[19:36:50 555][libcryptoDD.so 0x3d350] [b6ffff17] 0x4003d350: "b #0x4003d228"
[19:36:50 555][libcryptoDD.so 0x3d228] [e9030a2a] 0x4003d228: "mov w9, w10" w10=0xe5fb91b9 => w9=0xe5fb91b9
[19:36:50 555][libcryptoDD.so 0x3d22c] [8a488452] 0x4003d22c: "movz w10, #0x2244" w10=0xe5fb91b9 => w10=0x2244
[19:36:50 555][libcryptoDD.so 0x3d230] [eaf2ad72] 0x4003d230: "movk w10, #0x6f97, lsl #16" w10=0x2244 => w10=0x6f972244
[19:36:50 557][libcryptoDD.so 0x3d234] [3f010a6b] 0x4003d234: "cmp w9, w10" w10=0x6f972244 => nzcv: N=0, Z=0, C=1, V=1 w9=0xe5fb91b9
[19:36:50 557][libcryptoDD.so 0x3d238] [6c020054] 0x4003d238: "b.gt #0x4003d284" nzcv: N=0, Z=0, C=1, V=1
[19:36:50 557][libcryptoDD.so 0x3d23c] [6a9b9d52] 0x4003d23c: "movz w10, #0xecdb" w10=0x6f972244 => w10=0xecdb
[19:36:50 557][libcryptoDD.so 0x3d240] [4af0a772] 0x4003d240: "movk w10, #0x3f82, lsl #16" w10=0xecdb => w10=0x3f82ecdb
[19:36:50 557][libcryptoDD.so 0x3d244] [3f010a6b] 0x4003d244: "cmp w9, w10" w10=0x3f82ecdb => nzcv: N=1, Z=0, C=1, V=0 w9=0xe5fb91b9
[19:36:50 557][libcryptoDD.so 0x3d248] [0c040054] 0x4003d248: "b.gt #0x4003d2c8" nzcv: N=1, Z=0, C=1, V=0
[19:36:50 557][libcryptoDD.so 0x3d24c] [2a379252] 0x4003d24c: "movz w10, #0x91b9" w10=0x3f82ecdb => w10=0x91b9
[19:36:50 557][libcryptoDD.so 0x3d250] [6abfbc72] 0x4003d250: "movk w10, #0xe5fb, lsl #16" w10=0x91b9 => w10=0xe5fb91b9
[19:36:50 557][libcryptoDD.so 0x3d254] [3f010a6b] 0x4003d254: "cmp w9, w10" w10=0xe5fb91b9 => nzcv: N=0, Z=1, C=1, V=0 w9=0xe5fb91b9
[19:36:50 559][libcryptoDD.so 0x3d258] [40feff54] 0x4003d258: "b.eq #0x4003d220" nzcv: N=0, Z=1, C=1, V=0
[19:36:50 559][libcryptoDD.so 0x3d220] [8a9b9d52] 0x4003d220: "movz w10, #0xecdc" w10=0xe5fb91b9 => w10=0xecdc
[19:36:50 559][libcryptoDD.so 0x3d224] [4af0a772] 0x4003d224: "movk w10, #0x3f82, lsl #16" w10=0xecdc => w10=0x3f82ecdc
[19:36:50 559][libcryptoDD.so 0x3d228] [e9030a2a] 0x4003d228: "mov w9, w10" w10=0x3f82ecdc => w9=0x3f82ecdc
[19:36:50 559][libcryptoDD.so 0x3d22c] [8a488452] 0x4003d22c: "movz w10, #0x2244" w10=0x3f82ecdc => w10=0x2244
[19:36:50 559][libcryptoDD.so 0x3d230] [eaf2ad72] 0x4003d230: "movk w10, #0x6f97, lsl #16" w10=0x2244 => w10=0x6f972244
[19:36:50 559][libcryptoDD.so 0x3d234] [3f010a6b] 0x4003d234: "cmp w9, w10" w10=0x6f972244 => nzcv: N=1, Z=0, C=0, V=0 w9=0x3f82ecdc
[19:36:50 559][libcryptoDD.so 0x3d238] [6c020054] 0x4003d238: "b.gt #0x4003d284" nzcv: N=1, Z=0, C=0, V=0
