hookinunidbg

Android逆向-例子hookinunidbg

下载地址

【转载】unidbg hook 使用大全 - qinless

链接：https://pan.baidu.com/s/1ZRPtQrx4QAPEQhrpq6gbgg 提取码：6666

Java层

package com.example.hookinunidbg;

import android.os.Bundle;
import android.util.Log;
import android.view.View;
import android.widget.Button;
import android.widget.TextView;
import androidx.appcompat.app.AppCompatActivity;
import com.example.hookinunidbg.databinding.ActivityMainBinding;

/* loaded from: classes4.dex */
public class MainActivity extends AppCompatActivity {
    private ActivityMainBinding binding;

    public native void call();

    static {
        System.loadLibrary("hookinunidbg");
    }

    /* JADX INFO: Access modifiers changed from: protected */
    @Override // androidx.fragment.app.FragmentActivity, androidx.activity.ComponentActivity, androidx.core.app.ComponentActivity, android.app.Activity
    public void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        ActivityMainBinding inflate = ActivityMainBinding.inflate(getLayoutInflater());
        this.binding = inflate;
        setContentView(inflate.getRoot());
        TextView tv = this.binding.sampleText;
        tv.setText("hello ");
        Button button = (Button) findViewById(R.id.button);
        button.setOnClickListener(new View.OnClickListener() { // from class: com.example.hookinunidbg.MainActivity.1
            @Override // android.view.View.OnClickListener
            public void onClick(View view) {
                Log.i("lilac", "call functions");
                MainActivity.this.call();
            }
        });
    }
}

比较简单，主要就是调用了hookinunidbg.so里面导出的call方法。

Native

Java_com_example_hookinunidbg_MainActivity_call

int Java_com_example_hookinunidbg_MainActivity_call()
{
  int v0; // r0

  if ( j_verifyApkSign() == 1 )
    v0 = _android_log_print(6, "Lilac", "APK sign verify failed!");
  else
    v0 = _android_log_print(6, "Lilac", "APK sign verify success!");
  return j_testBase64(v0);
}

调用了这个verifyApkSign函数，但是这个函数恒定会返回1，导致这个call方法绝对会返回“验证错误”。

testBase64

int testBase64()
{
  void *v0; // r0

  v0 = malloc(9u);
  return j_base64_encode("lilac", 5, v0);
}

verifyApkSign

int verifyApkSign()
{
  _android_log_print(6, "Lilac", "verify apk sign");
  return 1;
}

.init_proc

base64_encode

int __fastcall base64_encode(_BYTE *in, unsigned int len, _BYTE *out)
{
  int v3; // r2
  int v4; // r2
  int v5; // r2
  int v6; // r1
  int v7; // r1
  unsigned __int8 v9; // [sp+12h] [bp-26h]
  unsigned __int8 v10; // [sp+13h] [bp-25h]
  unsigned int i; // [sp+14h] [bp-24h]
  int v12; // [sp+18h] [bp-20h]
  int v14; // [sp+28h] [bp-10h]

  v12 = 0;
  v9 = 0;
  v14 = 0;
  for ( i = 0; i < len; ++i )
  {
    v10 = in[i];
    if ( v12 )
    {
      if ( v12 == 1 )
      {
        v12 = 2;
        v4 = v14++;
        out[v4] = byte_2A71[(16 * (v9 & 3)) | (v10 >> 4)];
      }
      else
      {
        v12 = 0;
        out[v14] = byte_2A71[(4 * (v9 & 0xF)) | (v10 >> 6)];
        v5 = v14 + 1;
        v14 += 2;
        out[v5] = byte_2A71[v10 & 0x3F];
      }
    }
    else
    {
      v12 = 1;
      v3 = v14++;
      out[v3] = byte_2A71[v10 >> 2];
    }
    v9 = v10;
  }
  if ( v12 == 1 )
  {
    out[v14] = byte_2A71[16 * (v9 & 3)];
    out[v14 + 1] = 61;
    v6 = v14 + 2;
    v14 += 3;
    out[v6] = 61;
  }
  else if ( v12 == 2 )
  {
    out[v14] = byte_2A71[4 * (v9 & 0xF)];
    v7 = v14 + 1;
    v14 += 2;
    out[v7] = 61;
  }
  out[v14] = 0;
  return v14;
}

base64_decode

目标建立

总体目标就是尽量把Frida+Unidbg的大部分知识都用上来。

参考

【转载】unidbg hook 使用大全 - qinless

• 本文作者： Taardis
• 本文链接： https://taardisaa.github.io/2023/09/05/Android逆向-例子hookinunidbg/
• 版权声明： 本博客所有文章除特别声明外，均采用 Apache License 2.0 许可协议。转载请注明出处！