Android逆向解题-sec2023安卓赛题

字数统计: 12.8k字   |   阅读时长≈ 69分

sec2023安卓赛题

Android逆向解题-sec2023安卓赛题

项目

下载链接

APK分析

入口点

1
"com.unity3d.player.UnityPlayerActivity"

包名

1
"com.com.sec2023.rocketmouse.mouse"

是一个游戏，发现是Unity制作的。

看一下lib，发现libil2cpp.so，libmain.so等so。

Native分析

libmain.so

Unity的加载il2cpp的逻辑。不重要。

1
2
3
4
5
6
7
8
9
10
11
12
13
jint JNI_OnLoad(JavaVM *vm, void *reserved)
{
  __int64 v2; // x0
  JNIEnv *env; // [xsp+8h] [xbp-8h] BYREF

  env = 0LL;
  (*vm)->AttachCurrentThread(vm, &env, 0LL);
  v2 = (__int64)(*env)->FindClass(env, "com/unity3d/player/NativeLoader");
  if ( (((__int64 (__fastcall *)(JNIEnv *, __int64, void **, __int64))(*env)->RegisterNatives)(env, v2, &off_3000, 2LL) & 0x80000000) == 0 )
    return 65542;
  (*env)->FatalError(env, "com/unity3d/player/NativeLoader");
  return -1;
}

libil2cpp.so

Unity C#编译成C++Native后生成的so文件。需要用il2CppDumper等其他方式恢复。

libsec2023.so

需要重点分析。

libunity.so

绝对是Unity引擎文件。不管了。

Root下启动APP⭐

经过多次尝试，发现使用Magisk Delta最好，开启MaigskHide后可以隐藏root，规避APP的安全检查，成功启动程序。否则每次都会出现hack detected，然后自动退出。

由于开启MagiskHide后无法使用Frida，因此最后具体使用的方法请参考Frida过调试部分。

解密libil2cpp.so

直接打开libil2cpp.so，发现有严重混淆，判断是加密了。

因此尝试通过内存Dump或者其他方式来解密。

尝试il2CppDumper静态（失败）

Release Il2CppDumper v6.7.40 · Perfare/Il2CppDumper (github.com)

然后提示程序加密了：

1
2
3
4
5
6
7
8
9
10
11
12
13
Initializing metadata...
Metadata Version: 29
Initializing il2cpp file...
Applying relocations...
WARNING: find .init_proc
ERROR: This file may be protected.
Il2Cpp Version: 29
Searching...
CodeRegistration : 0
MetadataRegistration : 0
ERROR: No symbol is detected
ERROR: Can't use auto mode to process file, try manual mode.
Input CodeRegistration:

继续查一下，这个Input CodeResigstration是什么玩意：

[Tutorial] Il2CppDumper tutorial finding CodeRegistration and MetadataRegistration (unknowncheats.me)

这一块先等一等，太复杂了。

检查global-metadata.dat，没有加密。

反编译libil2cpp.so，发现加密了。

GG+il2CppDumper

用GG dump内存中的libil2cpp.so

首先安装GameGuardian

GameGuardian - Official Downloads - GameGuardian

Forums - GameGuardian

然后dump内存中的libil2cpp.so部分。具体而言的操作方法：

右上角打开设置，选择导出内存

选择内存范围起始和结尾：

开始从红色的Xa:.....libil2cpp.so

结尾到绿色的Cd:.....libil2cpp.so（最后一个，后面就是其他东西了）

这样把包含libil2cpp.so的内存块给dump下来。

然后使用最新的il2cppdumper（版本v6.7.40）（2023-10-11）

必须版本要高，否则可能没法读取dump文件，或者还必须要你的global-metadata.dat文件也是从内存里dump出来的，因为要你输入.dat文件在内存的基址。高版本的工具就不需要了。

Release Il2CppDumper v6.7.40 · Perfare/Il2CppDumper (github.com)

然后选择dump下来的内存bin文件，以及解包得到的global-metadata.dat文件（这个因为没有加密过，所以直接用）

检测到是内存dump后，输入dump下来文件的起始基址，然后就会自动恢复了。

成功拿到

1
2
3
4
5
DummyDll
dump.cs
il2cpp.h
script.json
stringliteral.json

修补libil2cpp.so

dump下来的.so和普通的so是有一定区别的，所以要修补。将dump下来的与静态解包后得到的.so的结构体进行比较（使用010Editor的ELF.bt辅助解析文件结构），发现：

  1. dump中丢失了dynamic_symbol_table
  2. dump中的section_header_table被空字节填充了
  3. dump中的program_header_table和静态解包的so是一样的，但是由于dump后的文件结构实际上有所变化，和静态的不一样，所以需要对dump的进行patch。

具体的东西放在blog”Linux-ELF文件结构”里面。

IDA中获取符号表

ida_with_struct.py

For IDA, read il2cpp.h file and apply structure information in IDA

将修补好的dump文件用IDA打开，然后选择il2cppdumper里面的ida_with_struct_py3.py，然后将上次提取出来的script.json和il2cpp.h选中。

经过漫长的等待，第一次脚本跑完，不少Unity函数和结构体都被注释好了。

在运行一次脚本，选中scriptliteral.json和il2cpp.h。

Frida dump libil2cpp.so

Frida过调试⭐

直接打开都被check了。这是真不知道为什么，难道是查到我的root环境了嘛

绕过frida-server与端口检查，但还是被check。

用下面的脚本Hook AlertDialog：

1
2
3
4
5
6
7
8
9
Java.perform(
    function() {
        var Sec2023MsgBox = Java.use("com.tencent.games.sec2023.Sec2023MsgBox");
        Sec2023MsgBox["show"].implementation = function (str) {
            console.log(`Sec2023MsgBox.show is called: str=${str}`);
            this["show"](str);
        };
    }
);

看到：

1
Sec2023MsgBox.show is called: str=hack detected
歪方法
  1. 首先在Magisk Delta下，MagiskHide开启，隐藏root权限，然后打开APP
  2. 然后关闭MagiskHide（因为Magisk Delta的MagiskHide是基于ptrace的，和frida冲突），再用adb shell启动frida-server，以防万一换一个端口
  3. 再去frida去Hook即可
1
frida -H 127.0.0.1:11451 -F -l .\hook_sec2023.js
持续性绕过（不懂原理）

根据另一个师傅的描述，通过Hook神秘Sleep函数似乎就能过反调试？搞不明白

后来发现 hook libsec2023.so 会弹窗,但是有一定延时才会弹出来,猜测调用 sleep, 尝试 hook 一下 sleep 发现真的不弹了。

[原创]2023腾讯游戏安全竞赛初赛题解(安卓)-Android安全-看雪-安全社区|安全招聘|kanxue.com

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
function AntiDebug()
{
    var sleep_addr = Module.findExportByName(null, "sleep");
    var sleep = new NativeFunction(sleep_addr, "void",["int"]);
    Interceptor.attach(sleep,
    {
        onEnter: function (args)
        {
            args[0] = ptr(1000000);
            console.log("hooked sleep");
            console.log('sleep called from:\n' + Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n') + '\n');
        },
        onLeave: function (returnValue)
        {
        }
    })
}
AntiDebug();

原来是通过延长Sleep的时间来预留足够长的时间进行调试。

不过可以比较确定的是，反调试+反Frida逻辑都是在libsec2023.so里面实现的。

我编写一个脚本：

1
2
let sec2023 = Module.findBaseAddress("libsec2023.so");
console.log(`sec2023:${sec2023}`);

很快啊，就触发了反调试逻辑。

1
2
3
4
5
6
7
8
9
hooked sleep
sleep called from:
0x74d9e7c43c libsec2023.so!0x3643c
0x74d9e7c340 libsec2023.so!0x36340
0x74d9e57f44 libsec2023.so!0x11f44
0x77f6807914 libc.so!_ZL15__pthread_startPv+0x10c
0x77f67a73f4 libc.so!__start_thread+0x44

sec2023:0x74d9e46000
反调试检测点

现在分析可以推测出的反调试检查点：

  1. 检查su
  2. 检查frida固定端口
  3. 疑似为启动时一次性检查，没有持续性检查
  4. 一次成功后便永久记录（后面无论几次重启APP，只要第一次成功过，后面都能持久保留；失败亦是如此；除非重启手机）
  5. 只要用Module.findBaseAddress函数寻找此lib，就会触发反调试检查

Dump

[原创]细品sec2023安卓赛题-Android安全-看雪-安全社区|安全招聘|kanxue.com

这位师傅过反调试似乎比我要轻松很多，单纯绕了个端口就搞定了，可能是su等已经被完美隐藏了吧。

于是乎就有下面的dump脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
function dump_so(so_name) {
    Java.perform(function () {
        var currentApplication = Java.use("android.app.ActivityThread").currentApplication();
        var dir = currentApplication.getApplicationContext().getFilesDir().getPath();
        var libso = Process.getModuleByName(so_name);
        console.log("[name]:", libso.name);
        console.log("[base]:", libso.base);
        console.log("[size]:", ptr(libso.size));
        console.log("[path]:", libso.path);
        var file_path = dir + "/" + libso.name + "_" + libso.base + "_" + ptr(libso.size) + ".so";
        var file_handle = new File(file_path, "wb");
         
        if (file_handle && file_handle != null) {
            Memory.protect(ptr(libso.base), libso.size, 'rwx');
            //如果报错为Error: access violation accessing,那么可以尝试添加下面的这一行代码,libso.base加上的值是通过address(access violation accessing)-address(base)计算出来的
            //Memory.protect(ptr(libso.base.add(0x13b7000)), libso.size-0x13b7000, 'rwx');
            var libso_buffer = ptr(libso.base).readByteArray(libso.size);
            file_handle.write(libso_buffer);
            file_handle.flush();
            file_handle.close();
            console.log("[dump]:", file_path);
        }
    });
}
dump_so("libil2cpp.so");

得到：

1
2
3
4
5
[name]: libil2cpp.so
[base]: 0x74d2e25000
[size]: 0x13cc000
[path]: /data/app/~~Jg6XwMivJ3-lel4mUyiaOg==/com.com.sec2023.rocketmouse.mouse-hL-hWNjinkQzpvTLXDEX3Q==/lib/arm64/libil2cpp.so       
[dump]: /data/user/0/com.com.sec2023.rocketmouse.mouse/files/libil2cpp.so_0x74d2e25000_0x13cc000.so

修复libil2cpp.so

和上面用GG dump的一样。此言不表。

反-反调试

顺着刚刚通过Hook Sleep成功绕过反调试，并获得Stacktrace；来溯源分析一波。

不过由于刚刚一开始是先用歪方法绕过反调试的，然后再Attach上来的，因此后续的Sleep函数调用可能不是直接与反调试逻辑相关的。

我们需要重新启动程序，以Spawn方式来启动：

1
frida -H 127.0.0.1:11451 -f com.com.sec2023.rocketmouse.mouse  -l .\hook_sec2023.js

得到：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
hooked sleep
hooked sleep
sleep called from:
0x74cfc5e0a8 libsec2023.so!0x220a8
0x74cfc4df44 libsec2023.so!0x11f44
0x77f6807914 libc.so!_ZL15__pthread_startPv+0x10c
0x77f67a73f4 libc.so!__start_thread+0x44

sleep called from:
0x74cfc7243c libsec2023.so!0x3643c
0x74cfc72340 libsec2023.so!0x36340
0x74cfc4df44 libsec2023.so!0x11f44
0x77f6807914 libc.so!_ZL15__pthread_startPv+0x10c
0x77f67a73f4 libc.so!__start_thread+0x44

sub_11F24

Stacktrace中的0x11f44在这个函数里面：

1
2
3
4
5
6
7
8
9
__int64 __fastcall sub_11F24(_BYTE *a1)
{
  if ( a1 )
  {
    (*(void (__fastcall **)(_BYTE *))(*(_QWORD *)a1 + 16LL))(a1);
    a1[8] = 0;
  }
  return 0LL;
}

这里面全是间接调用，不是重点

sub_22080

0x220a8在这个函数里面。混淆严重。注意到以下函数：

1
2
3
4
5
LABEL_77:
    sub_21408(v21, 1LL, &byte_7468F);
    v3 = 0;
LABEL_4:
    v2 = sleep(2u);

sub_21408

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
__int64 __fastcall sub_21408(JNIEnv *a1, unsigned int a2, __int64 a3)
{
  JNIEnv *v3; // x19
  char v7; // w24
  __int64 v8; // x1
  __int64 result; // x0
  __int64 v10[2]; // [xsp+0h] [xbp-40h] BYREF

  v10[1] = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
  v3 = (JNIEnv *)*a1;
  v10[0] = 0LL;
  if ( !v3 )
    return 0xFFFFFFFFLL;
  if ( ((unsigned int (__fastcall *)(JNIEnv *, __int64 *, __int64))(*v3)->FindClass)(v3, v10, 65540LL) )	//
  {
    if ( !((unsigned int (__fastcall *)(JNIEnv *, __int64 *, _QWORD))(*v3)->GetVersion)(v3, v10, 0LL) )	//
    {
      v7 = 0;
      v8 = v10[0];
      if ( !v10[0] )
        goto LABEL_5;
LABEL_8:
      sub_21500(a1, v8, a2, a3);	// important
      result = 0LL;
      if ( (v7 & 1) != 0 )
        return result;
LABEL_9:
      result = ((__int64 (__fastcall *)(JNIEnv *))(*v3)->DefineClass)(v3);	// 
      if ( !(_DWORD)result )
        return result;
    }
    return 0xFFFFFFFFLL;
  }
  v7 = 1;
  v8 = v10[0];
  if ( v10[0] )
    goto LABEL_8;
LABEL_5:
  result = 0xFFFFFFFFLL;
  if ( (v7 & 1) == 0 )
    goto LABEL_9;
  return result;
}

sub_21500

太长了，直接看结尾：

1
2
3
4
5
6
7
8
LABEL_73:
  v113 = (*a2)->GetStaticMethodID(a2, v5, &byte_746C9, &byte_746AA);
  v114 = (*a2)->NewStringUTF(a2, a4);
  v115 = *(_QWORD *)(a1 + 8);
  v116 = v114;
  sub_21B10(a2, v115, v113, a3, v114);
  (*a2)->DeleteLocalRef(a2, v116);
  return 0LL;

sub_21B10

似乎是一个变参调用Java方法的玩意

1
2
3
4
5
6
7
8
9
10
11
12
13
__int64 sub_21B10(JNIEnv *a1, __int64 a2, __int64 a3, ...)
{
  void (*CallStaticVoidMethodV)(JNIEnv *, jclass, jmethodID, va_list); // x8
  __va_list_tag va1[1]; // [xsp+B0h] [xbp-60h] BYREF
  __va_list_tag va[1]; // [xsp+D8h] [xbp-38h] BYREF
  __int64 v7; // [xsp+F8h] [xbp-18h]

  va_start(va, a3);
  v7 = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
  CallStaticVoidMethodV = (*a1)->CallStaticVoidMethodV;
  va_copy(va1, va);
  return ((__int64 (__fastcall *)(JNIEnv *, __int64, __int64, __va_list_tag *))CallStaticVoidMethodV)(a1, a2, a3, va1);
}