[19:36:50 559][libcryptoDD.so 0x3d23c] [6a9b9d52] 0x4003d23c: "movz w10, #0xecdb" w10=0x6f972244 => w10=0xecdb
[19:36:50 559][libcryptoDD.so 0x3d240] [4af0a772] 0x4003d240: "movk w10, #0x3f82, lsl #16" w10=0xecdb => w10=0x3f82ecdb
[19:36:50 559][libcryptoDD.so 0x3d244] [3f010a6b] 0x4003d244: "cmp w9, w10" w10=0x3f82ecdb => nzcv: N=0, Z=0, C=1, V=0 w9=0x3f82ecdc
[19:36:50 559][libcryptoDD.so 0x3d248] [0c040054] 0x4003d248: "b.gt #0x4003d2c8" nzcv: N=0, Z=0, C=1, V=0
[19:36:50 559][libcryptoDD.so 0x3d2c8] [8a9b9d52] 0x4003d2c8: "movz w10, #0xecdc" w10=0x3f82ecdb => w10=0xecdc
[19:36:50 559][libcryptoDD.so 0x3d2cc] [4af0a772] 0x4003d2cc: "movk w10, #0x3f82, lsl #16" w10=0xecdc => w10=0x3f82ecdc
[19:36:50 559][libcryptoDD.so 0x3d2d0] [3f010a6b] 0x4003d2d0: "cmp w9, w10" w10=0x3f82ecdc => nzcv: N=0, Z=1, C=1, V=0 w9=0x3f82ecdc
[19:36:50 559][libcryptoDD.so 0x3d2d4] [ca5b8d52] 0x4003d2d4: "movz w10, #0x6ade" w10=0x3f82ecdc => w10=0x6ade
[19:36:50 561][libcryptoDD.so 0x3d2d8] [2a1faf72] 0x4003d2d8: "movk w10, #0x78f9, lsl #16" w10=0x6ade => w10=0x78f96ade
[19:36:50 561][libcryptoDD.so 0x3d2dc] [60faff54] 0x4003d2dc: "b.eq #0x4003d228" nzcv: N=0, Z=1, C=1, V=0
[19:36:50 561][libcryptoDD.so 0x3d228] [e9030a2a] 0x4003d228: "mov w9, w10" w10=0x78f96ade => w9=0x78f96ade
[19:36:50 561][libcryptoDD.so 0x3d22c] [8a488452] 0x4003d22c: "movz w10, #0x2244" w10=0x78f96ade => w10=0x2244
[19:36:50 561][libcryptoDD.so 0x3d230] [eaf2ad72] 0x4003d230: "movk w10, #0x6f97, lsl #16" w10=0x2244 => w10=0x6f972244
[19:36:50 561][libcryptoDD.so 0x3d234] [3f010a6b] 0x4003d234: "cmp w9, w10" w10=0x6f972244 => nzcv: N=0, Z=0, C=1, V=0 w9=0x78f96ade
[19:36:50 561][libcryptoDD.so 0x3d238] [6c020054] 0x4003d238: "b.gt #0x4003d284" nzcv: N=0, Z=0, C=1, V=0
[19:36:50 561][libcryptoDD.so 0x3d284] [aa5b8d52] 0x4003d284: "movz w10, #0x6add" w10=0x6f972244 => w10=0x6add
[19:36:50 561][libcryptoDD.so 0x3d288] [2a1faf72] 0x4003d288: "movk w10, #0x78f9, lsl #16" w10=0x6add => w10=0x78f96add
[19:36:50 561][libcryptoDD.so 0x3d28c] [3f010a6b] 0x4003d28c: "cmp w9, w10" w10=0x78f96add => nzcv: N=0, Z=0, C=1, V=0 w9=0x78f96ade
[19:36:50 561][libcryptoDD.so 0x3d290] [8c030054] 0x4003d290: "b.gt #0x4003d300" nzcv: N=0, Z=0, C=1, V=0
[19:36:50 561][libcryptoDD.so 0x3d300] [ca5b8d52] 0x4003d300: "movz w10, #0x6ade" w10=0x78f96add => w10=0x6ade
[19:36:50 561][libcryptoDD.so 0x3d304] [2a1faf72] 0x4003d304: "movk w10, #0x78f9, lsl #16" w10=0x6ade => w10=0x78f96ade
