[原创]【银行逆向百例】16Android逆向之算法助手 frida绕过环境检测分析加密算法-Android安全-看雪安全社区

[原创]【银行逆向百例】16Android逆向之算法助手 frida绕过环境检测分析加密算法

发表于: 2026-5-22 14:59 2007

[原创]【银行逆向百例】16Android逆向之算法助手 frida绕过环境检测分析加密算法

差不多的张三

2026-5-22 14:59

2007

“ 你打算怎么活，今后，在我死之后，你打算过怎样的生活，托尔芬。——《冰海战记》S1E24 ”
# 01环境版本
环境：
电脑，Windows 11 专业版 23H2
```
https://github.com/JiaoSuInfoSec/JiaoSuInfoSec_T00ls_Win11
```

软件：
Mumu模拟器，5.3.4
```
https://mumu.163.com/download/
```
Kitsune Mask，27.2
```
https://github.com/1q23lyc45/KitsuneMagisk/releases
```
算法助手，1.0.9
```
https://www.123865.com/s/7G8aTd-bKH4H
```
LSPosed，1.9.2
```
https://github.com/LSPosed/LSPosed/releases/tag/v1.9.2
```
brook，20230606.5
```
https://github.com/txthinking/brook
```
frida-server，16.1.8
```
https://github.com/frida/frida/releases/tag/16.1.8
```
burpsuite，2025.1
```
https://portswigger.net/burp/releases
```
Charles，5.0.2
```
https://www.charlesproxy.com/download/
```

