安卓逆向 某开门软件签名算法、蓝牙开门、密码开门分析

 复制代码 隐藏代码/*   Android SSL Re-pinning frida script v0.2 030417-pier$ adb push burpca-cert-der.crt /data/local/tmp/cert-der.crt   $ frida -U -f it.app.mobile -l frida-android-repinning.js --no-pausehttps://techblog.mediaservice.net/2017/07/universal-android-ssl-pinning-bypass-with-frida/   UPDATE 20191605: Fixed undeclared var. Thanks to @oleavr and @ehsanpc9999 !*/setTimeout(function () {  Java.perform(function () {    console.log("");    console.log("[.] Cert Pinning Bypass/Re-Pinning");    var CertificateFactory = Java.use("java.security.cert.CertificateFactory");    var FileInputStream = Java.use("java.io.FileInputStream");    var BufferedInputStream = Java.use("java.io.BufferedInputStream");    var X509Certificate = Java.use("java.security.cert.X509Certificate");    var KeyStore = Java.use("java.security.KeyStore");    var TrustManagerFactory = Java.use("javax.net.ssl.TrustManagerFactory");    var SSLContext = Java.use("javax.net.ssl.SSLContext");    // Load CAs from an InputStream    console.log("[+] Loading our CA...");    var cf = CertificateFactory.getInstance("X.509");    try {      var fileInputStream = FileInputStream.$new(        "/data/local/tmp/cert-der.crt"      );    } catch (err) {      console.log("[o] " + err);    }    var bufferedInputStream = BufferedInputStream.$new(fileInputStream);    var ca = cf.generateCertificate(bufferedInputStream);    bufferedInputStream.close();    var certInfo = Java.cast(ca, X509Certificate);    console.log("[o] Our CA Info: " + certInfo.getSubjectDN());    // Create a KeyStore containing our trusted CAs    console.log("[+] Creating a KeyStore for our CA...");    var keyStoreType = KeyStore.getDefaultType();    var keyStore = KeyStore.getInstance(keyStoreType);    keyStore.load(null, null);    keyStore.setCertificateEntry("ca", ca);    // Create a TrustManager that trusts the CAs in our KeyStore    console.log(      "[+] Creating a TrustManager that trusts the CA in our KeyStore..."    );    var tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();    var tmf = TrustManagerFactory.getInstance(tmfAlgorithm);    tmf.init(keyStore);    console.log("[+] Our TrustManager is ready...");    console.log("[+] Hijacking SSLContext methods now...");    console.log("[-] Waiting for the app to invoke SSLContext.init()...");    SSLContext.init.overload(      "[Ljavax.net.ssl.KeyManager;",      "[Ljavax.net.ssl.TrustManager;",      "java.security.SecureRandom"    ).implementation = function (a, b, c) {      console.log("[o] App invoked javax.net.ssl.SSLContext.init...");      SSLContext.init        .overload(          "[Ljavax.net.ssl.KeyManager;",          "[Ljavax.net.ssl.TrustManager;",          "java.security.SecureRandom"        )        .call(this, a, tmf.getTrustManagers(), c);      console.log("[+] SSLContext initialized with our custom TrustManager!");    };}, 0);var libflutter = null;function onLibFlutterLoaded() {  const ssl_pinning_addr = 0x3e0f74;  Interceptor.attach(libflutter.add(ssl_pinning_addr), {    onEnter: function (args) {      console.log("Disabling SSL validation");    },    onLeave: function (retval) {      console.log("Retval: " + retval);      retval.replace(0x1);    },  });}function tryLoadLibFlutter() {  libflutter = Module.findBaseAddress("libflutter.so");  if (libflutter === null) setTimeout(tryLoadLibFlutter, 500);  else onLibFlutterLoaded();}tryLoadLibFlutter();

{  "mobile": "" // 手机号}

{  "smsCode": "", // 验证码  "mobile": "", // 加密手机号  "sign": "", // 签名  "version": "4.9.9", // 软件版本  "nonce": "", // 随机数  "appChannel": 1, // 未知 软件渠道?  "timestamp": 0 // 时间戳}

{  "method": "checkLogin", // 调用方法  "sign": "", // 签名  "version": "4.9.9", // 软件版本  "nonce": "0", // 随机数  "timestamp": 0 // 时间戳}

function functionCallLog(  address,  argsLength = 1,  func_name = "") {  Interceptor.attach(libapp.add(address), {    onEnter: function () {      init(this.context);      for (let i = 0; i < argsLength; i++) {        try {          const arg = getArg(this.context, i);          const [tptr, cls, values] = getTaggedObjectValue(arg);          this.info = this.info || [];          this.info.push(            `(${i}) ${cls.name}@${tptr.toString().slice(2)} = ${JSON.stringify(              values,              null,              2            )}`          );        } catch (e) {          this.info = this.info || [];          this.info.push(`(${i}) ${e}`);        }      }    },    onLeave: function (result) {      if (this.skip) {        return;      }      const [tptr, cls, values] = getTaggedObjectValue(result);      var stamp = new Date().getTime() + 8 * 60 * 60 * 1000;      var beijingTime = new Date(stamp).toISOString();      let debug_info = [        `Time: ${beijingTime}`,        `Function name: ${func_name || "unknown"}`,        `Function ptr: 0x${address.toString(16)}`,        `Args:`,        this.info.join("n"),        `Return:`,        `${cls.name}@${tptr.toString().slice(2)} = ${JSON.stringify(values, null, 2)}`,        "RegisterNatives called from:n" +          Thread.backtrace(this.context, Backtracer.ACCURATE)            .map(DebugSymbol.fromAddress)            .join("n")      ];      console.log("");      console.log("==========================");      console.log(debug_info.join("n"));      console.log("==========================");      console.log("");    },  });}

function onLibappLoaded() {    functionCallLog(0x65fce0, 1, "QappEncrypt::md5Encrypt");    functionCallLog(0xc52af0, 2, "Encryption::getHeaderSign");}