[19:36:50 563][libcryptoDD.so 0x3d308] [3f010a6b] 0x4003d308: "cmp w9, w10" w10=0x78f96ade => nzcv: N=0, Z=1, C=1, V=0 w9=0x78f96ade
[19:36:50 563][libcryptoDD.so 0x3d30c] [41020054] 0x4003d30c: "b.ne #0x4003d354" nzcv: N=0, Z=1, C=1, V=0
[19:36:50 563][libcryptoDD.so 0x3d310] [e9234039] 0x4003d310: "ldrb w9, [sp, #8]" sp=0xbffff490 => w9=0xf
[19:36:50 563][libcryptoDD.so 0x3d314] [ea0340b9] 0x4003d314: "ldr w10, [sp]" sp=0xbffff490 => w10=0xd3f10000
[19:36:50 563][libcryptoDD.so 0x3d318] [0b686838] 0x4003d318: "ldrb w11, [x0, x8]" x0=0xbffff4a0 x8=0x3 => w11=0xf
[19:36:50 563][libcryptoDD.so 0x3d31c] [4921092a] 0x4003d31c: "orr w9, w10, w9, lsl #8" w10=0xd3f10000 w9=0xf => w9=0xd3f10f00
[19:36:50 563][libcryptoDD.so 0x3d320] [4a010b0a] 0x4003d320: "and w10, w10, w11" w10=0xd3f10000 w11=0xf => w10=0x0
[19:36:50 563][libcryptoDD.so 0x3d324] [29010b4a] 0x4003d324: "eor w9, w9, w11" w9=0xd3f10f00 w11=0xf => w9=0xd3f10f0f
[19:36:50 563][libcryptoDD.so 0x3d328] [29010a2a] 0x4003d328: "orr w9, w9, w10" w9=0xd3f10f0f w10=0x0 => w9=0xd3f10f0f
[19:36:50 563][libcryptoDD.so 0x3d32c] [aa819552] 0x4003d32c: "movz w10, #0xac0d" w10=0x0 => w10=0xac0d
[19:36:50 563][libcryptoDD.so 0x3d330] [e90f00b9] 0x4003d330: "str w9, [sp, #0xc]" w9=0xd3f10f0f sp=0xbffff490 => w9=0xd3f10f0f
[19:36:50 563][libcryptoDD.so 0x3d334] [aa25af72] 0x4003d334: "movk w10, #0x792d, lsl #16" w10=0xac0d => w10=0x792dac0d
[19:36:50 563][libcryptoDD.so 0x3d338] [bcffff17] 0x4003d338: "b #0x4003d228"
[19:36:50 563][libcryptoDD.so 0x3d228] [e9030a2a] 0x4003d228: "mov w9, w10" w10=0x792dac0d => w9=0x792dac0d
[19:36:50 563][libcryptoDD.so 0x3d22c] [8a488452] 0x4003d22c: "movz w10, #0x2244" w10=0x792dac0d => w10=0x2244
[19:36:50 563][libcryptoDD.so 0x3d230] [eaf2ad72] 0x4003d230: "movk w10, #0x6f97, lsl #16" w10=0x2244 => w10=0x6f972244
[19:36:50 563][libcryptoDD.so 0x3d234] [3f010a6b] 0x4003d234: "cmp w9, w10" w10=0x6f972244 => nzcv: N=0, Z=0, C=1, V=0 w9=0x792dac0d
[19:36:50 563][libcryptoDD.so 0x3d238] [6c020054] 0x4003d238: "b.gt #0x4003d284" nzcv: N=0, Z=0, C=1, V=0
[19:36:50 563][libcryptoDD.so 0x3d284] [aa5b8d52] 0x4003d284: "movz w10, #0x6add" w10=0x6f972244 => w10=0x6add
[19:36:50 563][libcryptoDD.so 0x3d288] [2a1faf72] 0x4003d288: "movk w10, #0x78f9, lsl #16" w10=0x6add => w10=0x78f96add
[19:36:50 563][libcryptoDD.so 0x3d28c] [3f010a6b] 0x4003d28c: "cmp w9, w10" w10=0x78f96add => nzcv: N=0, Z=0, C=1, V=0 w9=0x792dac0d