总结

总体来说这个函数的执行逻辑：

  • FindClass
  • GetVersion
  • GetStaticMethodID
  • NewStringUTF
  • CallStaticVoidMethodV
  • DeleteLocalRef
  • DefineClass

种种迹象表明这个函数似乎主要是用于执行了一个Java方法。不过由于其他的混淆显然都是用于加密字符串等其他数据的，因此具体干了啥还是需要动调Hook。

sub_36340

0x36340

不知道干啥的

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
__int64 *__fastcall sub_36340(__int64 *a1, __int64 a2)
{
  void *v3; // x0
  __int64 v5; // x21
  __int64 v6; // x0
  __int64 i; // x8
  int v9; // [xsp+Ch] [xbp-14h] BYREF

  v3 = (void *)*a1;
  if ( v3 )
    sub_1D998(v3, a1[1] + 1);
  *a1 = 0LL;
  a1[1] = 0LL;
  if ( a2 )
  {
    v9 = 0xEECF7326;
    v5 = sub_3665C(&v9, a2, -1LL);
    v6 = sub_1CE70((int)v5 + 1);
    *a1 = v6;
    if ( v6 )
    {
      if ( v5 )
      {
        for ( i = 0LL; i != v5; ++i )
        {
          *(_BYTE *)(v6 + i) = *(_BYTE *)(a2 + i);
          v6 = *a1;
        }
      }
      *(_BYTE *)(v6 + v5) = 0;
      a1[1] = v5;
    }
  }
  return a1;
}

sub_363E0

0x3643c

1
2
3
4
5
6
7
8
void __fastcall sub_363E0(__int64 a1)
{
  __int64 v1; // [xsp+8h] [xbp-58h]

  v1 = a1 + 56;
  sleep(5u);
  __asm { BR              X8; Branch To Register }
}

继续尝试——主动触发反调试逻辑

将上面Hook Sleep脚本设计的时间变短一点（10s），看看会有哪些其他更多的地方会触发Sleep。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
hooked sleep
hooked sleep
sleep called from:
0x71359690a8 libsec2023.so!0x220a8
0x7135958f44 libsec2023.so!0x11f44
0x745bb37914 libc.so!_ZL15__pthread_startPv+0x10c
0x745bad73f4 libc.so!__start_thread+0x44

sleep called from:
0x713597d43c libsec2023.so!0x3643c
0x713597d340 libsec2023.so!0x36340
0x7135958f44 libsec2023.so!0x11f44
0x745bb37914 libc.so!_ZL15__pthread_startPv+0x10c
0x745bad73f4 libc.so!__start_thread+0x44

Sec2023IPC.onNativeEngineResponse is called: i=1, str=获得1000分，您将赢得比赛。
Sec2023IPC.nativeEngineResponseRunnable is called: i=1, str=获得1000分，您将赢得比赛。
Sec2023IPC.nativeEngineResponseRunnable result=[object Object]
hooked sleep
Sec2023MsgBox.show is called: str=获得1000分，您将赢得比赛。
sleep called from:
0x71359690dc libsec2023.so!0x220dc
0x7135958f44 libsec2023.so!0x11f44
0x745bb37914 libc.so!_ZL15__pthread_startPv+0x10c
0x745bad73f4 libc.so!__start_thread+0x44

hooked sleep
sleep called from:
0x713597d43c libsec2023.so!0x3643c
0x713597d340 libsec2023.so!0x36340
0x7135958f44 libsec2023.so!0x11f44
0x745bb37914 libc.so!_ZL15__pthread_startPv+0x10c
0x745bad73f4 libc.so!__start_thread+0x44

hooked sleep
sleep called from:
0x71359690dc libsec2023.so!0x220dc
0x7135958f44 libsec2023.so!0x11f44
0x745bb37914 libc.so!_ZL15__pthread_startPv+0x10c
0x745bad73f4 libc.so!__start_thread+0x44

hooked sleep
sleep called from:
0x713597d43c libsec2023.so!0x3643c
0x713597d340 libsec2023.so!0x36340
0x7135958f44 libsec2023.so!0x11f44
0x745bb37914 libc.so!_ZL15__pthread_startPv+0x10c
0x745bad73f4 libc.so!__start_thread+0x44

hooked sleep
sleep called from:
0x71359690dc libsec2023.so!0x220dc
0x7135958f44 libsec2023.so!0x11f44
0x745bb37914 libc.so!_ZL15__pthread_startPv+0x10c
0x745bad73f4 libc.so!__start_thread+0x44

hooked sleep
sleep called from:
0x713597d43c libsec2023.so!0x3643c
0x713597d340 libsec2023.so!0x36340
0x7135958f44 libsec2023.so!0x11f44
0x745bb37914 libc.so!_ZL15__pthread_startPv+0x10c
0x745bad73f4 libc.so!__start_thread+0x44

hook exit @ 0x745bb2c858
hook kill @ 0x745bb230f0
sec2023:0x7135947000
hook exit @ 0x745bb2c858
hook kill @ 0x745bb230f0
sec2023:0x7135947000
hooked sleep
sleep called from:
0x71359690dc libsec2023.so!0x220dc
0x7135958f44 libsec2023.so!0x11f44
0x745bb37914 libc.so!_ZL15__pthread_startPv+0x10c
0x745bad73f4 libc.so!__start_thread+0x44

hooked sleep
sleep called from:
0x713597d43c libsec2023.so!0x3643c
0x713597d340 libsec2023.so!0x36340
0x7135958f44 libsec2023.so!0x11f44
0x745bb37914 libc.so!_ZL15__pthread_startPv+0x10c
0x745bad73f4 libc.so!__start_thread+0x44

还是没有弹出hook detected!这种期望错误的框。看来得重启手机后才能触发了。

通过尝试Module.findBaseAddress函数寻找此lib，就会触发反调试检查，最后我们得到弹出hack detected!框函数：

1
2
3
4
5
6
7
8
sleep called from:
0x718b1bb908 libsec2023.so!0x36908
0x718b1bb7f8 libsec2023.so!0x367f8
0x718b1bb4c4 libsec2023.so!0x364c4
0x718b1bb340 libsec2023.so!0x36340
0x718b196f44 libsec2023.so!0x11f44
0x745bb37914 libc.so!_ZL15__pthread_startPv+0x10c
0x745bad73f4 libc.so!__start_thread+0x44

sub_36818（hack detected）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
void sub_36818()
{
  __int64 v0; // x0
  __int64 v1; // x19
  void *v2; // x0
  __int64 i; // x8
  __int64 v4; // x0
  int v5; // [xsp+4h] [xbp-BCh] BYREF
  __int64 v6; // [xsp+8h] [xbp-B8h] BYREF
  void *ptr; // [xsp+10h] [xbp-B0h]
  __int64 v8; // [xsp+18h] [xbp-A8h]
  __int128 v9[8]; // [xsp+20h] [xbp-A0h] BYREF
  __int64 v10; // [xsp+A8h] [xbp-18h]

  v10 = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
  memset(v9, 0, sizeof(v9));
  v6 = 0x35AF37FC0E8D1668LL;
  ptr = (void *)0xBF078D24CDDLL;
  LOBYTE(v8) = 0;
  v5 = -288394458;
  v0 = sub_36F6C(&v5, &v6);
  sub_20DD0(v9, 128LL, v0);
  v8 = 0LL;
  v5 = -288394458;
  v1 = sub_37024(&v5, v9, 128LL);
  v2 = sub_1CE70(v1 + 1);
  ptr = v2;
  if ( v2 )
  {
    if ( v1 )
    {
      for ( i = 0LL; i != v1; ++i )
      {
        *((_BYTE *)v2 + i) = *((_BYTE *)v9 + i);
        v2 = ptr;
      }
    }
    *((_BYTE *)v2 + v1) = 0;
    v8 = v1;
  }
  v4 = sub_21BAC();
  sub_21DB4(v4, 2LL, &v6);
  sleep(2u);
  if ( ptr )
    sub_1D998(ptr, v8 + 1);
}

仔细一看，似乎和sub_36340很相似

sub_36F6C（字符串解密函数1）

传入了两个数字进去

1
2
3
4
5
v6 = 0x35AF37FC0E8D1668LL;
ptr = (void *)0xBF078D24CDDLL;
LOBYTE(v8) = 0;
v5 = -288394458;
v0 = sub_36F6C(&v5, &v6);

根据某师傅的描述，这是一个很熟悉的字符串解密函数。

但是但从伪代码啥也看不出来，因为有间接跳转：

1
2
3
4
5
void __fastcall sub_36F6C(__int64 a1)
{
  _ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2));
  __asm { BR              X11; Branch To Register }
}

下面具体看汇编：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
.text:0000000000036F6C ; __unwind {
.text:0000000000036F6C                 SUB             SP, SP, #0x20 ; Rd = Op1 - Op2
.text:0000000000036F70                 STP             X29, X30, [SP,#0x10+var_s0] ; Store Pair
.text:0000000000036F74                 ADD             X29, SP, #0x10 ; Rd = Op1 + Op2
.text:0000000000036F78                 MRS             X8, #3, c13, c0, #2 ; Transfer PSR to Register
.text:0000000000036F7C                 LDR             X9, [X8,#0x28] ; Load from Memory
.text:0000000000036F80                 MOV             W12, #0xED142F96
.text:0000000000036F88                 STR             X9, [SP,#0x10+var_8] ; Store to Memory
.text:0000000000036F8C                 LDR             W10, [X0] ; Load from Memory
.text:0000000000036F90                 STR             XZR, [SP,#0x10+var_10] ; Store to Memory
.text:0000000000036F94                 LDR             X9, [SP,#0x10+var_10] ; Load from Memory
.text:0000000000036F98                 MOV             X0, X1  ; Rd = Op2
.text:0000000000036F9C                 SUB             W10, W12, W10 ; Rd = Op1 - Op2
.text:0000000000036FA0                 SXTW            X10, W10 ; Signed Extend Word
.text:0000000000036FA4                 CMP             X9, #0x10 ; Set cond. codes on Op1 - Op2
.text:0000000000036FA8                 ADRP            X9, #off_72290@PAGE ; Address of Page
.text:0000000000036FAC                 CSET            W11, HI ; Conditional Set
.text:0000000000036FB0                 ADD             X9, X9, #off_72290@PAGEOFF ; Rd = Op1 + Op2
.text:0000000000036FB4                 LDR             X11, [X9,W11,UXTW#3] ; Load from Memory
.text:0000000000036FB8                 ADD             X11, X11, X10 ; Rd = Op1 + Op2
.text:0000000000036FBC                 BR              X11     ; Branch To Register
.text:0000000000036FBC ; End of function sub_36F6C
.text:0000000000036FBC
.text:0000000000036FC0 ; ---------------------------------------------------------------------------
.text:0000000000036FC0                 LDR             X11, [SP] ; Load from Memory
.text:0000000000036FC4                 MOV             W14, #0x77 ; 'w' ; Rd = Op2
.text:0000000000036FC8                 LDRB            W11, [X0,X11] ; Load from Memory
.text:0000000000036FCC                 LDR             X12, [SP] ; Load from Memory
.text:0000000000036FD0                 LDR             X13, [SP] ; Load from Memory
.text:0000000000036FD4                 MUL             W12, W12, W14 ; Multiply
.text:0000000000036FD8                 EOR             W11, W12, W11 ; Rd = Op1 ^ Op2
.text:0000000000036FDC                 STRB            W11, [X0,X13] ; Store to Memory
.text:0000000000036FE0                 LDR             X11, [SP] ; Load from Memory
.text:0000000000036FE4                 ADD             X11, X11, #1 ; Rd = Op1 + Op2
.text:0000000000036FE8                 STR             X11, [SP] ; Store to Memory
.text:0000000000036FEC                 LDR             X11, [SP] ; Load from Memory
.text:0000000000036FF0                 CMP             X11, #0x10 ; Set cond. codes on Op1 - Op2
.text:0000000000036FF4                 CSET            W11, HI ; Conditional Set
.text:0000000000036FF8                 LDR             X11, [X9,W11,UXTW#3] ; Load from Memory
.text:0000000000036FFC                 ADD             X11, X11, X10 ; Rd = Op1 + Op2
.text:0000000000037000                 BR              X11     ; Branch To Register
.text:0000000000037004 ; ---------------------------------------------------------------------------
.text:0000000000037004                 LDR             X8, [X8,#0x28] ; Load from Memory
.text:0000000000037008                 LDR             X9, [SP,#8] ; Load from Memory
.text:000000000003700C                 CMP             X8, X9  ; Set cond. codes on Op1 - Op2
.text:0000000000037010                 B.NE            loc_37020 ; Branch
.text:0000000000037014                 LDP             X29, X30, [SP,#0x10] ; Load Pair
.text:0000000000037018                 ADD             SP, SP, #0x20 ; ' ' ; Rd = Op1 + Op2
.text:000000000003701C                 RET                     ; Return from Subroutine
.text:0000000000037020 ; ---------------------------------------------------------------------------
.text:0000000000037020
.text:0000000000037020 loc_37020                               ; CODE XREF: .text:0000000000037010↑j
.text:0000000000037020                 BL              .__stack_chk_fail ; Branch with Link
.text:0000000000037020 ; } // starts at 36F6C
模拟执行