# 02操作步骤
1、弹窗提示设备环境风险，点击确定自动退出APP
 ![图片描述](upload/attach/202605/1037623_F3W2MWCQYDPW525.webp)
2、可写系统盘
```
https://mumu.163.com/help/20240202/35044_1136675.html
```
 ![图片描述](upload/attach/202605/1037623_VEU2CM48TPV7YQA.webp)
3、安装KitsuneMagisk
```
https://github.com/1q23lyc45/KitsuneMagisk/releases
```
 ![图片描述](upload/attach/202605/1037623_FZASB8R3A6D74HM.webp)
4、安装算法助手
```
https://www.123865.com/s/7G8aTd-bKH4H
```
 ![图片描述](upload/attach/202605/1037623_7686GJX2BN87R8A.webp)
5、下载LSPosed-v1.9.2-7024-zygisk-release
```
https://github.com/LSPosed/LSPosed/releases/tag/v1.9.2
```
 ![图片描述](upload/attach/202605/1037623_PXW8XX9YP5769QC.webp)
6、允许root权限
 ![图片描述](upload/attach/202605/1037623_WRJP9AQ64YBZ8R9.webp)
7、安装
 ![图片描述](upload/attach/202605/1037623_CVVHQVKKRGW8W9K.webp)
8、直接安装
 ![图片描述](upload/attach/202605/1037623_SEVA9QTG47YU6U6.webp)
9、开启Zygisk
 ![图片描述](upload/attach/202605/1037623_QQ2YAUZW5965EPE.webp)
10、关闭模拟器
 ![图片描述](upload/attach/202605/1037623_85WNF2SSRZF2Y6K.webp)
11、模块安装LSPosed-v1.9.2-7024-zygisk-release
 ![图片描述](upload/attach/202605/1037623_N8WCG5PEH9DAKNZ.webp)
12、关闭模拟器
 ![图片描述](upload/attach/202605/1037623_GKFMZFFFPQFE2HU.webp)
13、下拉进入LSPosed
 ![图片描述](upload/attach/202605/1037623_UZ7MKC932UHCVMG.webp)
14、模块启用算法助手
 ![图片描述](upload/attach/202605/1037623_YVD3M84G447ZSWD.webp)
15、启用模块后关闭模拟器
 ![图片描述](upload/attach/202605/1037623_EV7ZMYM5RK4XUS2.webp)
16、算法助手勾选目标APP
 ![图片描述](upload/attach/202605/1037623_4WUHA9V3NG3DQEW.webp)
17、弹窗定位，启动APP
 ![图片描述](upload/attach/202605/1037623_G3XQCKAJ48T6APC.webp)
18、查看日志
 ![图片描述](upload/attach/202605/1037623_8GHX7S3VR8ZXWE6.webp)
19、复制调用堆栈
 ![图片描述](upload/attach/202605/1037623_AMTE5F68MNPT4JD.webp)
20、分析日志，最后调用了AlertMessageDialog.showIosAlert
 ![图片描述](upload/attach/202605/1037623_KTUC8ZC6Z2KQBF5.webp)
21、启动frida-server
```
https://github.com/frida/frida/releases/tag/16.1.8
```
 ![图片描述](upload/attach/202605/1037623_95RRFH7RG5BSET4.webp)
```
adb push .\frida-server-16.1.8-android-x86_64 /data/local/tmp
adb shell
su
cd /data/local/tmp
chmod +x frida-server-16.1.8-android-x86_64
./frida-server-16.1.8-android-x86_64
```
22、获取包名
```
frida-ps -Uai
```
 ![图片描述](upload/attach/202605/1037623_PNGT6ERSAKAW6KQ.webp)
23、hook弹窗通用方法Dialog.show，如果调用堆栈包含AlertMessageDialog关键字就返回空，成功绕过弹窗
 ![图片描述](upload/attach/202605/1037623_9US23PXMA7TV5TT.webp)
```
Java.perform(function() {
    var Dialog = Java.use("android.app.Dialog");
    Dialog.show.implementation = function() {
        if (Java.use("java.lang.Thread").currentThread().getStackTrace().toString().indexOf("AlertMessageDialog") !== -1) {
            console.log("[+] 拦截环境检测弹窗");
            return;
        }
        return this.show();
    };
});
```
24、网络环境勾选
 ![图片描述](upload/attach/202605/1037623_3QQ4S58CCYHQ38Q.webp)
25、抓包请求加密
```
https://xz.aliyun.com/news/11263
```
 ![图片描述](upload/attach/202605/1037623_23NBJMNAJYZK5MP.webp)
26、算法助手勾选算法分析
 ![图片描述](upload/attach/202605/1037623_K8CQYUVDXEG27F4.webp)
27、复制调用堆栈日志
 ![图片描述](upload/attach/202605/1037623_SZNYH5GM78JNP6J.webp)
28、分析调用堆栈
用户名，调用 RSAUtils.IdNoEncrypt() → 内部调用 RSAUtils.encrypt() 进行 RSA 加密
```
com.xxx.utils.keyboardutil.RSAUtils.encrypt
com.xxx.utils.keyboardutil.RSAUtils.IdNoEncrypt
```
密码，调用 RSAUtils.PwdRandomRsaEncrypt() → 内部先用 AESUtils.encrypt() 加密密码，再用 RSA 加密 AES 密钥
```
com.xxx.utils.keyboardutil.AESUtils.encrypt
com.xxx.utils.keyboardutil.AESUtils.encrypt
com.xxx.utils.keyboardutil.RSAUtils.PwdRandomRsaEncrypt
```
 ![图片描述](upload/attach/202605/1037623_N9ZZ4U6YSHHUSRF.webp)
29、hook.js
 ![图片描述](upload/attach/202605/1037623_SPDGUAPHMY9TK5E.webp)
```
Java.perform(function() {
    console.log("[*] Frida Hook已启动 - 延迟Hook策略");
    // 字节转Hex
    function bytesToHex(bytes) {
        if (!bytes) return "null";
        var result = "";
        for (var i = 0; i < bytes.length; i++) {
            result += ("0" + (bytes[i] & 0xFF).toString(16)).slice(-2);
        }
        return result;
    }
    // 打印调用堆栈
    function printStackTrace() {
        console.log("[调用堆栈]");
        var traces = Java.use("java.lang.Thread").currentThread().getStackTrace();
        for (var i = 0; i < traces.length && i < 10; i++) {
            var line = traces[i].toString();
            if (line.indexOf("cn.com.xxx") !== -1 || line.indexOf("xxx") !== -1) {
                console.log("  at " + line);
            }
        }
    }
    // ==================== 弹窗拦截 ====================
    try {
        var Dialog = Java.use("android.app.Dialog");
        Dialog.show.implementation = function() {
            try {
                if (Java.use("java.lang.Thread").currentThread().getStackTrace().toString().indexOf("AlertMessageDialog") !== -1) {
                    console.log("[+] 拦截环境检测弹窗");
                    return;
                }
            } catch(e) {}
            return this.show();