[19:36:50 563][libcryptoDD.so 0x3d290] [8c030054] 0x4003d290: "b.gt #0x4003d300" nzcv: N=0, Z=0, C=1, V=0
[19:36:50 563][libcryptoDD.so 0x3d300] [ca5b8d52] 0x4003d300: "movz w10, #0x6ade" w10=0x78f96add => w10=0x6ade
[19:36:50 563][libcryptoDD.so 0x3d304] [2a1faf72] 0x4003d304: "movk w10, #0x78f9, lsl #16" w10=0x6ade => w10=0x78f96ade
[19:36:50 563][libcryptoDD.so 0x3d308] [3f010a6b] 0x4003d308: "cmp w9, w10" w10=0x78f96ade => nzcv: N=0, Z=0, C=1, V=0 w9=0x792dac0d
[19:36:50 563][libcryptoDD.so 0x3d30c] [41020054] 0x4003d30c: "b.ne #0x4003d354" nzcv: N=0, Z=0, C=1, V=0
[19:36:50 563][libcryptoDD.so 0x3d354] [aa819552] 0x4003d354: "movz w10, #0xac0d" w10=0x78f96ade => w10=0xac0d
[19:36:50 563][libcryptoDD.so 0x3d358] [aa25af72] 0x4003d358: "movk w10, #0x792d, lsl #16" w10=0xac0d => w10=0x792dac0d
[19:36:50 571][libcryptoDD.so 0x3d35c] [3f010a6b] 0x4003d35c: "cmp w9, w10" w10=0x792dac0d => nzcv: N=0, Z=1, C=1, V=0 w9=0x792dac0d
[19:36:50 571][libcryptoDD.so 0x3d360] [ea03092a] 0x4003d360: "mov w10, w9" w9=0x792dac0d => w10=0x792dac0d
[19:36:50 571][libcryptoDD.so 0x3d364] [21f6ff54] 0x4003d364: "b.ne #0x4003d228" nzcv: N=0, Z=1, C=1, V=0
[19:36:50 571][libcryptoDD.so 0x3d368] [e00f40b9] 0x4003d368: "ldr w0, [sp, #0xc]" sp=0xbffff490 => w0=0xd3f10f0f
[19:36:50 571][libcryptoDD.so 0x3d36c] [ff430091] 0x4003d36c: "add sp, sp, #0x10" sp=0xbffff490 => sp=0xbffff4a0
[19:36:50 573][libcryptoDD.so 0x3d370] [c0035fd6] 0x4003d370: "ret"
[19:36:50 573][libcryptoDD.so 0x40f60] [4f000094] 0x40040f60: "bl #0x4004109c"
[19:36:50 573][libcryptoDD.so 0x4109c] [1f000071] 0x4004109c: "cmp w0, #0" => nzcv: N=1, Z=0, C=1, V=0 w0=0xd3f10f0f
[19:36:50 573][libcryptoDD.so 0x410a0] [0054805a] 0x400410a0: "cneg w0, w0, mi" nzcv: N=1, Z=0, C=1, V=0 w0=0xd3f10f0f => w0=0x2c0ef0f1
[19:36:50 575][libcryptoDD.so 0x410a4] [c0035fd6] 0x400410a4: "ret"
[19:36:50 575][libcryptoDD.so 0x40f64] [a8035df8] 0x40040f64: "ldur x8, [x29, #-0x30]" x8=0x3 x29=0xbffff5d0 => x8=0xbffff4b0
[19:36:50 575][libcryptoDD.so 0x40f68] [810000d0] 0x40040f68: "adrp x1, #0x40052000" => x1=0x40052000
[19:36:50 575][libcryptoDD.so 0x40f6c] [e203002a] 0x40040f6c: "mov w2, w0" w0=0x2c0ef0f1 => w2=0x2c0ef0f1
[19:36:50 577][libcryptoDD.so 0x40f70] [21d02d91] 0x40040f70: "add x1, x1, #0xb74" x1=0x40052000 => x1=0x40052b74
[19:36:50 577][libcryptoDD.so 0x40f74] [e00308aa] 0x40040f74: "mov x0, x8" x8=0xbffff4b0 => x0=0xbffff4b0
[19:36:50 579][libcryptoDD.so 0x40f78] [a25bff97] 0x40040f78: "bl #0x40017e00"
