Android逆向解题-羊城杯2023-ezAndroid

2023-10-11

字数统计: 376字 | 阅读时长≈ 2分

Java

1	com.example.ezandroid

“com.example.ezandroid.S2”

“com.example.ezandroid.S”

这是主界面


static {
    System.loadLibrary("android");
}

1	public native String Stringfjni();

1	public native void onCreate(Bundle bundle);

1	public native void onClick(View view);

class AnonymousClass2 implements DialogInterface.OnClickListener {
    AnonymousClass2() {
    }

    @Override // android.content.DialogInterface.OnClickListener
    public void onClick(DialogInterface dialogInterface, int i) {
        S.this.startActivity(new Intent(S.this, S2.class));
    }
}

还有个C类


/* loaded from: classes.dex */
public class C {
    public static native boolean cf(String str, int i);

    static {
        System.loadLibrary("ezandroid");
    }
}

Native

T1 找出导出函数

Unidbg（报错）
静态（有混淆）
Frida
- 可以使用，没有反调试
动调

LABEL_64:
  v82 = env[0];
  v83 = (*env[0])->FindClass(env[0], aComExampleEzan);// com/example/ezandroid/S
  if ( !v83 )
    return -1;
  if ( (((__int64 (__fastcall *)(JNIEnv *, jclass, char **, __int64))(*v82)->RegisterNatives)(
          v82,
          v83,
          &off_7B7A0891D8,                      // onCreate
          1LL) & 0x80000000) != 0 )
    return -1;
  v84 = (__int64)(*v82)->FindClass(v82, aComExampleEzan_0);// com/example/ezandroid/S2
  if ( !v84 )
    return -1;
  if ( (((__int64 (__fastcall *)(JNIEnv *, __int64, char **, __int64))(*v82)->RegisterNatives)(
          v82,
          v84,
          &off_7B7A0891F0,                      // onCreate
          1LL) & 0x80000000) != 0 )
    return -1;
  v85 = (__int64)(*v82)->FindClass(v82, aComExampleEzan_1);// com/example/ezandroid/MU
  if ( !v85 )
    return -1;
  if ( (((__int64 (__fastcall *)(JNIEnv *, __int64, char **, __int64))(*v82)->RegisterNatives)(
          v82,
          v85,
          &off_7B7A089208,                      // GMS
          1LL) & 0x80000000) != 0 )
    return -1;
  v86 = (__int64)(*v82)->FindClass(v82, aComExampleEzan_2);// com/example/ezandroid/C
  if ( !v86 )
    return -1;
  if ( (((__int64 (__fastcall *)(JNIEnv *, __int64, char **, __int64))(*v82)->RegisterNatives)(
          v82,
          v86,
          &off_7B7A089220,                      // cf
          1LL) & 0x80000000) != 0 )
    return -1;
  v87 = (__int64)(*v82)->FindClass(v82, aComExampleEzan_3);// com/example/ezandroid/S$1
  if ( !v87 )
    return -1;
  if ( (((__int64 (__fastcall *)(JNIEnv *, __int64, char **, __int64))(*v82)->RegisterNatives)(
          v82,
          v87,
          &off_7B7A089238,                      // onClick
          1LL) & 0x80000000) != 0 )
    return -1;
  v88 = (__int64)(*v82)->FindClass(v82, aComExampleEzan_4);// com/example/ezandroid/S2$1
  if ( !v88
    || (((__int64 (__fastcall *)(JNIEnv *, __int64, char **, __int64))(*v82)->RegisterNatives)(
          v82,
          v88,
          &off_7B7A089250,                      // onClick
          1LL) & 0x80000000) != 0 )
  {
    return -1;
  }
  return v2;
}

本文作者： Taardis
本文链接： https://taardisaa.github.io/2023/10/11/Android逆向解题-羊城杯2023-ezAndroid/
版权声明： 本博客所有文章除特别声明外，均采用 Apache License 2.0 许可协议。转载请注明出处！