        };
        console.log("[+] 弹窗拦截已启用");
    } catch(e) {}
    // ==================== 延迟Hook目标类 ====================
    var rsaHooked = false;
    var aesHooked = false;
    var hookAttempts = 0;
    var maxAttempts = 30;
    function tryHookTargetClasses() {
        hookAttempts++;
        // 尝试Hook RSAUtils
        if (!rsaHooked) {
            try {
                var RSAUtils = Java.use("com.xxx.utils.keyboardutil.RSAUtils");
                console.log("[+] RSAUtils 类已加载，开始Hook...");
                // Hook encrypt (String, Key)
                try {
                    RSAUtils.encrypt.overload('java.lang.String', 'java.security.Key').implementation = function(data, key) {
                        console.log("\n================ RSAUtils.encrypt ================");
                        console.log("[输入] " + data);
                        var result = this.encrypt(data, key);
                        console.log("[输出Hex] " + bytesToHex(result));
                        printStackTrace();
                        console.log("==================================================");
                        return result;
                    };
                } catch(e) {}
                // Hook IdNoEncrypt
                try {
                    RSAUtils.IdNoEncrypt.implementation = function(idNo) {
                        console.log("\n================ RSAUtils.IdNoEncrypt ================");
                        console.log("[输入数据] " + idNo);
                        var result = this.IdNoEncrypt(idNo);
                        console.log("[加密结果] " + result);
                        printStackTrace();
                        console.log("======================================================");
                        return result;
                    };
                } catch(e) {}
                // Hook PwdRandomRsaEncrypt
                try {
                    RSAUtils.PwdRandomRsaEncrypt.implementation = function(pwd, randomKey) {
                        console.log("\n================ RSAUtils.PwdRandomRsaEncrypt ================");
                        console.log("[AES随机密钥] " + pwd);
                        console.log("[明文密码] " + randomKey);
                        var result = this.PwdRandomRsaEncrypt(pwd, randomKey);
                        console.log("[加密结果] " + result);
                        printStackTrace();
                        console.log("==============================================================");
                        return result;
                    };
                } catch(e) {}
                rsaHooked = true;
                console.log("[+] RSAUtils Hook完成");
            } catch(e) {}
        }
        // 尝试Hook AESUtils
        if (!aesHooked) {
            try {
                var AESUtils = Java.use("com.xxx.utils.keyboardutil.AESUtils");
                console.log("[+] AESUtils 类已加载，开始Hook...");
                try {
                    AESUtils.encrypt.overload('java.lang.String', 'java.lang.String').implementation = function(data, key) {
                        console.log("\n================ AESUtils.encrypt ================");
                        console.log("[随机密钥] " + data);
                        console.log("[用户输入] " + key);
                        var result = this.encrypt(data, key);
                        console.log("[AES密文] " + result);
                        printStackTrace();
                        console.log("==================================================");
                        return result;
                    };
                } catch(e) {}
                aesHooked = true;
                console.log("[+] AESUtils Hook完成");
            } catch(e) {}
        }
        // 如果还有类未Hook成功，继续尝试
        if ((!rsaHooked || !aesHooked) && hookAttempts < maxAttempts) {
            setTimeout(tryHookTargetClasses, 300);
        } else if (rsaHooked && aesHooked) {
            console.log("[*] 所有目标类Hook完成");
        }
    }
    // 开始尝试Hook
    setTimeout(tryHookTargetClasses, 1000);
    console.log("[*] Hook设置完成，请操作APP进行登录");
});
```
30、输出日志与数据包一致
 ![图片描述](upload/attach/202605/1037623_PFWGVH7PY96MCMQ.webp)

冰与火的战歌：Windows内核攻防实战高级班！从零到实战，融合AI与Windows内核攻防全技术栈，打造具备自动化能力的内核开发高手。

最后于 2026-5-22 22:23 被差不多的张三编辑，原因：

#逆向分析

收藏・2

点赞・1

打赏

最新回复 (1)
YoungBai 雪币： 1293 活跃值： (1640) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 144 粉丝 2 关注私信	YoungBai 2 楼学习了.感谢分享. 2026-5-24 09:58 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

差不多的张三

发帖

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (1)
YoungBai 雪币： 1293 活跃值： (1640) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 144 粉丝 2 关注私信	YoungBai 2 楼学习了.感谢分享. 2026-5-24 09:58 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复