使用IDA7.5的uEmu插件，从0x36818函数头开始模拟执行，然后进入该函数观察具体逻辑：（因为此函数传入的形参似乎会影响X11寄存器的值）

经过调试，得到：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
.text:0000000000036FC0                 LDR             X11, [SP]
.text:0000000000036FC4                 MOV             W14, #0x77 ; 'w'
.text:0000000000036FC8                 LDRB            W11, [X0,X11] ; w11 = 0x68
.text:0000000000036FC8                                         ; 逐个字节？很可疑
.text:0000000000036FCC                 LDR             X12, [SP,#0x10+var_10]
.text:0000000000036FD0                 LDR             X13, [SP,#0x10+var_10]
.text:0000000000036FD4                 MUL             W12, W12, W14 ; w12 *= 0x77
.text:0000000000036FD8                 EOR             W11, W12, W11 ; w11 ^= w12
.text:0000000000036FDC                 STRB            W11, [X0,X13] ; 把w11重新存回去
.text:0000000000036FE0                 LDR             X11, [SP,#0x10+var_10]
.text:0000000000036FE4                 ADD             X11, X11, #1 ; 像是for循环里的i++
.text:0000000000036FE8                 STR             X11, [SP,#0x10+var_10]
.text:0000000000036FEC                 LDR             X11, [SP,#0x10+var_10]
.text:0000000000036FF0                 CMP             X11, #0x10 ; 0x10，像是for循环终结的判断条件
.text:0000000000036FF4                 CSET            W11, HI
.text:0000000000036FF8                 LDR             X11, [X9,W11,UXTW#3]
.text:0000000000036FFC                 ADD             X11, X11, X10
.text:0000000000037000                 BR              X11

这里已经很清晰了，就是一个

1
a[i] ^= (0x77 * i)

这样的逻辑。而被解密的值是外面传来的第二个参数：

1
2
v6 = 0x35AF37FC0E8D1668LL;
ptr = (void *)0xBF078D24CDDLL;
解密脚本
1
2
3
4
5
6
7
8
9
10
11
12
#0x35AF37FC0E8D1668LL
#0xBF078D24CDDLL

a = [0x68, 0x16, 0x8D, 0x0E, 
     0xFC, 0x37, 0xAF, 0x35, 
     0xDD, 0x4C, 0xD2, 0x78, 
     0xF0, 0xB, 0x0, 0x0]
for i in range(0x10):
	a[i] ^= (0x77 * i)
	a[i] &= 0xFF
    
print("".join([chr(i) for i in a]))

得到

1
hack detectedù

反正可以实锤是报错弹窗了。

Patch
1
0x36FBC: BR X11

修改成

1
NOP
1
2
3
4
.text:0000000000036FF4                 CSET            W11, HI
.text:0000000000036FF8                 LDR             X11, [X9,W11,UXTW#3]
.text:0000000000036FFC                 ADD             X11, X11, X10
.text:0000000000037000                 BR              X11

修改成：

1
2
3
4
5
6
7
8
9
10
.text:0000000000036FF4                 NOP                     ; Keypatch modified this from:
.text:0000000000036FF4                                         ;   CSET W11, HI
.text:0000000000036FF8                 NOP                     ; Keypatch modified this from:
.text:0000000000036FF8                                         ;   LDR X11, [X9,W11,UXTW#3]
.text:0000000000036FF8                                         ; Keypatch modified this from:
.text:0000000000036FF8                                         ;   LDR X11, [X9,W11,UXTW#3]
.text:0000000000036FFC                 NOP                     ; Keypatch modified this from:
.text:0000000000036FFC                                         ;   ADD X11, X11, X10
.text:0000000000037000                 B.NE            loc_36FC0 ; Keypatch modified this from:
.text:0000000000037000                                         ;   BR X11

这样IDA也能正常反编译了：

1
2
3
4
5
6
7
8
void __fastcall sub_36F6C(__int64 a1, _BYTE *a2)
{
  __int64 i; // [xsp+0h] [xbp-10h]

  _ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2));
  for ( i = 0LL; i != 16; ++i )
    a2[i] ^= 119 * (_BYTE)i;
}

sub_36340（获得1000分，您将赢得比赛。）

根据上面的分析，可以发现这里执行的应该都是字符串解密后的。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
__int64 *__fastcall sub_36340(__int64 *a1, __int64 a2)
{
  __int64 v3; // x0
  __int64 v5; // x21
  __int64 v6; // x0
  __int64 i; // x8
  int v9; // [xsp+Ch] [xbp-14h] BYREF

  v3 = *a1;
  if ( v3 )
    sub_1D998(v3, a1[1] + 1);
  *a1 = 0LL;
  a1[1] = 0LL;
  if ( !a2 )
    return a1;
  v9 = -288394458;
  v5 = sub_3665C(&v9, a2, -1LL);
  v6 = sub_1CE70(v5 + 1);
  *a1 = v6;
  if ( !v6 )
    return a1;
  if ( v5 )
  {
    for ( i = 0LL; i != v5; ++i )
    {
      *(_BYTE *)(v6 + i) = *(_BYTE *)(a2 + i);
      v6 = *a1;
    }
  }
  *(_BYTE *)(v6 + v5) = 0;
  a1[1] = v5;
  return a1;
}

因此去找调用这个函数的函数，发现了经典的间接跳转：

模拟执行sub_361D0

1
2
3
4
5
6
7
8
9
void __fastcall sub_361D0(__int64 a1)
{
  __int64 v1; // x8

  v1 = 40LL;
  if ( *(_QWORD *)(a1 + 56) )
    v1 = 0LL;
  __asm { BR              X8 }
}

太经典啦。还是用uEmu去模拟执行函数头，慢慢看间接跳转是怎么走的。

最后比较理想的是，所有间接跳转都如愿正常跳转了。

最后跳到block 0x362BC处，就是要调用sub_36340的位置。

不过在它前头有一个BL sub_365A8：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
.text:00000000000362BC                 MOV             W8, #1
.text:00000000000362C0                 STRB            W8, [X19,#0x7C]
.text:00000000000362C4                 ADRP            X8, #xmmword_5E440@PAGE
.text:00000000000362C8                 LDR             Q0, [X8,#xmmword_5E440@PAGEOFF]
.text:00000000000362CC                 ADRP            X8, #xmmword_5E450@PAGE
.text:00000000000362D0                 LDR             Q1, [X8,#xmmword_5E450@PAGEOFF]
.text:00000000000362D4                 MOV             W8, #0x50036BB5
.text:00000000000362DC                 STR             W8, [SP,#0x20]
.text:00000000000362E0                 MOV             W8, #0xB042
.text:00000000000362E4                 STRH            W8, [SP,#0x24]
.text:00000000000362E8                 MOV             W8, #0x7326
.text:00000000000362EC                 ADD             X9, SP, #0x40 ; '@'
.text:00000000000362F0                 MOVK            W8, #0xEECF,LSL#16
.text:00000000000362F4                 SUB             X0, X29, #0x24 ; '$'
.text:00000000000362F8                 MOV             X1, SP
.text:00000000000362FC                 ADD             X20, X9, #8
.text:0000000000036300                 STP             XZR, XZR, [SP,#0x48]
.text:0000000000036304                 STUR            XZR, [SP,#0x2E]
.text:0000000000036308                 STUR            XZR, [SP,#0x26]
.text:000000000003630C                 STUR            WZR, [SP,#0x36]
.text:0000000000036310                 STP             Q0, Q1, [SP]
.text:0000000000036314                 STUR            W8, [X29,#-0x24]
.text:0000000000036318                 BL              sub_365A8	; here
.text:000000000003631C                 MOV             X1, X0
.text:0000000000036320                 MOV             X0, X20
.text:0000000000036324                 BL              sub_36340
.text:0000000000036328                 BL              sub_21BAC
.text:000000000003632C                 ADD             X2, SP, #0x40 ; '@'
.text:0000000000036330                 MOV             W1, #2
.text:0000000000036334                 BL              sub_21DB4
.text:0000000000036338                 MOV             X0, X19
.text:000000000003633C                 BL              sub_363E0

sub_365A8（字符串解密函数2）

和上面的Patch同理：

1
2
3
4
5
6
.text:00000000000365F8                 NOP                     ; Keypatch modified this from:
.text:00000000000365F8                                         ;   BR X11


.text:0000000000036638                 B.NE            loc_365FC ; Keypatch modified this from:
.text:0000000000036638                                         ;   BR X11

得到

1
2
3
4
5
6
7
8
void __fastcall sub_365A8(__int64 a1, __int64 a2)
{
  __int64 i; // [xsp+0h] [xbp-10h]

  _ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2));
  for ( i = 0LL; i != 57; ++i )
    *(_BYTE *)(a2 + i) ^= 0xF0 * (_BYTE)i;
}

因此现在需要知道具体解密的值。通过模拟执行，得到X1指向的栈中的数据：

1
2
3
4
FFFFFFFFFFFFFF70: E8 7E 57 35 7E 27 91 A0 B0 40 85 D8 C6 DF 9C 9C   .~W5~'...@......
FFFFFFFFFFFFFF80: E6 72 48 35 70 36 48 25 22 95 DE C7 A6 9F B4 F8   .rH5p6H%".......
FFFFFFFFFFFFFF90: B5 6B 03 50 42 B0 00 00 00 00 00 00 00 00 00 00   .k.PB...........
FFFFFFFFFFFFFFA0: 00 00 00 00 00 00 00 00 00

解密脚本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
a = "E8 7E 57 35 7E 27 91 A0 B0 40 85 D8 C6 DF 9C 9C E6 72 48 35 70 36 48 25 22 95 DE C7 A6 9F B4 F8 B5 6B 03 50 42 B0"

import binascii

a = binascii.unhexlify(a.replace(" ", ""))
"""
E8 7E 57 35 7E 27 91 A0 B0 40 85 D8 C6 DF 9C 9C
E6 72 48 35 70 36 48 25 22 95 DE C7 A6 9F B4 F8
B5 6B 03 50 42 B0
"""
a = bytearray(a)
for i in range(len(a)):
    a[i] ^= (0xF0 * i) & 0xFF
    
print(a.decode("utf-8"))

得到：

1
获得1000分，您将赢得比赛。

动调

首先一定要新开 ida,不要用分析了 so 的 ida 附加,否则退出调试的时候会卡死,之前的分析就炸了,推荐是动静结合来分析

还有一件很重要的事情是关闭一些异常处理

Debugger Options…->Edit exceptions->

SIGPWR SIGXCPU 右键 edit,去掉挂起程序的勾,并勾上通过引用,report 选 log 或者 Silent 都行

这一点可能是因为 unity 的问题或者是 Android 的问题,调着调着就会弹这俩个异常,如果挂起程序,程序就会崩溃,程序崩溃又会导致 ida 崩溃,而设置完之后就不会出现这个情况了

还有一件事,程序暂停调试的时候不要点击屏幕,否则会出现和前面异常挂起一样的问题

分析游戏逻辑

在dump.cs中找到表示金币的Coins

1
private TssSdtInt Coins; // 0x50

以及收集硬币的函数：

1
2
// RVA: 0x4652E4 Offset: 0x4652E4 VA: 0x763C08E2E4
private void CollectCoin(Collider2D coinCollider) { }

在恢复符号表的libil2cpp.so里面也可以找到具体实现逻辑：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
void __fastcall MouseController__CollectCoin(
        MouseController_o *this,
        UnityEngine_Collider2D_o *coinCollider,
        const MethodInfo *method)
{
  __int64 v5; // x1
  __int64 v6; // x2
  UnityEngine_Object_o *gameObject; // x20
  UnityEngine_AudioClip_o *CoinCollectSound; // x20
  UnityEngine_Transform_o *transform; // x0
  struct TssSdtInt_o *Coins; // x0
  struct UnityEngine_UI_Text_o *LblCoins; // x20
  __int64 v12; // x0
  const MethodInfo *v13; // x1
  System_String_o *deviceUniqueIdentifier; // x0
  System_String_o *v15; // x0
  System_String_o *v16; // x0
  struct UnityEngine_UI_Text_o *LblWeaks; // x8
  UnityEngine_Vector3_o position; // 0:s0.4,4:s1.4,8:s2.4

  if ( (byte_119A37B & 1) == 0 )
  {
    sub_389B58(&off_111C930, coinCollider, method);
    sub_389B58(&StringLiteral_4153, v5, v6);
    byte_119A37B = 1;
  }
  this->fields.Coins = TssSdtInt__op_Increment(this->fields.Coins, (const MethodInfo *)coinCollider);
  if ( !coinCollider )
    goto LABEL_14;
  gameObject = (UnityEngine_Object_o *)UnityEngine_Component__get_gameObject(
                                         (UnityEngine_Component_o *)coinCollider,
                                         0LL);
  if ( !*((_DWORD *)off_111C930 + 56) )
    j_il2cpp_runtime_class_init_0(off_111C930);
  UnityEngine_Object__Destroy_11077540(gameObject, 0LL);
  CoinCollectSound = this->fields.CoinCollectSound;
  transform = UnityEngine_Component__get_transform((UnityEngine_Component_o *)this, 0LL);
  if ( !transform )
    goto LABEL_14;
  position = UnityEngine_Transform__get_position(transform, 0LL);
  UnityEngine_AudioSource__PlayClipAtPoint(CoinCollectSound, position, 0LL);
  Coins = this->fields.Coins;
  if ( !Coins )
    goto LABEL_14;
  LblCoins = this->fields.LblCoins;
  v12 = ((__int64 (__fastcall *)(struct TssSdtInt_o *, void *))Coins->klass->vtable._3_ToString.method)(
          Coins,
          Coins->klass[1]._1.image);
  if ( !LblCoins )
    goto LABEL_14;
  ((void (__fastcall *)(struct UnityEngine_UI_Text_o *, __int64, Il2CppMethodPointer))LblCoins->klass->vtable._75_set_text.method)(
    LblCoins,
    v12,
    LblCoins->klass->vtable._76_CalculateLayoutInputHorizontal.methodPtr);
  if ( TssSdtInt__op_Implicit(this->fields.Coins, v13) >= 1000 )
  {
    deviceUniqueIdentifier = UnityEngine_SystemInfo__get_deviceUniqueIdentifier(0LL);
    if ( deviceUniqueIdentifier )
    {
      v15 = System_String__Substring_8643156(deviceUniqueIdentifier, 0, 6, 0LL);
      v16 = System_String__Concat_8591696((System_String_o *)StringLiteral_4153, v15, 0LL);
      LblWeaks = this->fields.LblWeaks;
      if ( LblWeaks )
      {
        ((void (__fastcall *)(struct UnityEngine_UI_Text_o *, System_String_o *, Il2CppMethodPointer))LblWeaks->klass->vtable._75_set_text.method)(
          LblWeaks,
          v16,
          LblWeaks->klass->vtable._76_CalculateLayoutInputHorizontal.methodPtr);
        return;
      }
    }
LABEL_14:
    sub_389C40();
  }
}