[19:36:50 579][libcryptoDD.so 0x17e00] [b0010090] 0x40017e00: "adrp x16, #0x4004b000" => x16=0x4004b000
[19:36:50 579][libcryptoDD.so 0x17e04] [11c647f9] 0x40017e04: "ldr x17, [x16, #0xf88]" x16=0x4004b000 => x17=0x40214f34
[19:36:50 581][libcryptoDD.so 0x17e08] [10223e91] 0x40017e08: "add x16, x16, #0xf88" x16=0x4004b000 => x16=0x4004bf88
[19:36:50 581][libcryptoDD.so 0x17e0c] [20021fd6] 0x40017e0c: "br x17" x17=0x40214f34
============出参================-739176689
```

我们只看一次就行了 搜md5传参加密结果 d3f10f0f64ae26b60b095c92172e2950前4个字节 d3f10f0f 在此处 我们看这

```
19:36:50 573 [1f000071] 0x4004109c: "cmp w0, #0" => nzcv: N=1, Z=0, C=1, V=0 w0=0xd3f10f0f

19:36:50 573 [0054805a] 0x400410a0: "cneg w0, w0, mi" nzcv: N=1, Z=0, C=1, V=0 w0=0xd3f10f0f => w0=0x2c0ef0f1

19:36:50 575 [c0035fd6] 0x400410a4: "ret"

```

这三行汇编 具体实现为

- 检查条件标志位（N=1 表示负数）
- 当条件满足时（mi，即负数），对 w0 寄存器的值进行取反（按位取反加 1，即补码运算）
- 比较 0xd3f10f0f  为负 执行 cneg   指令取反

![](./upload/attach/202510/949800_TJ9GBJT48XTJFKU.png)

到这里基本上就能理解了，对MD5的结果传入函数比较 然后根据情况取反操作 写个python 实现下

首先对传参md5 得到 9f8b2056b6cb87149b196da5b305059a  然后 运算得到 结果与unidbg结果对比一致 完结

```
hex_str = "9f8b2056b6cb87149b196da5b305059a"
result = ''.join(str(int(hex_str[i:i+8],16) if int(hex_str[i:i+8],16) < 0x80000000 else (~int(hex_str[i:i+8],16)+1)&0xFFFFFFFF) for i in range(0,32,8))
print(result)
```

![](./upload/attach/202510/949800_CGMECT25SCNZWY6.png)

此案例总体来说还是很简单的，用来练习Unidbg刚刚好。虽然有ollvm，但是 代码量不算大，还是阔以看着搞。

登录后可查看完整内容

冰与火的战歌：Windows内核攻防实战高级班！从零到实战，融合AI与Windows内核攻防全技术栈，打造具备自动化能力的内核开发高手。

#逆向分析

收藏・5

点赞・5

打赏

最新回复 (3)
bluegatar 雪币： 5 活跃值： (5784) 能力值： ( LV2，RANK：10 ) 在线值：发帖 4 回帖 238 粉丝 6 关注私信	bluegatar 2 楼不错不错，给你点赞 2025-10-7 23:47 0
mb_cbgtaveo 雪币： 292 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 253 粉丝 0 关注私信	mb_cbgtaveo 3 楼 66666666666 2025-10-10 17:46 0
xxjj678 雪币： 4 能力值： ( LV1，RANK：0 ) 在线值：发帖 2 回帖 83 粉丝 1 关注私信	xxjj678 4 楼 666 2025-10-12 00:13 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

nianchu

发帖

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (3)
bluegatar 雪币： 5 活跃值： (5784) 能力值： ( LV2，RANK：10 ) 在线值：发帖 4 回帖 238 粉丝 6 关注私信	bluegatar 2 楼不错不错，给你点赞 2025-10-7 23:47 0
mb_cbgtaveo 雪币： 292 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 253 粉丝 0 关注私信	mb_cbgtaveo 3 楼 66666666666 2025-10-10 17:46 0
xxjj678 雪币： 4 能力值： ( LV1，RANK：0 ) 在线值：发帖 2 回帖 83 粉丝 1 关注私信	xxjj678 4 楼 666 2025-10-12 00:13 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复