Java 代码解密：使用 Frida 还原 JVMTI Agent 加密保护的java类&Linux 环境下的Frida 使用

/bin/java -- -Dsun.misc.URLClassPath.disableJarChecking=true -agentpath:./xxxagent.so

//场景的伪代码示例
void JNICALL ClassFileLoadHook(jvmtiEnv *jvmti_env, JNIEnv *jni_env, jclass class_being_loaded,
                               const char *name, jobject protection_domain, jint class_data_len,
                               const unsigned char *class_data, jint *new_class_data_len,
                               unsigned char **new_class_data) {
    // 在这里可以插入解密代码, 它会加载class文件之前进行解密操作

    std::cout << "Class file loaded: " << name << std::endl;

    // 例如，解密后的字节码存放到new_class_data中
    *new_class_data_len = class_data_len;  // 设置新的字节码长度
    *new_class_data = const_cast<unsigned char *>(class_data);  // 这里假设没有改变数据

    // 继续加载原始或解密后的class数据
}
jvmtiEnv *jvmti = nullptr;
JavaVM *jvm = nullptr;
JNIEXPORT jint JNICALL Agent_OnLoad(JavaVM *vm, char *options, void *reserved) {
    // 获取jvmti环境
    jint res = vm->GetEnv(reinterpret_cast<void **>(&jvmti), JVMTI_VERSION);
    if (res != JNI_OK || jvmti == nullptr) {
        std::cerr << "Error: Unable to access JVMTI version." << std::endl;
        return res;
    }

    // 注册ClassFileLoadHook回调
    jvmtiEventCallbacks callbacks = {0};
    callbacks.ClassFileLoadHook = &ClassFileLoadHook;

    res = jvmti->SetEventCallbacks(&callbacks, sizeof(callbacks));
    if (res != JVMTI_ERROR_NONE) {
        std::cerr << "Error: Unable to set event callbacks." << std::endl;
        return res;
    }

    // 启动ClassFileLoadHook事件
    res = jvmti->SetEventNotificationMode(JVMTI_EVENT_CLASS_FILE_LOAD, JVMTI_ENABLE, nullptr);
    if (res != JVMTI_ERROR_NONE) {
        std::cerr << "Error: Unable to enable class file load event." << std::endl;
        return res;
    }

    return JNI_OK;
}

  void post_to_env(JvmtiEnv* env, bool caching_needed) {
    unsigned char *new_data = NULL;
    jint new_len = 0;
  /*......*/
    JvmtiClassFileLoadEventMark jem(_thread, _h_name, _class_loader,
                                    _h_protection_domain,
                                    _h_class_being_redefined);
    JvmtiJavaThreadEventTransition jet(_thread);
    JNIEnv* jni_env =  (JvmtiEnv::get_phase() == JVMTI_PHASE_PRIMORDIAL)?
                                                        NULL : jem.jni_env();
    jvmtiEventClassFileLoadHook callback = env->callbacks()->ClassFileLoadHook;
    if (callback != NULL) {
      (*callback)(env->jvmti_external(), jni_env,
                  jem.class_being_redefined(),
                  jem.jloader(), jem.class_name(),
                  jem.protection_domain(),
                  _curr_len, _curr_data,
                  &new_len, &new_data);
    }
    if (new_data != NULL) {
      // this agent has modified class data.
      if (caching_needed && *_cached_class_file_ptr == NULL) {
        // data has been changed by the new retransformable agent
        // and it hasn't already been cached, cache it
        JvmtiCachedClassFileData *p;
        p = (JvmtiCachedClassFileData *)os::malloc(
          offset_of(JvmtiCachedClassFileData, data) + _curr_len, mtInternal);
        if (p == NULL) {
          vm_exit_out_of_memory(offset_of(JvmtiCachedClassFileData, data) + _curr_len,
            OOM_MALLOC_ERROR,
            "unable to allocate cached copy of original class bytes");
        }
        p->length = _curr_len;
        memcpy(p->data, _curr_data, _curr_len);
        *_cached_class_file_ptr = p;
      }

      if (_curr_data != *_data_ptr) {
        // curr_data is previous agent modified class data.
        // And this has been changed by the new agent so
        // we can delete it now.
        _curr_env->Deallocate(_curr_data);
      }

      // Class file data has changed by the current agent.
      _curr_data = new_data;
      _curr_len = new_len;
      // Save the current agent env we need this to deallocate the
      // memory allocated by this agent.
      _curr_env = env;
    }
  }
  /*......*/
};

// this entry is for class file load hook on class load, redefine and retransform
void JvmtiExport::post_class_file_load_hook(Symbol* h_name,
                                            Handle class_loader,
                                            Handle h_protection_domain,
                                            unsigned char **data_ptr,
                                            unsigned char **end_ptr,
                                            JvmtiCachedClassFileData **cache_ptr) {
  JvmtiClassFileLoadHookPoster poster(h_name, class_loader,
                                      h_protection_domain,
                                      data_ptr, end_ptr,
                                      cache_ptr);
  poster.post();
}

frida-server -l 0.0.0.0:27042

pip install frida-tools

frida-ps -H 192.168.12.1

frida -H 192.168.12.1 -f /bin/java -- -agentpath:./xxxxx.so  -jar /xxxxxx.jar

[Remote::java ]-> %help
Available commands:
  %resume(0) - resume execution of the spawned process
  %load(1) - Load an additional script and reload the current REPL state
  %reload(0) - reload (i.e. rerun) the script that was given as an argument to the REPL
  %unload(0) - no description
  %autoperform(1) - receive on/off as first and only argument, when switched on will wrap any REPL code with Java.performNow()
  %autoreload(1) - disable or enable auto reloading of script files
  %exec(1) - execute the given file path in the context of the currently loaded scripts
  %time(1+) - measure the execution time of the given expression and print it to the screen
  %help(0) - print a list of available REPL commands

