ill intentions

Android逆向解题-[ill-intentions]

objection -g com.example.hellojni explore
android hooking list activities

看一下有什么Activities：

com.example.application.DefinitelyNotThisOne
com.example.application.IsThisTheRealOne
com.example.application.MainActivity
com.example.application.ThisIsTheRealOne

强制开启一个Activity：

android intent launch_activity com.example.application.ThisIsTheRealOne

里面调用了orThat方法。

android hooking watch class_method com.example.application.ThisIsTheRealOne.orThat --dump-args --dump-backtrace --dump-return

点击一下按钮，调用函数：

com.example.hellojni on (google: 13) [usb] # android hooking watch class_method com.example.application.ThisIs
TheRealOne.orThat --dump-args --dump-backtrace --dump-return
(agent) Attempting to watch class com.example.application.ThisIsTheRealOne and method orThat.
(agent) Hooking com.example.application.ThisIsTheRealOne.orThat(java.lang.String, java.lang.String, java.lang.String)
(agent) Registering job 317785. Type: watch-method for: com.example.application.ThisIsTheRealOne.orThat
com.example.hellojni on (google: 13) [usb] # (agent) [317785] Called com.example.application.ThisIsTheRealOne.orThat(java.lang.String, java.lang.String, java.lang.String)
(agent) [317785] Backtrace:
        com.example.application.ThisIsTheRealOne.orThat(Native Method)
        com.example.application.ThisIsTheRealOne$1.onClick(ThisIsTheRealOne.java:31)
        android.view.View.performClick(View.java:7506)
        android.view.View.performClickInternal(View.java:7483)
        android.view.View.-$$Nest$mperformClickInternal(Unknown Source:0)
        android.view.View$PerformClick.run(View.java:29341)
        android.os.Handler.handleCallback(Handler.java:942)
        android.os.Handler.dispatchMessage(Handler.java:99)
        android.os.Looper.loopOnce(Looper.java:201)
        android.os.Looper.loop(Looper.java:288)
        android.app.ActivityThread.main(ActivityThread.java:7872)
        java.lang.reflect.Method.invoke(Native Method)
        com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548)
        com.android.internal.os.ZygoteInit.main(ZygoteInit.java:936)

(agent) [317785] Arguments com.example.application.ThisIsTheRealOne.orThat(IIjsWa}iyYSmks, ODBkNTNhZjRmMGZmMWYtMzhhMDIzMmMwYjcwNzlhMTUwMDczOWNlYjhjMhUWYWYeMzYiZDFkMTY?
, MhMhMGJhMTUhOGYWZThlZDQaYWJkYzkWZTktMTQhMjYhOTgiOTZkODgaNWRkZmFiZTciOGNlNDI?
)
(agent) [317785] Return Value: KeepTryingThisIsNotTheActivityYouAreLookingForButHereHaveSomeInternetPoints!

不是这个Activity，因此换一个。

android intent launch_activity com.example.application.IsThisTheRealOne
android hooking watch class_method com.example.application.IsThisTheRealOne.orThat --dump-args --dump-backtrace --dump-return

得到：

(agent) Registering job 208845. Type: watch-method for: com.example.application.IsThisTheRealOne.orThat
com.example.hellojni on (google: 13) [usb] # android hooking watch class_method com.example.application.IsThis
TheRealOne.perhapsThis --dump-args --dump-backtrace --dump-return
(agent) Attempting to watch class com.example.application.IsThisTheRealOne and method perhapsThis.
(agent) Hooking com.example.application.IsThisTheRealOne.perhapsThis(java.lang.String, java.lang.String, java.lang.String)
(agent) Registering job 771144. Type: watch-method for: com.example.application.IsThisTheRealOne.perhapsThis
com.example.hellojni on (google: 13) [usb] # (agent) [771144] Called com.example.application.IsThisTheRealOne.perhapsThis(java.lang.String, java.lang.String, java.lang.String)
(agent) [771144] Backtrace:
        com.example.application.IsThisTheRealOne.perhapsThis(Native Method)
        com.example.application.IsThisTheRealOne$1.onClick(IsThisTheRealOne.java:33)
        android.view.View.performClick(View.java:7506)
        android.view.View.performClickInternal(View.java:7483)
        android.view.View.-$$Nest$mperformClickInternal(Unknown Source:0)
        android.view.View$PerformClick.run(View.java:29341)
        android.os.Handler.handleCallback(Handler.java:942)
        android.os.Handler.dispatchMessage(Handler.java:99)
        android.os.Looper.loopOnce(Looper.java:201)
        android.os.Looper.loop(Looper.java:288)
        android.app.ActivityThread.main(ActivityThread.java:7872)
        java.lang.reflect.Method.invoke(Native Method)
        com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548)
        com.android.internal.os.ZygoteInit.main(ZygoteInit.java:936)

(agent) [771144] Arguments com.example.application.IsThisTheRealOne.perhapsThis(TRytfrgooq|F{i-JovFBungFk\VlphgQbwvj~HuDgaeTzuSt.@Lex^~, ZGFkNGIwYzIWYjEzMTUWNjVjNTVlNjZhOGJkNhYtODIyOGEaMTMWNmQaOTVjZjkhMzRjYmUzZGE?
, MzQxZTZmZjAxMmIiMWUzNjUxMmRiYjIxNDUwYTUxMWItZGQzNWUtMzkyOWYyMmQeYjZmMzEaNDQ?
)
(agent) [771144] Return Value: Congratulation!YouFoundTheRightActivityHereYouGo-CTF{IDontHaveABadjokeSorry}

参考

ill-intentions - hktk1643 - 博客园 (cnblogs.com)

• 本文作者： Taardis
• 本文链接： https://taardisaa.github.io/2023/09/07/Android逆向解题-ill-intentions/
• 版权声明： 本博客所有文章除特别声明外，均采用 Apache License 2.0 许可协议。转载请注明出处！