本文为看雪论坛优秀文章
看雪论坛作者ID：pass_
var base_xxx = Module.findBaseAddress("libnative-lib.so");var sub_0xF04C = base_xxx.add(0xF04C);Interceptor.attach(sub_0xF04C, {onEnter: function (args) {this.arg0 = args[0];this.arg1 = args[1];this.arg2 = args[2];console.log("addr:", sub_0xF04C, " onEnter rn", hexdump(this.arg0), "rn",this.arg1,"rn", this.arg2);},onLeave: function (retval) {});
这次有input、middle，以及output的值了。
tab10="0123456789-_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";output=""i=-1while i < 47:#print(output)i=i+1#print("index:",i)if i % 4==0:plus =int( (i / 4)*3)tmp=ord(middle[plus])>>2output=output+tab10[tmp]continueif i %4 ==1:plus =int( (i / 4)*3)tmp=ord(middle[plus])#print(tmp)tmp=0x10*(tmp&0x3)#print(tmp)tmp = tmp | ord(middle[1+plus])>>4output=output+tab10[tmp]continueif i % 4==2:plus =(int(i / 4))plus=plus*3#print("plus:",plus)tmp=ord(middle[1+plus])# print(tmp)tmp=4*(tmp & 0xf)# print(tmp)tmp=tmp | (ord(middle[2+plus])>>6)output=output+tab10[tmp]continueif i % 4==3:plus =int( (i / 4)*3)#print(plus)tmp=ord(middle[plus])&0x3f#print(tmp)output=output+tab10[tmp]continueprint(output)
tab_1="0123456789abcdef"input="DKR0hQV5ZzqM3v8kMdRYZ9qbhCFqSruTvdoQ"#input: WnD6JZC9NilAwTPEUXbXhZSykE4mCqP0sRRM output: jAX5bOHpexuHo6P0rwOOf5fn_jzDkP9E_iePp49Kih5MiNiSmiddle=""tmp1=0xfftmp2=0for i in range(len(input)-2):if i == 8 or i == 0xd or i == 0x12 or i ==0x18:middle=middle+"-"continueif i==0xe:middle=middle+"4"continueif i == 0x17:middle=middle+chr(ord(input[i+1]) ^ 1)tmp1=tmp1 ^ ord(input[i+1])tmp2=tmp2 + ord(input[i+1])continuemiddle=middle+chr(ord(input[i]) ^ 1)tmp1=tmp1 ^ ord(input[i])tmp2=tmp2 + ord(input[i])tmp2=tmp2 - (tmp2 & 0xFFFFFFF0)tmp1=(tmp1&0xf)#print(tmp1,tmp2)middle=middle+tab_1[tmp2]+tab_1[tmp1]print("middle array:")print(middle)tab10="0123456789-_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";output=""i=-1while i < 47:#print(output)i=i+1#print("index:",i)if i % 4==0:plus =int( (i / 4)*3)tmp=ord(middle[plus])>>2output=output+tab10[tmp]continueif i %4 ==1:plus =int( (i / 4)*3)tmp=ord(middle[plus])#print(tmp)tmp=0x10*(tmp&0x3)#print(tmp)tmp = tmp | ord(middle[1+plus])>>4output=output+tab10[tmp]continueif i % 4==2:plus =(int(i / 4))plus=plus*3#print("plus:",plus)tmp=ord(middle[1+plus])# print(tmp)tmp=4*(tmp & 0xf)# print(tmp)tmp=tmp | (ord(middle[2+plus])>>6)output=output+tab10[tmp]continueif i % 4==3:plus =int( (i / 4)*3)#print(plus)tmp=ord(middle[plus])&0x3f#print(tmp)output=output+tab10[tmp]continueprint(output)
看雪ID：pass_
https://bbs.pediy.com/user-home-897363.htm
安卓应用层抓包通杀脚本发布！
《高研班》2021年3月班正在火热招生中！👇
* 戳图片了解详情
# 往期推荐
球分享
球点赞
球在看
点击“阅读原文”，了解更多！
本文始发于微信公众号（看雪学院）：使用IDA trace来还原ollvm混淆的非标准算法
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论