Module.enumerateExports("libjava.so", {
    onMatch: function(exp) {
        console.log("Exported function: " + exp.name + " | Address: " + exp.address);
    },
    onComplete: function() {
        console.log("Finished enumerating exports.");
    }
});

void *dlopen(const char *filename, int flags);

args[0].readCString();

// HOOK模块加载
const moduleName = "libjvm.so"; // JVM模块
var dlopen = Module.findExportByName(null, "dlopen"); //查找dlopen函数的地址
if(dlopen != null){
    // 使用Interceptor来对dlopen函数进行拦截
    Interceptor.attach(dlopen,{
        // 当dlopen函数被调用时触发 这时模块还没有被加载
        onEnter: function(args){
            // 读取第一个参数，即加载的模块名称 *filename
            var soName = args[0].readCString();
            console.log(soName);
            // 检查模块名称是否包含目标模块名
            if(soName.indexOf(moduleName) != -1){
                this.hook = true;// 标记已找到目标模块
            }
        },
        // 当dlopen函数执行完返回时触发 也就是模块加载完成后
        onLeave: function(retval){
            if(this.hook){
                hookFunction();// 执行我们的HOOK函数
            }
        }
    });
}

const moduleName = "libjvm.so";
const functionOffset = 0x7A5C60; // 函数的实际偏移量
    const baseAddress = Module.findBaseAddress(moduleName);
    if (baseAddress === null) {
        console.log("Module not found: " + moduleName);
        return;
    }
const targetAddress = baseAddress.add(functionOffset);

static void post_class_file_load_hook(Symbol* h_name, Handle class_loader,
                                      Handle h_protection_domain,
                                      unsigned char **data_ptr, unsigned char **end_ptr,
                                      JvmtiCachedClassFileData **cache_ptr) NOT_JVMTI_RETURN;

class SymbolBase : public MetaspaceObj {
 public:
  ATOMIC_SHORT_PAIR(
    volatile short _refcount,  // needs atomic operation
    unsigned short _length     // number of UTF8 characters in the symbol (does not need atomic op)
  );
  int            _identity_hash;
};

class Symbol : private SymbolBase {
  friend class VMStructs;
  friend class SymbolTable;
  friend class MoveSymbols;
 private:
  jbyte _body[1];
  .....
}

| _refcount (2 bytes) | _length (2 bytes) | _identity_hash (4 bytes) | _body[1] (variable length) |

function getSymbolString(symbolAddr) {
    // 读取 Symbol 的 _length 字段，它是一个 unsigned short 类型（2 字节）
    const length = ptr(symbolAddr).add(2).readU16();
    // 读取 _body 数组的首地址，从它开始读取 _length 长度的字节数据
    const symbolBodyAddr = ptr(symbolAddr).add(8); // _body 的起始偏移是 8 字节
    // 使用 readByteArray 读取字节，再将其转换为 UTF-8 字符串
    const byteArray = symbolBodyAddr.readByteArray(length);
    const str = Memory.readUtf8String(byteArray, length);
    return str;
}

this.ptrAddress = args[3];
this.endPtrAddress = args[4];

const ptr = this.ptrAddress.readPointer();
const endPtr = this.endPtrAddress.readPointer();

function hookFunction() {
    const baseAddress = Module.findBaseAddress(moduleName);
    if (baseAddress === null) {
        console.log("Module not found: " + moduleName);
        return;
    }
    const targetAddress = baseAddress.add(functionOffset);
    console.log("Hooking function at: " + targetAddress);
    //JvmtiExport::post_class_file_load_hook(name, class_loader(), protection_domain, &ptr, &end_ptr, &cached_class_file);
    Interceptor.attach(targetAddress, {
        onEnter: function(args) 
            this.ptrAddress = args[3];
            this.endPtrAddress = args[4];
            this.name = getSymbolString(args[0]);  //偏移量8处存储字符串内容
        },
        onLeave: function(retval) {
            console.log("Entering JvmtiExport::post_class_file_load_hook");
            console.log("name: " + this.name  );
            //读取ptr和end_ptr的值
            const ptr = this.ptrAddress.readPointer();
            const endPtr = this.endPtrAddress.readPointer();
            // 计算读取范围
            const length = endPtr.sub(ptr).toInt32();
            //>0
            if (length > 0) {
                // 读取 ptr 到 end_ptr 范围内的数据
                const data = ptr.readByteArray(length);
                const dumpPath = "/tmp/"+this.name.replaceAll("/",".") +".class";
                const file = new File(dumpPath, "wb");
                file.write(data);
                console.log("Dump file saved to: " + dumpPath);
                file.flush();
                file.close();
            } else {
                console.log('Invalid memory range to dump.');
            }
    
        }
    });

frida -H 192.168.12.1 -l hook.js -f /bin/java -- -agentpath:./xxxxx.so  -jar /xxxxxx.jar