其中有：

1
if ( TssSdtInt__op_Implicit(this->fields.Coins, v13) >= 1000 )

Frida破解

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
function fuck_il2cpp() {
    // var libil2cpp = Module.findBaseAddress("libil2cpp.so")
    var libso = Process.getModuleByName("libil2cpp.so");
    var libil2cpp = libso.base;
    var offset = 0x4653CC
    console.log("libil:", libil2cpp)
    var h = libil2cpp.add(ptr(offset))
    Interceptor.attach(h, {
        onEnter(args) {
            this.context.x0 = 0x3E8;
            console.log("il2cpp fucked!")
        },
        onLeave(retval) {

        }
    })
    dis(h, 2);
}

可能一开始直接注入会报错，提示找不到模块；不过后面等一会儿再注入也行。

之后主动去收集金币，就会触发这个函数CollectCoin，继而触发我们的魔改逻辑，得到flag。

1
sec2023_baacf2

注册机

在一开始的界面，有一个Mod Menu，里面有一个数字键盘，和一个显示的Token。

在dump.cs中寻找键盘相关逻辑，发现SmallKeyboard类，同时此类还有严重混淆。

SmallKeyboard__iI1Ii

在IDA里面搜索相关类逻辑：

1
void __fastcall SmallKeyboard__iI1Ii(SmallKeyboard_o *this, SmallKeyboard_iII1i_o *info, const MethodInfo *method)

发现：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
if ( KeyType == 2 )
{
    v13 = (Il2CppObject *)System_String__Concat_8591696((System_String_o *)StringLiteral_4134, v4->fields.iIIIi, 0LL);// 
                                                // "sResult ="
    if ( !*((_DWORD *)off_111B960 + 56) )
      j_il2cpp_runtime_class_init_0(off_111B960);
    UnityEngine_Debug__LogWarning(v13, 0LL);
    iIIIi = v4->fields.iIIIi;
    if ( !System_Convert_TypeInfo->_2.cctor_finished )
      j_il2cpp_runtime_class_init_0(System_Convert_TypeInfo);
    v15 = System_Convert__ToUInt64_8763844(iIIIi, 0LL);
    SmallKeyboard__iI1Ii_4610736(v4, v15, v16); // ToUint64
    SmallKeyboard__oO0oOo0(v4, v17);
}

这里的iI1Ii个人猜测可能是生成的Token，或者是用户的输入。

SmallKeyboard__oO0oOo0

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
void __fastcall SmallKeyboard__oO0oOo0(SmallKeyboard_o *this, const MethodInfo *method)
{
  __int64 v2; // x2
  __int64 v4; // x1
  __int64 v5; // x2
  __int64 v6; // x1
  __int64 v7; // x2
  __int64 v8; // x1
  __int64 v9; // x2
  int v10; // w25
  System_Random_o *IDObj; // x0
  __int64 v12; // x2
  System_Random_o *v13; // x20
  System_String_o *oO0o0o0; // x21
  System_String_o *v15; // x0
  Il2CppObject *Component_object; // x0
  System_String_o *v17; // x1
  Il2CppObject *v18; // x19
  int v19; // [xsp+Ch] [xbp-44h] BYREF

  if ( (byte_119A382 & 1) == 0 )
  {
    sub_389B58((__int64)&qword_112BD48, (__int64)method, v2);
    sub_389B58((__int64)&off_111CC00, v4, v5);
    sub_389B58((__int64)&qword_1134438, v6, v7);
    sub_389B58((__int64)&off_112FAD0, v8, v9);
    byte_119A382 = 1;
  }
  v10 = 8;
  v19 = 0;
  this->fields.oO0o0o0 = (struct System_String_o *)off_112FAD0;
  do
  {
    IDObj = (System_Random_o *)sub_389C30(off_111CC00, method);
    if ( !IDObj )
      goto LABEL_9;
    v13 = IDObj;
    System_Random___ctor(IDObj, 0LL);
    oO0o0o0 = this->fields.oO0o0o0;
    v19 = ((__int64 (__fastcall *)(System_Random_o *, _QWORD, __int64, Il2CppMethodPointer))v13->klass->vtable._6_Next.method)(
            v13,
            0LL,
            10LL,
            v13->klass->vtable._7_Next.methodPtr);// 
                                                // v13 = IDObj = System.Random
                                                // rand(0, 10)
    v15 = System_Int32__ToString((int32_t)&v19, 0LL);
    --v10;
    this->fields.oO0o0o0 = System_String__Concat_8591696(oO0o0o0, v15, 0LL);// int32 to string
                                                // 然后拼接
  }
  while ( v10 );                                // 循环8次
  IDObj = (System_Random_o *)this->fields.IDObj;
  if ( !IDObj
    || (Component_object = UnityEngine_GameObject__GetComponent_object_(
                             (UnityEngine_GameObject_o *)IDObj,
                             (const MethodInfo_521C18 *)qword_112BD48),
        v17 = this->fields.oO0o0o0,
        v18 = Component_object,
        IDObj = (System_Random_o *)System_String__Concat_8591696((System_String_o *)qword_1134438, v17, 0LL),
        !v18) )
  {
LABEL_9:
    sub_389C40(IDObj, method, v12);
  }
  ((void (__fastcall *)(Il2CppObject *, System_Random_o *, Il2CppMethodPointer))v18->klass->vtable[75].method)(
    v18,
    IDObj,
    v18->klass->vtable[76].methodPtr);
}

这个很确定就是生成随机Token的逻辑了。

1
2
3
4
5
6
7
8
// RVA: 0x465880 Offset: 0x465880 VA: 0x763C08E880
private void iI1Ii(SmallKeyboard.iII1i _info) { }

// RVA: 0x465FDC Offset: 0x465FDC VA: 0x763C08EFDC
private void iI1Ii(GameObject go) { }

// RVA: 0x465AB0 Offset: 0x465AB0 VA: 0x763C08EAB0
private void iI1Ii(ulong i1I) { }

因此可以确定iI1Ii是check函数。

观察第3个方法，传入了一个数字，显然就是用户输入的Token。

SmallKeyboard__iI1Ii_4610736

1
2
3
4
void __fastcall SmallKeyboard__iI1Ii_4610736(SmallKeyboard_o *this, uint64_t i1I, const MethodInfo *method)
{
  SmallKeyboard__iI1Ii_4610736_0();
}

然后

1
2
3
4
5
// attributes: thunk
void SmallKeyboard__iI1Ii_4610736_0()
{
  JUMPOUT(0x13B8DC8LL);
}

汇编里面一看：

1
2
3
4
LOAD:00000000013B8DC8 08 00 00 D0                 ADRP            X8, #off_13BAFF0@PAGE ; Address of Page
LOAD:00000000013B8DCC 08 F9 47 F9                 LDR             X8, [X8,#off_13BAFF0@PAGEOFF] ; Load from Memory
LOAD:00000000013B8DD0 02 25 40 F9                 LDR             X2, [X8,#0x48] ; Load from Memory
LOAD:00000000013B8DD4 40 00 1F D6                 BR              X2      ; Branch To Register

这整个代码区域都被.init_proc函数给包裹了，导致伪代码错误。因为我们不需要.init_proc，因此直接u掉，单独对这里按p构建函数即可。（为了不影响后续可能的分析流程，剩余的数据要重新c回来，变成汇编或者p成函数）

最后得到：

1
2
3
4
__int64 sub_13B8DC8()
{
  return (*((__int64 (**)(void))off_13BAFF0 + 9))();	// g_sec2023_p_array[9]
}

而这个off指向了

1
g_sec2023_p_array

这是一个从libsec2023.so导入的列表。

回到libsec2023.so，看导出符号：

1
2
3
4
5
6
7
8
9
10
.data:0000000000071240 g_sec2023_p_array DCQ sub_35404         ; DATA XREF: LOAD:0000000000000FF8↑o
.data:0000000000071248                 DCQ j_.fread
.data:0000000000071250                 DCQ j_.fwrite
.data:0000000000071258                 DCQ sub_31024
.data:0000000000071260                 DCQ j_.fclose
.data:0000000000071268                 DCQ sub_31020
.data:0000000000071270                 DCQ j_.mprotect
.data:0000000000071278                 DCQ j_.malloc
.data:0000000000071280                 DCQ loc_FF2C
.data:0000000000071288                 DCQ sub_31164

第九个元素：

1
sub_31164

sub_31164

1
2
3
4
5
6
7
8
9
__int64 __fastcall sub_31164(__int64 a1, __int64 a2)
{
  __int64 v3; // x1
  __int64 (__fastcall *v5)(__int64, __int64); // [xsp+8h] [xbp-8h]

  v5 = (__int64 (__fastcall *)(__int64, __int64))g_sec2023_o_array;
  v3 = sub_3B8CC(a2);
  return v5(a1, v3);
}

调用g_sec2023_o_array里的另一个函数，其传参是sub_3B8CC(a2)

这个array在libsec2023里面没有被定义，猜测应该是从其他so里写入的。

在libil2cpp.so里面看到里导出。然后用交叉引用发现了调用了的函数。

这里一开始没有发现交叉引用，事实证明那一串代码被我在u掉.init_proc的时候给搞成数据了。所以需要立刻重新patch成代码。

sub_763CFE1DD8（libil2cpp.so基址为0x763bc29000）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
void sub_763CFE1DD8()
{
  *(_QWORD *)off_763CFE3FE8 = off_763CFE4168;
}

LOAD:000000763CFE1DD8             ; void sub_763CFE1DD8()
LOAD:000000763CFE1DD8             sub_763CFE1DD8                          ; CODE XREF: LOAD:000000763CFE1B30↑j
LOAD:000000763CFE1DD8 08 00 00 F0                 ADRP            X8, #off_763CFE4168@PAGE ; Address of Page
LOAD:000000763CFE1DDC 09 00 00 D0                 ADRP            X9, #off_763CFE3FE8@PAGE ; Address of Page
LOAD:000000763CFE1DE0 08 B5 40 F9                 LDR             X8, [X8,#off_763CFE4168@PAGEOFF] ; Load from Memory
LOAD:000000763CFE1DE4 29 F5 47 F9                 LDR             X9, [X9,#off_763CFE3FE8@PAGEOFF] ; Load from Memory
LOAD:000000763CFE1DE8 28 01 00 F9                 STR             X8, [X9] ; Store to Memory
LOAD:000000763CFE1DEC C0 03 5F D6                 RET                     ; Return from Subroutine
LOAD:000000763CFE1DEC             ; End of function sub_763CFE1DD8

第一个off指向了一个函数：sub_763CFE1D64

sub_763CFE1D64⭐

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
  a2_low = System_Convert__ToUInt32_8761148((unsigned int)a2, 0LL);// a2的低4字节
  if ( !num->max_length )
    ((void (__fastcall __noreturn *)(__int64))sub_763BFB2C48)(a2_low);
  num->m_Items[1] = a2_low;                     // 
                                                // 
  a2_high = System_Convert__ToUInt32_8761148(HIDWORD(a2), 0LL);// a2的高4字节
  if ( num->max_length <= 1 )
    ((void (__fastcall __noreturn *)(__int64))sub_763BFB2C48)(a2_high);
  num->m_Items[2] = a2_high;                    // 
                                                // 
  v26 = (OO0OoOOo_Oo0_o *)sub_763BFB2C30(OO0OoOOo_Oo0_TypeInfo, v25);
  v30 = v26;
  if ( !v26 )
    sub_763BFB2C40(0LL, v27, v28);
  OO0OoOOo_Oo0___ctor(v26, (System_UInt16_array *)v22, 0, num, v29);// num用于OO0OoOOo.ctor
  v30->fields.oOOO0Oo0 = v30->fields.oOOO0O0O;
  OO0OoOOo_Oo0__oOOoO0o0(v30, v31);             // OO0OoOOo_Oo0.oOOoO0o0
                                                // 据说有猫腻，没仔细看是干啥的
  v33 = num->max_length;
  if ( !v33 )
    ((void (__fastcall __noreturn *)(__int64))sub_763BFB2C48)(v32);
  if ( v33 == 1 )
    ((void (__fastcall __noreturn *)(__int64))sub_763BFB2C48)(v32);// 
                                                // 
  num2_lo = num->m_Items[1];
  num2_hi = num->m_Items[2];
  v36 = sub_763BFB2B90(uint___TypeInfo, 4LL);
  v48.fields.value = Field__PrivateImplementationDetails__7ED62A9C940924585528F182C4782BE139EB7954F975F7145C28719071F7BC8E;
  System_Runtime_CompilerServices_RuntimeHelpers__InitializeArray_9068608((System_Array_o *)v36, v48, 0LL);
  if ( !v36 )
    sub_763BFB2C40(v37, v38, v39);
  v40 = *(_DWORD *)(v36 + 24);
  v41 = 0xBEEFBEEF;
  v42 = 0x9D9D7DDE;
  v43 = 64;
  do                                            // 魔改TEA
  {
    if ( (v41 & 3u) >= v40 )
      ((void (__fastcall __noreturn *)(__int64))sub_763BFB2C48)(v37);
    v44 = (v42 >> 13) & 3;
    if ( v44 >= v40 )
      ((void (__fastcall __noreturn *)(__int64))sub_763BFB2C48)(v37);
    num2_lo += (v41 - *(_DWORD *)(v36 + 4LL * (v41 & 3) + 32)) ^ (((num2_hi << 7) ^ (num2_hi >> 8)) + num2_hi);
    --v43;
    v41 -= 559038737;
    num2_hi += (v42 + *(_DWORD *)(v36 + 4LL * v44 + 32)) ^ (((num2_lo << 8) ^ (num2_lo >> 7)) - num2_lo);
    v42 -= 559038737;
  }
  while ( v43 );
  v45 = *(System_String_o **)(a1 + 56);
  if ( !System_Convert_TypeInfo->_2.cctor_finished )
    j_il2cpp_runtime_class_init_0(System_Convert_TypeInfo);
  result = System_Convert__ToUInt32_8761612(v45, 0LL);
  if ( !num2_hi && (_DWORD)result == num2_lo )
    SmallKeyboard_TypeInfo->static_fields->KeyboardNum = -1;
  return result;
}

