NSSCTF三周年Mobile题

思路

解题步骤

能正常运行APP解题步骤

function antiFrida() {
 var memcmp_addr = Module.findExportByName("libc.so", "fread");
 if (memcmp_addr !== null) {
 Interceptor.attach(memcmp_addr, {
 onEnter: function (args) {
 this.buffer = args[0];
 this.size = args[1];
 this.count = args[2]; 
 this.stream = args[3]; 
 },
 onLeave: function (retval) {
 if (this.count.toInt32() == 8) {
 Memory.writeByteArray(this.buffer, [0x50, 0x00, 0x00, 0x58, 0x00, 0x02, 0x1f, 0xd6]);
 retval.replace(8);
 }
 }
 });
 } else {
 console.error("Error: memcmp function not found in libc.so");
 }
}
function hook_RegisterNatives() {
 antiFrida();
 var symbols = Module.enumerateSymbolsSync("libart.so");
 var addrRegisterNatives = null;
 for (var i = 0; i < symbols.length; i++) {
 var symbol = symbols[i];
 //_ZN3art3JNI15RegisterNativesEP7_JNIEnvP7_jclassPK15JNINativeMethodi
 if (symbol.name.indexOf("art") >= 0 &&
 symbol.name.indexOf("JNI") >= 0 &&
 symbol.name.indexOf("RegisterNatives") >= 0 &&
 symbol.name.indexOf("CheckJNI") < 0) {
 addrRegisterNatives = symbol.address;
 console.log("RegisterNatives is at ", symbol.address, symbol.name);
 }
 }
 if (addrRegisterNatives != null) {
 Interceptor.attach(addrRegisterNatives, {
 onEnter: function (args) {
 console.log("[RegisterNatives] method_count:", args[3]);
 var env = args[0];
 var java_class = args[1];
 var class_name = Java.vm.tryGetEnv().getClassName(java_class);
 //console.log(class_name);
 var methods_ptr = ptr(args[2]);
 var method_count = parseInt(args[3]);
 for (var i = 0; i < method_count; i++) {
 var name_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3));
 var sig_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize));
 var fnPtr_ptr = Memory.readPointer(methods_ptr.add(i * Process.pointerSize * 3 + Process.pointerSize * 2));
 var name = Memory.readCString(name_ptr);
 var sig = Memory.readCString(sig_ptr);
 var find_module = Process.findModuleByAddress(fnPtr_ptr);
 console.log("[RegisterNatives] java_class:", class_name, "name:", name, "sig:", sig, "fnPtr:", fnPtr_ptr, "module_name:", find_module.name, "module_base:", find_module.base, "offset:", ptr(fnPtr_ptr).sub(find_module.base));
 if (class_name.indexOf("MainActivity") != -1) {
 dump_so("libezezez83.so");
 }
 }
 }
 });
 }
}
function dump_so(so_name) {
 var libso = Process.getModuleByName(so_name);
 console.log("[name]:", libso.name);
 console.log("[base]:", libso.base);
 console.log("[size]:", ptr(libso.size));
 console.log("[path]:", libso.path);
 var file_path = "/data/data/com.swdd.ezezez/" + libso.name + "_" + libso.base + "_" + ptr(libso.size) + ".so";
 var file_handle = new File(file_path, "wb");
 if (file_handle && file_handle != null) {
 Memory.protect(ptr(libso.base), libso.size, 'rwx');
 var libso_buffer = ptr(libso.base).readByteArray(libso.size);
 file_handle.write(libso_buffer);
 file_handle.flush();
 file_handle.close();
 console.log("[dump]:", file_path);
 }
}
setImmediate(hook_RegisterNatives);

无法正常运行APP解题步骤

EXP

总结