最后TEA成功后：

1
2
if ( !num2_hi && (_DWORD)result == num2_lo )
  SmallKeyboard_TypeInfo->static_fields->KeyboardNum = -1;

对SmallKeyboard_TypeInfo交叉引用一下，看看哪里用了这个玩意：

在MouseController__Start：

1
2
3
4
5
if ( SmallKeyboard_TypeInfo->static_fields->KeyboardNum == -1 )
{
  this->fields.IsInvincible = 1;
  this->fields.JetpackForce = 10.0;
}

还有4个引用点，具体算法没细看，应该是开挂无敌逻辑。

修复sub_3B8CC

复盘sub_31164，了解到上面这一串位于libil2cpp.so的注册机开挂逻辑，其输入是先经过了sub_3B8CC变换过的。

1
2
3
4
5
6
7
8
9
__int64 __fastcall sub_31164(__int64 a1, __int64 a2)
{
  __int64 v3; // x1
  __int64 (__fastcall *v5)(__int64, __int64); // [xsp+8h] [xbp-8h]

  v5 = (__int64 (__fastcall *)(__int64, __int64))g_sec2023_o_array;
  v3 = sub_3B8CC(a2);
  return v5(a1, v3);
}

因此现在开始patch：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
void __fastcall sub_3B8CC(__int64 a1)
{
  __int64 v1; // x0
  __int64 v2; // x0
  int v3; // w0
  __int64 v4; // x8
  unsigned int v5[2]; // [xsp+8h] [xbp-48h] BYREF
  int v6; // [xsp+10h] [xbp-40h] BYREF
  unsigned int v7; // [xsp+14h] [xbp-3Ch] BYREF
  __int64 v8; // [xsp+18h] [xbp-38h]

  v8 = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
  v5[0] = HIDWORD(a1);
  v5[1] = a1;
  v1 = sub_3B9D4(v5);
  v6 = 0;
  v7 = bswap32(v5[0]);
  v2 = sub_3A054(v1);
  v3 = sub_3A924(v2, &v7, 4LL, &v6, 4LL);
  v4 = 16LL;
  if ( v3 )
    v4 = 24LL;
  __asm { BR              X8 }
}

先从其中的子函数开始patch：

修复sub_3B9D4

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
void sub_3B9D4()
{
  __asm { BR              X10 }
}

.text:000000000003B9D4 sub_3B9D4                               ; CODE XREF: sub_3B8CC+30↑p
.text:000000000003B9D4 ; __unwind {
.text:000000000003B9D4                 SUB             SP, SP, #0x10 ; Rd = Op1 - Op2
.text:000000000003B9D8                 MOV             X8, XZR ; Rd = Op2
.text:000000000003B9DC                 CMP             X8, #2  ; Set cond. codes on Op1 - Op2
.text:000000000003B9E0                 MOV             W9, #40 ; Rd = Op2
.text:000000000003B9E4                 CSEL            X10, XZR, X9, CC ; Conditional Select
.text:000000000003B9E8                 ADRL            X9, off_72C40
.text:000000000003B9F0                 LDR             X10, [X9,X10] ; Load from Memory
.text:000000000003B9F4                 MOV             W11, #0x740078FC
.text:000000000003B9FC                 ADD             X10, X10, X11 ; Rd = Op1 + Op2
.text:000000000003BA00                 BR              X10     ; Branch To Register
.text:000000000003BA00 ; End of function sub_3B9D4

主要搞不懂的是CSEL指令：

1
CSEL            X10, XZR, X9, CC ; Conditional Select

大概意思是：

ARM Cortex-A Series Programmer’s Guide for ARMv8-A

Code Encoding Meaning (when set by CMP) Meaning (when set by FCMP) Condition flags
EQ 0b0000 Equal to. Equal to. Z =1
NE 0b0001 Not equal to. Unordered, or not equal to. Z = 0
CS 0b0010 Carry set (identical to HS). Greater than, equal to, or unordered (identical to HS). C = 1
HS 0b0010 Greater than, equal to (unsigned) (identical to CS). Greater than, equal to, or unordered (identical to CS). C = 1
CC 0b0011 Carry clear (identical to LO). Less than (identical to LO). C = 0 
1
2
3
4
if 0 < 2:
	x10 = xzr(0)
else:
	x10 = x9(40)

整个代码则为：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
if 0 < 2:
	x10 = 0	// 恒成立
else:
	x10 = 40	
x9 = 0x72C40
x10 = *(x9+40)
// x10 = off_72C40[0]

x11 = 0x740078FC
x10 += x11
br x10

.data:0000000000072C40 off_72C40       DCQ 0xFFFFFFFF8C034108  ; DATA XREF: sub_3B9D4+14↑o
.data:0000000000072C48                 DCQ 0xFFFFFFFF8C034230
.data:0000000000072C50                 DCQ 0xFFFFFFFF8C034138
.data:0000000000072C58                 DCQ 0xFFFFFFFF8C034178
.data:0000000000072C60                 DCQ 0xFFFFFFFF8C0341E4
.data:0000000000072C68                 DCQ 0xFFFFFFFF8C034254

0:0xFFFFFFFF8C034108 + 0x740078FC = 0x3BA04
8:0x3BB2C
10:0x3BA34
18:0x3BA74
20:0x3BAE0
28:0x3BB50

由于0x3BA04就是紧接着的一个基本块，且0x3BA04可以当作是小于的时候的执行，那么不小于的时候就要跳转到0x3BB50

也就是B.GE loc_3BB50。

反正patch完后得到：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
void __fastcall sub_3B9D4(_DWORD *a1)
{
  unsigned __int64 i; // x8
  __int64 v2; // x10
  char v3; // w11
  __int64 v4; // x11
  int v5; // w10
  char v6; // w12
  unsigned __int8 v7; // w14
  int v8; // [xsp+Ch] [xbp-4h]

  for ( i = 0LL; i < 2; ++i )
  {
    v2 = 3LL;
    v8 = 0;
    v3 = 24;
    do
    {
      *((_BYTE *)&v8 + v2) = (a1[i] >> v3) ^ v2;
      --v2;
      v3 -= 8;
    }
    while ( v2 >= 0 );
    HIBYTE(v8) ^= 0x86u;
    BYTE2(v8) -= 94;
    v4 = 3LL;
    BYTE1(v8) ^= 0xD3u;
    LOBYTE(v8) = v8 - 28;
    a1[i] = 0;
    v5 = 0;
    v6 = 24;
    do
    {
      v7 = *((_BYTE *)&v8 + v4) - v6;
      *((_BYTE *)&v8 + v4--) = v7;
      v5 += v7 << v6;
      a1[i] = v5;
      v6 -= 8;
    }
    while ( v4 >= 0 );
  }
}

修复点

这是一位师傅总结的：这里我就偷个懒了。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
sub_3B9D4
.text:000000000003BA00 8A 0A 00 54                   B.GE            loc_3BB50
.text:000000000003BA30 23 02 00 54                   B.CC            loc_3BA74
.text:000000000003BA70 2A FE FF 54                   B.GE            loc_3BA34
.text:000000000003BADC 14 00 00 94                   B.CC            loc_3BB2C
.text:000000000003BB28 CA FD FF 54                   B.GE            loc_3BAE0
.text:000000000003BB4C C3 F5 FF 54                   B.CC            loc_3BA04
 
sub_3A054
.text:000000000003A08C 21 03 00 54                   B.NE            loc_3A0F0
.text:000000000003A0C8 41 01 00 54                   B.NE            loc_3A0F0
 
sub_3B4B8
.text:000000000003B508 1F 20 03 D5                   NOP
.text:000000000003B54C 0D FE FF 54                   B.LE            loc_3B50C
 
sub_3B570
.text:000000000003B5C0 1F 20 03 D5                   NOP
.text:000000000003B604 0D FE FF 54                   B.LE            loc_3B5C4
 
sub_3A924
.text:000000000003AA70 40 05 00 54                   B.EQ            loc_3AB18
.text:000000000003AAA0 C0 03 00 54                   B.EQ            loc_3AB18
.text:000000000003AAD4 A0 01 00 54                   B.EQ            loc_3AB08
.text:000000000003AB04 60 03 00 54                   B.EQ            loc_3AB70
 
sub_3B8CC
.text:000000000003B950 61 00 00 54                   B.NE            loc_3B95C
.text:000000000003B990 61 00 00 54                   B.EQ            loc_3B99C

修复后

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
unsigned __int64 __fastcall sub_3B8CC(__int64 a1)
{
  __int64 v1; // x0
  unsigned int v2; // w19
  __int64 v3; // x0
  char v4; // zf
  unsigned int v6; // [xsp+8h] [xbp-48h] BYREF
  unsigned int v7; // [xsp+Ch] [xbp-44h]
  unsigned int v8; // [xsp+10h] [xbp-40h] BYREF
  unsigned int v9; // [xsp+14h] [xbp-3Ch] BYREF
  __int64 v10; // [xsp+18h] [xbp-38h]

  v10 = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
  v6 = HIDWORD(a1);
  v7 = a1;
  sub_3B9D4(&v6);
  v8 = 0;
  v9 = bswap32(v6);

  v1 = sub_3A054();                             // 某个初始化函数
  if ( !(unsigned int)sub_3A924(v1, (__int64)&v9, 4u, (__int64)&v8, 4LL) )
    sub_367B0(0x11111111LL);
  v2 = v8;
  v8 = 0;
  v9 = bswap32(v7);
  v3 = sub_3A054();
  sub_3A924(v3, (__int64)&v9, 4u, (__int64)&v8, 4LL);
  if ( !v4 )
    sub_367B0(0x11111111LL);
  return v2 | ((unsigned __int64)v8 << 32);
}
sub_3A924
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
__int64 __fastcall sub_3A924(__int64 a1, __int64 a2, unsigned int a3, __int64 a4, __int64 a5)
{
  _QWORD *v10; // x0
  JNIEnv *v11; // x21
  jbyteArray v12; // x23
  void *v13; // x24
  const char *v14; // x25
  const char *v15; // x0
  jmethodID v16; // x0
  jmethodID v17; // x24
  __int64 v18; // x0
  void *v19; // x22
  unsigned int v20; // w19
  jbyte *v22; // x0
  int v23; // [xsp+8h] [xbp-C8h] BYREF
  int v24; // [xsp+Ch] [xbp-C4h] BYREF
  char v25[32]; // [xsp+10h] [xbp-C0h] BYREF
  char v26[24]; // [xsp+30h] [xbp-A0h] BYREF
  int v27; // [xsp+48h] [xbp-88h] BYREF
  __int16 v28; // [xsp+4Ch] [xbp-84h]
  char v29; // [xsp+4Eh] [xbp-82h]
  _QWORD v30[2]; // [xsp+4Fh] [xbp-81h]
  __int64 v31[2]; // [xsp+60h] [xbp-70h] BYREF
  __int16 v32; // [xsp+70h] [xbp-60h]
  __int64 v33; // [xsp+78h] [xbp-58h]

  v33 = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
  v10 = (_QWORD *)sub_1010C();
  sub_2D4B8(v26, *v10);
  v11 = (JNIEnv *)sub_2D588(v26);
  sub_125E4(v25, v11);
  v12 = (*v11)->NewByteArray(v11, a3);
  (*v11)->SetByteArrayRegion(v11, v12, 0LL, a3, (const jbyte *)a2);
  v13 = *(void **)(a1 + 32);
  v31[1] = 0LL;
  v32 = 0;
  v31[0] = 0xF712A53DC141FF65LL;
  v27 = 0xEECF7326;
  v14 = (const char *)sub_3B4B8((__int64)&v27, (__int64)v31);// 字符串解密
                                                // encrypt
  v30[0] = 0LL;
  *(_DWORD *)((char *)v30 + 7) = 0;
  v27 = 176175656;
  v28 = -22561;
  v29 = 70;
  v24 = 0xEECF7326;
  v15 = (const char *)sub_3B570((__int64)&v24, (__int64)&v27);// 字符串解密
                                                // ([B)[B
  v16 = (*v11)->GetStaticMethodID(v11, v13, v14, v15);
  if ( v16 )
  {
    v17 = v16;
    if ( (*v11)->ExceptionCheck(v11) )
    {
      v18 = sub_3ABBC(v11, *(_QWORD *)(a1 + 32), v17, v12);// CallMethod
      if ( v18 )
      {
        v19 = (void *)v18;
        if ( !(*v11)->ExceptionCheck(v11) )
        {
          sub_12660(v25, v19);
          v22 = (*v11)->GetByteArrayElements(v11, v19, 0LL);
          v23 = 0xEECF7326;
          sub_3AC58(&v23, a4, -1LL, v22, a5);
          v20 = 0;
          goto LABEL_7;
        }
      }
      (*v11)->ExceptionDescribe(v11);
    }
  }
  (*v11)->ExceptionClear(v11);
  v20 = -1;
LABEL_7:
  sub_125F0(v25);
  sub_2D56C(v26);
  return v20;
}

这里面似乎又用了JNI接口去调用java方法。由于并没有在jadx里面找到这个encrypt方法，因此猜测又是动态加载的。因此再一次用GG。

encrypt.dex（用GG修改器Dump）

  1. 首先frida-ps -U找到进程PID（进程名是mouse）
  2. 然后adb shell，su后，cat /proc/<pid>/maps | grep "encrypt"
  3. 然后再去GG里面复制内存，直接写上具体数字，用不着对着手机里的maps列表嗯看了。
1
2
3
130|crosshatch:/ # cat /proc/23943/maps | grep "encrypt"
792d83b000-792d83d000 r--p 00000000 fd:08 12496                          /data/data/com.com.sec2023.rocketmouse.mouse/files/encrypt.dex (deleted)
792d954000-792d955000 rw-p 00000000 fd:08 23949                          /data/data/com.com.sec2023.rocketmouse.mouse/files/oat/arm64/encrypt.vdex

deleted?，但我还是想把他dump出来。实在不行我就只能看.vdex了，不过还没仔细研究。

dump下来后，Jadx报错，一检查说是checksum有问题。因此直接关闭这个JADX中的checksum设置。

混淆极其严重，里面有一设计了一大堆恶心人的UTF8特殊字符作为字符串。

因此在JADX设置里面开启UTF转义。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
package sec2023;

/* loaded from: D:\Android\Rev\安卓客户端安全-初赛题目\dump\dump\com.com.sec2023.rocketmouse.mouse-792d83b000-792d85d000.bin */
public class Encrypt {
    /* JADX WARN: Multi-variable type inference failed */
    /* JADX WARN: Type inference failed for: r1v0 */
    /* JADX WARN: Type inference failed for: r1v1 */
    /* JADX WARN: Type inference failed for: r1v2, types: [int] */
    /* JADX WARN: Type inference failed for: r1v3 */
    public static byte[] encrypt(byte[] bArr) {
        byte[] bArr2 = null;
        String str = "\u06e2\u06e1\u06dc\u06d8\u06da\u06da\u06e0\u06d6\u06e8\u06dc\u06e4\u06d7\u06e2\u06d9\u06da\u06e1\u06d8\u06e1\u06e8\u06d6\u06d9\u06e0\u06d9\u06d7\u06dc\u06eb\u06e1\u06df\u06d6\u06e1\u06d7\u06e8\u06d8\u06e1\u06db\u06e0\u06da\u06d9\u06e1\u06d8\u06e4\u06e4\u06e4\u06d9\u06e0\u06e7";
        ?? r1 = 0;
        byte b = 0;
        int i = 0;
        int i2 = 0;
        while (true) {
            switch ((((str.hashCode() ^ 207) ^ 335) ^ 813) ^ (-475453606)) {
                case -1949514609:
                    bArr2[3] = (byte) (i & 255);
                    str = "\u06e7\u06db\u06e7\u06da\u06e4\u06e5\u06d8\u06d8\u06d7\u06e6\u06e5\u06df\u06e6\u06ec\u06e1\u06e1\u06d8\u06e4\u06d9\u06e7\u06e0\u06d8\u06db\u06d8\u06e1\u06e2\u06df\u06e1\u06e4\u06ec\u06db\u06ec\u06d7\u06d7\u06e8\u06e4\u06e0\u06e5\u06d8\u06e7\u06ec\u06e6\u06d6\u06e8\u06da";
                    break;
                case -1498437827:
                    bArr2 = new byte[4];
                    str = "\u06dc\u06e7\u06e6\u06d8\u06df\u06ec\u06dc\u06d8\u06e6\u06e0\u06eb\u06eb\u06e2\u06ec\u06e2\u06d7\u06ec\u06dc\u06d6\u06e8\u06df\u06d9\u06e6\u06e7\u06d7\u06e4\u06e4\u06d6\u06d7\u06e7\u06dc\u06e2\u06e8\u06e8\u06d9\u06dc\u06eb\u06eb\u06e6\u06e1\u06e4\u06d9\u06dc\u06d8";
                    break;
                case -1377289191:
                    bArr2[b] = (byte) (bArr2[b] + b);
                    str = "\u06e4\u06da\u06e5\u06d8\u06e6\u06d9\u06e8\u06d8\u06e5\u06e6\u06da\u06d6\u06ec\u06e8\u06d8\u06e4\u06e7\u06e0\u06d6\u06e4\u06e7\u06e7\u06e4\u06d8\u06d7\u06e1\u06d8\u06df\u06dc\u06d6\u06d8\u06e1\u06ec\u06d7\u06e7\u06da\u06e1\u06d8\u06eb\u06e5\u06eb";
                    break;
                case -1254104282:
                    str = "\u06eb\u06e2\u06d6\u06e8\u06d7\u06e6\u06d8\u06db\u06e4\u06e7\u06db\u06e8\u06dc\u06d8\u06d8\u06da\u06d6\u06d8\u06e4\u06e5\u06da\u06d9\u06e1\u06e5\u06d8\u06d8\u06dc\u06e4\u06e7\u06eb\u06d6\u06d7\u06e2";
                    b = 0;
                    break;
                case -1163833416:
                    str = "\u06eb\u06e2\u06d6\u06e8\u06d7\u06e6\u06d8\u06db\u06e4\u06e7\u06db\u06e8\u06dc\u06d8\u06d8\u06da\u06d6\u06d8\u06e4\u06e5\u06da\u06d9\u06e1\u06e5\u06d8\u06d8\u06dc\u06e4\u06e7\u06eb\u06d6\u06d7\u06e2";
                    break;
                case -1151204491:
                    i2 = (bArr[3] & 255) + ((bArr[0] << 24) & (-16777216)) + ((bArr[1] << 16) & 16711680) + ((bArr[2] << 8) & 65280);
                    str = "\u06eb\u06db\u06dc\u06d8\u06e4\u06e0\u06e2\u06e8\u06e7\u06df\u06e5\u06e8\u06e5\u06e5\u06dc\u06ec\u06e0\u06db\u06eb\u06e5\u06e1\u06d8\u06dc\u06e4\u06d6\u06d8\u06e6\u06e0\u06d8\u06e7\u06dc\u06da\u06dc\u06d6\u06d9\u06df\u06e5\u06d8";
                    break;
                case -997590982:
                    bArr2[2] = (byte) ((i >> 8) & 255);
                    str = "\u06e0\u06e1\u06db\u06e1\u06e2\u06d7\u06df\u06d9\u06e8\u06d8\u06da\u06e6\u06d7\u06d8\u06e1\u06d6\u06e7\u06d8\u06d6\u06d6\u06e5\u06e5\u06e1\u06da\u06d9\u06ec\u06dc\u06e7\u06d8\u06ec\u06e7\u06e5\u06d8\u06db\u06e8\u06d7\u06e5\u06db\u06e2";
                    break;
                case -789535785:
                    bArr2[0] = (byte) ((i >> 24) & 255);
                    str = "\u06db\u06d7\u06ec\u06dc\u06e1\u06e6\u06e8\u06dc\u06d6\u06d8\u06d8\u06df\u06d9\u06e0\u06d6\u06e7\u06e0\u06df\u06e5\u06e5\u06d8\u06e1\u06e1\u06e1\u06d9\u06e2\u06d8\u06eb\u06e5\u06e8\u06e6\u06d8\u06d9\u06e0\u06da\u06d6\u06da\u06e6\u06e0\u06e4\u06da\u06e4\u06eb\u06d7\u06e8\u06e7\u06dc\u06da\u06e7\u06e5\u06dc\u06d6\u06e7\u06df\u06db\u06d8";
                    break;
                case -613839074:
                    str = "\u06d7\u06e6\u06e0\u06dc\u06db\u06df\u06e5\u06ec\u06e0\u06e2\u06e4\u06d6\u06eb\u06e2\u06e7\u06dc\u06e6\u06e4\u06eb\u06e6\u06e8\u06d9\u06e1\u06d8\u06e8\u06da\u06e6\u06d8\u06e6\u06d9\u06e6\u06d8\u06da\u06db\u06e6\u06db\u06eb\u06e4";
                    b = r1;
                    break;
                case -536464064:
                    return bArr2;
                case -310231771:
                    bArr2[1] = (byte) ((i >> 16) & 255);
                    str = "\u06d6\u06e0\u06e0\u06d8\u06e8\u06dc\u06d8\u06e4\u06ec\u06e1\u06e8\u06dc\u06db\u06ec\u06d9\u06db\u06db\u06d6\u06e7\u06db\u06e4\u06ec\u06ec\u06e6\u06e8\u06df\u06eb\u06ec\u06da\u06e0";
                    break;
                case -292704642:
                    return null;
                case 24339473:
                    String str2 = "\u06d9\u06eb\u06df\u06e6\u06dc\u06e4\u06dc\u06e8\u06df\u06d7\u06da\u06df\u06e4\u06e7\u06d6\u06d8\u06eb\u06e6\u06d8\u06e8\u06d7\u06df\u06df\u06e5\u06d6\u06d7\u06df\u06e4\u06d9\u06e7\u06e1\u06df\u06ec\u06df\u06e7\u06e4\u06d6\u06d8\u06d6\u06e1\u06e7\u06d8\u06d9\u06d9\u06dc\u06d8";
                    while (true) {
                        switch (str2.hashCode() ^ (-80253450)) {
                            case -1358738638:
                                String str3 = "\u06e4\u06db\u06dc\u06d8\u06df\u06dc\u06e6\u06d8\u06e2\u06df\u06e8\u06d8\u06e4\u06e0\u06e1\u06d8\u06d6\u06e6\u06dc\u06d9\u06e0\u06df\u06d9\u06eb\u06e8\u06d8\u06db\u06d8\u06e0\u06d9\u06d6\u06d9\u06e1\u06e6\u06e7\u06d8";
                                while (true) {
                                    switch (str3.hashCode() ^ 1273023324) {
                                        case -1616392989:
                                            str3 = bArr.length != 4 ? "\u06df\u06e8\u06e7\u06dc\u06e6\u06db\u06e6\u06d9\u06da\u06e5\u06da\u06e5\u06d8\u06ec\u06df\u06ec\u06da\u06e5\u06e5\u06e6\u06df\u06e2\u06e0\u06e2\u06e5\u06d8\u06da\u06e7\u06d6\u06e2\u06e5\u06d8\u06d8\u06d9\u06e2\u06d8\u06df\u06eb\u06e4\u06ec\u06eb\u06d8\u06e5\u06e2\u06e6\u06d8\u06eb\u06db\u06e7\u06da\u06e1\u06e2\u06e5\u06e1\u06e4\u06da\u06d9\u06db" : "\u06e5\u06d9\u06d6\u06df\u06d6\u06d7\u06eb\u06e4\u06d8\u06d8\u06e5\u06e8\u06db\u06eb\u06dc\u06d8\u06e6\u06db\u06da\u06da\u06e8\u06eb\u06da\u06e8\u06da\u06e8\u06df\u06e5\u06d8\u06d9\u06d7\u06e8";
                                        case 67436560:
                                            str3 = "\u06e7\u06e5\u06d8\u06d8\u06d6\u06e2\u06eb\u06dc\u06d8\u06e6\u06e1\u06dc\u06d7\u06e2\u06e1\u06db\u06dc\u06e1\u06d6\u06d8\u06d8\u06d6\u06e6\u06d8\u06d7\u06ec\u06e8\u06eb\u06d8\u06d7\u06e1\u06da\u06ec\u06e8\u06d8\u06d8\u06e6\u06d7";
                                        case 557762990:
                                            str2 = "\u06e4\u06da\u06d6\u06e0\u06e8\u06e5\u06e5\u06d7\u06e2\u06e7\u06d7\u06e6\u06e5\u06d9\u06e7\u06e1\u06e4\u06ec\u06d6\u06dc\u06dc\u06d6\u06e7\u06d7\u06e1\u06e4\u06eb\u06e8\u06db\u06da\u06d6\u06dc\u06d8\u06ec\u06ec\u06dc\u06e8\u06d6\u06d8\u06e7\u06e4\u06e6\u06e2\u06dc\u06dc\u06dc\u06e8\u06e4";
                                            break;
                                        case 824079233:
                                            str2 = "\u06d8\u06e0\u06eb\u06d7\u06e0\u06df\u06e5\u06df\u06e4\u06e2\u06e2\u06eb\u06ec\u06d6\u06d9\u06e6\u06ec\u06eb\u06d9\u06e0\u06e4\u06da\u06e4\u06d9\u06e0\u06da\u06df\u06e8\u06e4\u06e2\u06db\u06e1\u06d8\u06eb\u06d8\u06e5\u06e8\u06d9\u06dc\u06e8\u06e1\u06e1";
                                            break;
                                    }
                                }
                                break;
                            case -631355797:
                                str = "\u06da\u06da\u06e5\u06d8\u06e2\u06d6\u06eb\u06db\u06e4\u06e8\u06da\u06df\u06e8\u06e2\u06e4\u06df\u06d9\u06da\u06d9\u06da\u06dc\u06e2\u06d7\u06e0\u06e1\u06d8\u06ec\u06e4\u06db\u06e0\u06e7\u06e5\u06e2\u06d8\u06d8\u06e7\u06da\u06d8\u06d8\u06e7\u06da\u06e6\u06d8\u06df\u06d8\u06e4";
                                continue;
                            case 1259555729:
                                str = "\u06eb\u06df\u06dc\u06d8\u06df\u06dc\u06df\u06d8\u06d8\u06e2\u06e1\u06e7\u06d8\u06ec\u06d9\u06d6\u06d8\u06d7\u06e0\u06e8\u06d8\u06e6\u06db\u06e1\u06e6\u06d6\u06d6\u06db\u06e1\u06d8\u06e4\u06e8\u06e6\u06d8\u06e0\u06e1\u06e8\u06d8\u06dc\u06da\u06e6\u06d8\u06e8\u06e7\u06e6\u06d8\u06e8\u06dc\u06ec";
                                continue;
                            case 1497141398:
                                str2 = "\u06db\u06e8\u06e1\u06d8\u06d6\u06d9\u06e0\u06d7\u06e4\u06d9\u06d9\u06df\u06d7\u06da\u06d8\u06d6\u06d8\u06d6\u06dc\u06e1\u06d8\u06e4\u06dc\u06e1\u06d7\u06df\u06ec\u06d7\u06e1\u06e1\u06d8\u06ec\u06dc\u06e4";
                        }
                    }
                    break;
                case 366525790:
                    i = (i2 >>> 7) | ((i2 & 127) << 25);
                    str = "\u06dc\u06da\u06d7\u06d8\u06d6\u06e1\u06d8\u06d9\u06eb\u06d7\u06d9\u06e7\u06d8\u06d8\u06d7\u06e6\u06e6\u06d8\u06e0\u06e1\u06e6\u06d8\u06da\u06eb\u06db\u06d8\u06e0\u06df\u06e8\u06d6\u06e4\u06e8\u06eb\u06e7\u06e1\u06e4\u06e5\u06df\u06df\u06e6\u06d6\u06ec\u06e2\u06e8\u06eb\u06ec\u06db\u06e1\u06eb\u06e1\u06da\u06eb\u06d8\u06d9\u06e1\u06e8";
                    break;
                case 457528267:
                    str = "\u06d6\u06d6\u06e6\u06e2\u06d7\u06e6\u06d8\u06e7\u06d7\u06e6\u06d6\u06d9\u06e5\u06e4\u06ec\u06d8\u06d8\u06e7\u06d7\u06e8\u06e0\u06db\u06df\u06da\u06e8\u06d9\u06e1\u06d8\u06e0\u06da\u06e6\u06eb\u06da\u06db\u06e7\u06ec\u06e1\u06d8";
                    break;
                case 618390897:
                    String str4 = "\u06dc\u06da\u06e4\u06d6\u06e2\u06e6\u06ec\u06e2\u06d8\u06df\u06e7\u06df\u06e7\u06dc\u06e4\u06e1\u06db\u06e1\u06d8\u06eb\u06e7\u06e1\u06d8\u06e5\u06e7\u06e5\u06d8\u06ec\u06db\u06e5\u06d8\u06ec\u06e8\u06e6\u06d8\u06eb\u06df\u06e8\u06dc\u06dc\u06d8";
                    while (true) {
                        switch (str4.hashCode() ^ 832736704) {
                            case -2058903085:
                                String str5 = "\u06e5\u06d9\u06dc\u06d8\u06d8\u06e4\u06e5\u06e2\u06d6\u06e0\u06da\u06eb\u06da\u06d9\u06dc\u06e6\u06df\u06e8\u06e5\u06d8\u06e8\u06e7\u06e0\u06e6\u06e7\u06d7\u06da\u06df\u06db\u06eb\u06e1\u06d8\u06d8\u06e2\u06eb\u06e8\u06d6\u06d6\u06d6\u06d8\u06e6\u06e7\u06e8\u06d8\u06e4\u06eb\u06d6\u06d8";
                                while (true) {
                                    switch (str5.hashCode() ^ (-761307794)) {
                                        case -1730425482:
                                            str4 = "\u06d6\u06e1\u06db\u06e1\u06d6\u06d8\u06d8\u06e0\u06ec\u06e0\u06d8\u06d8\u06da\u06e4\u06db\u06da\u06e6\u06e4\u06e6\u06e1\u06d6\u06d7\u06eb\u06d8\u06e7\u06e4\u06db\u06e5";
                                            break;
                                        case -559381948:
                                            str4 = "\u06df\u06db\u06e5\u06d8\u06e1\u06df\u06e1\u06d8\u06e2\u06e8\u06e1\u06d8\u06db\u06d7\u06e6\u06d8\u06e1\u06e6\u06e1\u06e0\u06e5\u06d8\u06e8\u06eb\u06d8\u06d8\u06eb\u06e5\u06e1\u06d8\u06e6\u06e5\u06dc\u06d8\u06e6\u06eb\u06e2\u06e4\u06e1\u06d8\u06e2\u06e1\u06d9\u06e6\u06e1\u06e4\u06eb\u06db\u06db\u06df\u06e1\u06eb\u06e8\u06e1\u06d6\u06d8\u06e7\u06ec\u06e0\u06e4\u06ec\u06db";
                                            break;
                                        case -344434253:
                                            str5 = b < bArr2.length ? "\u06e2\u06db\u06d7\u06e8\u06d9\u06ec\u06dc\u06eb\u06e2\u06e4\u06ec\u06e2\u06db\u06e1\u06e7\u06e0\u06d6\u06d8\u06d8\u06e5\u06e2\u06e5O\u06dc\u06d9\u06e8\u06d8\u06eb\u06d7\u06e1\u06d9\u06d6\u06d8\u06d8\u06e6\u06da\u06e8\u06e5\u06db\u06df\u06d8\u06d6\u06e7\u06d8\u06ec\u06df\u06d9\u06d8\u06e7\u06e0" : "\u06d8\u06e0\u06df\u06e5\u06dc\u06da\u06ec\u06df\u06e1\u06d8\u06dc\u06e6\u06e6\u06d8\u06ec\u06ec\u06d6\u06d8\u06dc\u06db\u06d8\u06d8\u06e0\u06e5\u06e8\u06d8\u06d7\u06df\u06da\u06e8\u06da\u06dc\u06db\u06e4\u06d9\u06ec\u06df\u06db\u06eb\u06e6\u06eb";
                                        case 1761895892:
                                            str5 = "\u06d6\u06e4\u06d7\u06e0\u06e4\u06e6\u06d6\u06d7\u06e1\u06d6\u06e5\u06da\u06db\u06e0\u06e4\u06e1\u06e5\u06e5\u06d8\u06e6\u06eb\u06e8\u06e4\u06ec\u06e8\u06d8\u06da\u06e0\u06d7\u06dc\u06e4\u06db\u06e7\u06e0\u06e6\u06e6\u06da\u06ec\u06e1\u06d8\u06dc\u06d8\u06ec\u06d7\u06ec\u06e2\u06dc\u06e5\u06e1\u06d8";
                                    }
                                }
                                break;
                            case -1219301069:
                                str = "\u06db\u06e6\u06d9\u06da\u06da\u06d7\u06ec\u06e5\u06da\u06dc\u06ec\u06e5\u06d8\u06d8\u06e5\u06e0\u06eb\u06db\u06eb\u06d9\u06dc\u06e1\u06ec\u06db\u06da\u06e6\u06d7\u06e8\u06d8\u06df\u06df\u06e2\u06d8\u06e8\u06d8\u06e4\u06d7\u06e6\u06e8\u06e1\u06d8\u06d6\u06e2\u06dc\u06d9\u06e0\u06ec\u06d8\u06e6\u06d6\u06d8";
                                continue;
                            case 503680307:
                                str4 = "\u06e1\u06e2\u06ec\u06ec\u06e6\u06e2\u06d6\u06dc\u06e4\u06e6\u06e4\u06d6\u06e4\u06da\u06e4\u06d7\u06db\u06e1\u06e2\u06ec\u06e1\u06d8\u06ec\u06d9\u06d9\u06ec\u06da\u06d6\u06d8\u06e4\u06e5\u06e1\u06e4\u06e1\u06e8\u06d8\u06d9\u06df\u06d9\u06eb\u06e6\u06e6\u06d8\u06e7\u06df\u06e5\u06d8";
                            case 1723654246:
                                str = "\u06dc\u06d7\u06e5\u06d8\u06da\u06ec\u06db\u06e8\u06df\u06d6\u06d8\u06d9\u06dc\u06e0\u06d9\u06dc\u06e6\u06d8\u06ec\u06e4\u06d8\u06d9\u06d6\u06dc\u06d8\u06e1\u06e7\u06e5\u06e4\u06dc\u06e7\u06d8\u06e5\u06eb\u06e1\u06ec\u06e2\u06e1\u06e0\u06da\u06e7\u06d7\u06dc\u06e5\u06e8\u06e8\u06d8\u06da\u06d9\u06d6\u06eb\u06db\u06db\u06e0\u06e2\u06d8\u06d9\u06ec\u06e4";
                                continue;
                        }
                    }
                    break;
                case 1125181772:
                    str = "\u06d6\u06dc\u06dc\u06d6\u06e7\u06e4\u06ec\u06e8\u06df\u06e7\u06db\u06e5\u06d8\u06da\u06e2\u06ec\u06e6\u06d7\u06e5\u06d8\u06e1\u06dc\u06da\u06e8\u06df\u06e8\u06d8\u06e5\u06da\u06e5\u06d8\u06e7\u06e7\u06d7\u06e7\u06d9\u06ec\u06e6\u06df\u06e2\u06e4\u06e0\u06e8\u06d8\u06dc\u06e1\u06d6\u06d8";
                    break;
                case 1527482667:
                    r1 = b + 1;
                    str = "\u06e6\u06ec\u06e2\u06da\u06d6\u06df\u06df\u06d6\u06e1\u06d8\u06df\u06e0\u06e1\u06d8\u06da\u06e2\u06e2\u06df\u06db\u06da\u06e4\u06e4\u06eb\u06e1\u06d6\u06e1\u06e5\u06d7\u06d8\u06d6\u06e5\u06e2\u06df\u06d7\u06df\u06e0\u06d6\u06dc\u06e6\u06d6\u06e4\u06e7\u06e7\u06df";
                    break;
                case 1538354559:
                    bArr2[b] = (byte) (bArr2[b] ^ new byte[]{50, -51, -1, -104, 25, -78, 124, -102}[b % 8]);
                    str = "\u06ec\u06d8\u06eb\u06dc\u06da\u06da\u06da\u06e1\u06e1\u06df\u06e6\u06eb\u06d6\u06eb\u06e1\u06e0\u06e7\u06d7\u06db\u06e8\u06e8\u06df\u06d8\u06d8\u06e8\u06e0\u06da\u06e7\u06d8\u06e6\u06d8\u06e8\u06e8\u06ec\u06e0\u06e8\u06ec";
                    break;
            }
        }
    }
}

稍微花点时间把平坦化给去掉的话，这里还是挺好恢复逻辑的。

逆算法

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
void Decode2(int* flag)
{
    char temp[] = {50, -51, -1, -104, 25, -78, 0x7C, -102};
    for(int j = 0; j < 2; ++j)
    {
        unsigned int v7 = flag[j];
        for(int i = 0; i < 4; ++i)
        {
            ((char *)&v7)[i] -= i;
            ((char *)&v7)[i] ^= temp[i % 8];
        }
 
        char v77[4] = {};
        v77[0] = ((char *)&v7)[3];
        v77[1] = ((char *)&v7)[2];
        v77[2] = ((char *)&v7)[1];
        v77[3] = ((char *)&v7)[0];
        v7 = *(int*)v77;
        //printf("0x%x\n", v7);
 
        v7 = (unsigned int)(v7 << 7) | (v7 >> 25);
 
        v77[0] = ((char *)&v7)[3];
        v77[1] = ((char *)&v7)[2];
        v77[2] = ((char *)&v7)[1];
        v77[3] = ((char *)&v7)[0];
        v7 = *(int*)v77;
        //printf("0x%x\n", v7);
        flag[j] = v7;
    }
}

TEA逆向（没有具体调试&Hook）

这是sub_763CFE1D64里的TEA。里面的初始化队列可以通过 hook InitializeArray 或者直接调试都可以拿到：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
int* DecodeTea(int RandNum)
{
    unsigned int v20 = 0xBEEFBEEF - 0x21524111 * 64;
    unsigned int v21 = 0x9D9D7DDE - 0x21524111 * 64;
    int v22 = 64;
    char key_char[] = {0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76};
 
    int* key = (int*)key_char;
    unsigned int v16 = RandNum;
    unsigned int v17 = 0;
    do
    {
        v21 += 0x21524111;
        v17 -= (v21 + key[(v21 >> 13) & 3]) ^ (((v16 << 8) ^ (v16 >> 7)) - v16);
        v20 += 0x21524111;
        v16 -= (v20 - key[v20 & 3]) ^ (((v17 << 7) ^ (v17 >> 8)) + v17);
        --v22;
    }
    while ( v22 );
    unsigned int* temp = (int*)malloc(8);
    temp[0] = v16;
    temp[1] = v17;
    return temp;
}

OO0OoOOo_Oo0__oOOoO0o0

为了方便识别，把OO0OoOOo_Oo0_o结构体的名字改成好识别的a1等。

然后把一些没用的if条件给删掉，得到：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
void __fastcall OO0OoOOo_Oo0__oOOoO0o0(OO0OoOOo_Oo0_o *this, const MethodInfo *method)
{
  __int64 v2; // x2
  OO0OoOOo_Oo0_o *v3; // x19
  __int64 v4; // x1
  __int64 v5; // x2
  struct System_UInt16_array *a1; // x8
  __int64 a5; // x9
  int32_t v8; // w20
  struct System_UInt16_array *v9; // x9
  int32_t v10; // w8

  v3 = this;
  a1 = v3->fields.a1;
  a5 = v3->fields.a5;
  while ( 1 )
  {
    this = (OO0OoOOo_Oo0_o *)OO0OoOOo_oO0OoOOo_TypeInfo;
    v8 = a1->m_Items[a5 + 2];

    if ( HIDWORD(this[2].fields.a8->fields._values) == v8 ) // 退出条件
      break;

    v9 = v3->fields.a1;
    v10 = v3->fields.a5;

    this = (OO0OoOOo_Oo0_o *)v3->fields.a8;
    v3->fields.a5 = v10 + 1;

    this = (OO0OoOOo_Oo0_o *)System_Collections_Generic_Dictionary_int__object___get_Item(
                               (System_Collections_Generic_Dictionary_TKey__TValue__o *)this,
                               v8,
                               (const MethodInfo_7C771C *)Method_System_Collections_Generic_Dictionary_int__Action__get_Item__);	

    this = (OO0OoOOo_Oo0_o *)((__int64 (__fastcall *)(OO0OoOOo_Oo0_c *, _QWORD))this->fields.a2)(
                               this[1].klass,
                               *(_QWORD *)&this->fields.a4);	// VM handler执行VM指令
    a1 = v3->fields.a1;
    a5 = v3->fields.a5;

  }
}

这很像一个虚拟机代码。其中a5就是PC寄存器，a1是汇编字节码。

获得VM汇编码（没具体调试&Hook）

在OO0OoOOo_Oo0__oOOoO0o0中：

1
2
v3 = this;
a1 = v3->fields.a1;

而this就是此函数的第一个形参：

1
void __fastcall OO0OoOOo_Oo0__oOOoO0o0(OO0OoOOo_Oo0_o *this, const MethodInfo *method)

因此回去看初始化函数OO0OoOOo_Oo0___ctor：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
// local variable allocation has failed, the output may be wrong!
void __fastcall OO0OoOOo_Oo0___ctor(
        OO0OoOOo_Oo0_o *this,
        System_UInt16_array *OoOOO00,
        int32_t oOOO0O0O,
        System_UInt32_array *OOoOO0,
        const MethodInfo *method)
{
  const MethodInfo *v9; // x1

  if ( (byte_763CDC33D8 & 1) == 0 )
  {
    sub_763BFB2B58((__int64)&uint___TypeInfo, (__int64)OoOOO00, *(__int64 *)&oOOO0O0O);
    byte_763CDC33D8 = 1;
  }
  System_Object___ctor((Il2CppObject *)this, 0LL);
  OO0OoOOo_Oo0__O000O000000o(this, v9);
  this->fields.a1 = OoOOO00;                    // 初始化函数的第二个参数就是VM字节码
  this->fields.a2 = OOoOO0;
  this->fields.a3 = (struct System_UInt32_array *)sub_763BFB2B90(uint___TypeInfo, 1000LL);
  this->fields.a7 = oOOO0O0O;
  this->fields.a4 = -1;
}

继续往上看它的调用：

1
OO0OoOOo_Oo0___ctor(v26, (System_UInt16_array *)v22, 0, num, v29);

v22在这里被初始化：

1
2
3
v22 = (System_Array_o *)sub_763BFB2B90(ushort___TypeInfo, 199LL);
v46.fields.value = Field__PrivateImplementationDetails__98C5DBCEF5D5D82C07C7B79290AED7B4B64180255F87038F6AD0459937EED610;
System_Runtime_CompilerServices_RuntimeHelpers__InitializeArray_9068608(v22, v46, 0LL);

这是一个199大小的Array，因此这里可以通过Hook或者动调来直接得到初始的VM字节码。

获取VM Handler

对VM代码里面经常使用的OO0OoOOo_oO0OoOOo_TypeInfo进行交叉引用，发现另一个函数对它的引用：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
void __fastcall OO0OoOOo_oO0OoOOo___cctor(const MethodInfo *method)
{
  __int64 v1; // x2
  int v2; // w3
  int v3; // w4
  int v4; // w5
  int v5; // w6
  int v6; // w7
  struct OO0OoOOo_oO0OoOOo_StaticFields *static_fields; // x8

  if ( (byte_763CDC33D6 & 1) == 0 )
  {
    sub_763BFB2B58((__int64)&OO0OoOOo_oO0OoOOo_TypeInfo, v1, v2, v3, v4, v5, v6, (unsigned __int8)byte_763CDC33D6);
    byte_763CDC33D6 = 1;
  }
  static_fields = OO0OoOOo_oO0OoOOo_TypeInfo->static_fields;
  *(_OWORD *)&static_fields->oO0OO0O0 = xmmword_763C877470;
  *(_OWORD *)&static_fields->oO0Oo000 = xmmword_763C877480;
  *(_OWORD *)&static_fields->oO0Oo00o = xmmword_763C877490;
  *(_OWORD *)&static_fields->Oo0OOO = xmmword_763C8774A0;
  *(_OWORD *)&static_fields->oO0O00OO = xmmword_763C8774B0;
  *(_QWORD *)&static_fields->OO0OO0O = 0x1600000015LL;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
.rodata:000000763C877470 xmmword_763C877470 DCB 1, 0, 0, 0, 2, 0, 0, 0, 3, 0, 0, 0, 4, 0, 0, 0
.rodata:000000763C877470                                         ; DATA XREF: OO0OoOOo.oO0OoOOo$$.cctor+34↑o
.rodata:000000763C877470                                         ; OO0OoOOo.oO0OoOOo$$.cctor+38↑r
.rodata:000000763C877480 xmmword_763C877480 DCB 5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0
.rodata:000000763C877480                                         ; DATA XREF: OO0OoOOo.oO0OoOOo$$.cctor+3C↑o
.rodata:000000763C877480                                         ; OO0OoOOo.oO0OoOOo$$.cctor+40↑r
.rodata:000000763C877490 xmmword_763C877490 DCB 9, 0, 0, 0, 0xA, 0, 0, 0, 0xB, 0, 0, 0, 0xC, 0, 0
.rodata:000000763C877490                                         ; DATA XREF: OO0OoOOo.oO0OoOOo$$.cctor+48↑o
.rodata:000000763C877490                                         ; OO0OoOOo.oO0OoOOo$$.cctor+4C↑r
.rodata:000000763C877490                 DCB 0
.rodata:000000763C8774A0 xmmword_763C8774A0 DCB 0xD, 0, 0, 0, 0xE, 0, 0, 0, 0xF, 0, 0, 0, 0x10, 0
.rodata:000000763C8774A0                                         ; DATA XREF: OO0OoOOo.oO0OoOOo$$.cctor+50↑o
.rodata:000000763C8774A0                                         ; OO0OoOOo.oO0OoOOo$$.cctor+54↑r
.rodata:000000763C8774A0                 DCB 0, 0
.rodata:000000763C8774B0 xmmword_763C8774B0 DCB 0x11, 0, 0, 0, 0x12, 0, 0, 0, 0x13, 0, 0, 0, 0x14
.rodata:000000763C8774B0                                         ; DATA XREF: OO0OoOOo.oO0OoOOo$$.cctor+58↑o
.rodata:000000763C8774B0                                         ; OO0OoOOo.oO0OoOOo$$.cctor+60↑r
.rodata:000000763C8774B0                 DCB 0, 0, 0

可以发现1-22数字（4字节DWORD）

以及函数OO0OoOOo_Oo0__O000O000000o：（下面取部分代码片段）

1
2
3
4
5
6
7
8
9
10
11
OO0OO0 = OO0OoOOo_oO0OoOOo_TypeInfo->static_fields->OO0OO0;
v177 = (System_Collections_Generic_Dictionary_TKey__TValue__o *)sub_763BFB2C30(qword_763CD442B0, v189);
if ( !v177 )
  goto LABEL_29;
v190 = (Il2CppObject *)v177;
System_Action___ctor((System_Action_o *)v177, (Il2CppObject *)this, Method_OO0OoOOo_Oo0_OOOOOO0__, 0LL);
System_Collections_Generic_Dictionary_int__object___Add(
  v180,
  OO0OO0,
  v190,
  (const MethodInfo_7C77D0 *)Method_System_Collections_Generic_Dictionary_int__Action__Add__);

这里显然就是将其设置成了VM方法Method_OO0OoOOo_Oo0_OOOOOO0__，这个的注释上会写上具体函数的偏移的（只要正确运行了il2cppdumper的那个脚本），即可找到真正的Handler函数。

而实际上每个VM Handler也可以直接在函数列表里面找到，只要搜索OO0OoOOo.Oo0即可，会出现一大堆OO0OoOOo.Oo0$$开头的函数，就是VM Handler。

VM Handler逆向
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
dispatcher
{
    a5++;
    get_Item(key: cmd->m_Items[a5 - 1]).method();
}
 
1//add
{
    v6 = buffer->m_Items[a4];
    v8 = buffer->m_Items[a4 - 1];
    buffer->m_Items[--a4] = v8 + v6;
}
 
2//sub
{
    v6 = buffer->m_Items[a4];
    v8 = buffer->m_Items[a4 - 1];
    buffer->m_Items[--a4] = v8 - v6;
}
 
4//<
{
    v6 = buffer->m_Items[a4];
    v8 = buffer->m_Items[a4 - 1];
    buffer->m_Items[--a4] = v8 < v6;
}
 
5//==
{
    v6 = buffer->m_Items[a4];
    v8 = buffer->m_Items[a4 - 1];
    buffer->m_Items[--a4] = v8 == v6;
}
 
7//je
{
    if ( buffer->m_Items[a4--] == 1 )
        v7 = cmd->m_Items[v5];
    else
        v7 = a5 + 1;
    a5 = v7;
}
 
8//je
{
    if ( buffer->m_Items[a4--] )
        v7 = a5 + 1;
    else
        v7 = cmd->m_Items[v5];
    a5 = v7;
}
 
9//push from cmd[]
{
   buffer->m_Items[++a4] = cmd->m_Items[a5++];
}
 
a//[]
{
    buffer->m_Items[a4] = input->m_Items[buffer->m_Items[a4]];
}
 
b//push from input[cmd[]]
{
    buffer->m_Items[++a4] = input->m_Items[cmd->m_Items[a5++]];
}
 
d//pop
{
    input->m_Items[cmd->m_Items[a5++]] = buffer->m_Items[a4--];
}
 
13//>>
{
    v6 = buffer->m_Items[a4];
    v8 = buffer->m_Items[a4 - 1];
    buffer->m_Items[--a4] = v8 >> v6;
}
 
14//<<
{
    v6 = buffer->m_Items[a4];
    v8 = buffer->m_Items[a4 - 1];
    buffer->m_Items[--a4] = v8 >> v6;
}
 
15//and
{
    v6 = buffer->m_Items[a4];
    v8 = buffer->m_Items[a4 - 1];
    buffer->m_Items[--a4] = v6 & v8;
}
 
16//xor
{
    v6 = buffer->m_Items[a4];
    v8 = buffer->m_Items[a4 - 1];
    buffer->m_Items[--a4] = v6 ^ v8;
}

注册机代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
#include<stdio.h>
#include <stdlib.h>
 
void vmDecode(int* flag)
{
    for(int i = 0; i <= 3; ++i)
        ((char*)flag)[4 + i] -= i * 8;
 
    ((char*)flag)[7] ^= 0x98;
    ((char*)flag)[6] -= 0x37;
    ((char*)flag)[5] ^= 0xb6;
    ((char*)flag)[4] += 0x2f;
 
    for(int i = 0; i <= 3; ++i)
        ((char*)flag)[i] ^= i * 8;
 
    ((char*)flag)[3] ^= 0x36;
    ((char*)flag)[2] -= 0xa8;
    ((char*)flag)[1] ^= 0xc2;
    ((char*)flag)[0] += 0x1b;
}
 
void Decode2(int* flag)
{
    char temp[] = {50, -51, -1, -104, 25, -78, 0x7C, -102};
    for(int j = 0; j < 2; ++j)
    {
        unsigned int v7 = flag[j];
        for(int i = 0; i < 4; ++i)
        {
            ((char *)&v7)[i] -= i;
            ((char *)&v7)[i] ^= temp[i % 8];
        }
 
        char v77[4] = {};
        v77[0] = ((char *)&v7)[3];
        v77[1] = ((char *)&v7)[2];
        v77[2] = ((char *)&v7)[1];
        v77[3] = ((char *)&v7)[0];
        v7 = *(int*)v77;
        //printf("0x%x\n", v7);
 
        v7 = (unsigned int)(v7 << 7) | (v7 >> 25);
 
        v77[0] = ((char *)&v7)[3];
        v77[1] = ((char *)&v7)[2];
        v77[2] = ((char *)&v7)[1];
        v77[3] = ((char *)&v7)[0];
        v7 = *(int*)v77;
        //printf("0x%x\n", v7);
        flag[j] = v7;
    }
}
 
void Decode1(unsigned int* flag)
{
    for(int j = 0; j < 2; ++j)
    {
        unsigned int v7 = flag[j];
        //v7 += 0x18100800;
        ((unsigned char *)&v7)[0] += 0x00;
        ((unsigned char *)&v7)[1] += 0x08;
        ((unsigned char *)&v7)[2] += 0x10;
        ((unsigned char *)&v7)[3] += 0x18;
 
        ((unsigned char *)&v7)[3] ^= 0x86;
        ((unsigned char *)&v7)[2] += 94;
        ((unsigned char *)&v7)[1] ^= 0xD3;
        ((unsigned char *)&v7)[0] += 28;
 
        for(int i = 3; i >= 0; --i)
        {
            ((unsigned char*)flag)[j * 4 + i] = (unsigned char)(v7 >> (i * 8)) ^ i;
        }
    }
}
 
void ObfuDecode(unsigned int* flag)//sub_3B8CC
{
    vmDecode(flag);
 
    Decode2(flag);//sub_3A054
 
    char v77[4] = {};
    v77[0] = ((char *)flag)[3];
    v77[1] = ((char *)flag)[2];
    v77[2] = ((char *)flag)[1];
    v77[3] = ((char *)flag)[0];
    flag[0] = *(int*)v77;
 
 
    v77[0] = ((char *)flag)[7];
    v77[1] = ((char *)flag)[6];
    v77[2] = ((char *)flag)[5];
    v77[3] = ((char *)flag)[4];
    flag[1] = *(int*)v77;
 
 
    Decode1(flag);//sub_3B9D4
 
}
 
int* DecodeTea(int RandNum)
{
    unsigned int v20 = 0xBEEFBEEF - 0x21524111 * 64;
    unsigned int v21 = 0x9D9D7DDE - 0x21524111 * 64;
    int v22 = 64;
    char key_char[] = {0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76};
 
    int* key = (int*)key_char;
    unsigned int v16 = RandNum;
    unsigned int v17 = 0;
    do
    {
        v21 += 0x21524111;
        v17 -= (v21 + key[(v21 >> 13) & 3]) ^ (((v16 << 8) ^ (v16 >> 7)) - v16);
        v20 += 0x21524111;
        v16 -= (v20 - key[v20 & 3]) ^ (((v17 << 7) ^ (v17 >> 8)) + v17);
        --v22;
    }
    while ( v22 );
    unsigned int* temp = (int*)malloc(8);
    temp[0] = v16;
    temp[1] = v17;
    return temp;
}
 
 
int main()
{
    printf("pls input rand:");
    int rand;
    scanf("%d", &rand);
    int* temp = DecodeTea(rand);
 
    //unsigned int* temp = malloc(10);
    //temp[0] = 0x4d09f96f;
    //temp[1] = 0x2d55b70a;
 
    ObfuDecode(temp);
 
    printf("%llu\n", (((unsigned long long)temp[0]<<32) | (temp[1] & 0xffffffff)));
    free(temp);
}

参考

[原创]细品sec2023安卓赛题-Android安全-看雪-安全社区|安全招聘|kanxue.com

Perfare/Il2CppDumper: Unity il2cpp reverse engineer (github.com)

[Tutorial] Il2CppDumper tutorial finding CodeRegistration and MetadataRegistration (unknowncheats.me)

[求助]如何修改frida-server 服务端的默认监听端口？-求助问答-看雪-安全社区|安全招聘|kanxue.com

Java Native Interface Specification: 4 - JNI Functions (oracle.com)

[原创]2023腾讯游戏安全竞赛初赛题解(安卓)-Android安全-看雪-安全社区|安全招聘|kanxue.com（已经阅读完）

tag:

    缺失模块。
    1、请确保node版本大于6.2
    2、在博客根目录（注意不是yilia-plus根目录）执行以下命令：
    npm i hexo-generator-json-content --save

    3、在根目录_config.yml里添加配置： 

      jsonContent:
    meta: false
    pages: false
    posts:
      title: true
      date: true
      path: true
      text: false
      raw: false
      content: false
      slug: false
      updated: false
      comments: false
      link: false
      permalink: false
      excerpt: false
      categories: false
      tags: true

A junior undergraduate
studying in the college of cyber science and engineering
in Sichuan University
in Sichuan , China.
Pronouns:He/him.
A core member of 0x401 CTF team
majorly focus on Reverse Engineering chanllenges.