专栏首页逆向与安全APK加固之类抽取分析与修复

APK加固之类抽取分析与修复

0x00 简单介绍

目前我己知的APK加固主要有以下两种方式(或有其它的方式有待发现)

隐藏dex文件:通过对目标DEX文件进行整体加密或压缩方式把整个dex转换为另外一个文件存放在assets文件夹中或者其它地方,然后利用类加载器技术进行内存解密并加载运行。

修改dex结构:抽取DexCode中的字节码指令后用零去填充,或者修改方法属性等操作,运行时在内存中做修正、修复等处理工作。

0x01 APK加固前后对比

整体来看一下原始APK包和加固后的APK包结构相关变化

图1所示加固后的APK包变化如下:

新增2个文件夹:

assets文件夹中增加3个文件

data

dx

pk

lib文件夹中增加了2个so文件

libedog.so

libfdog.so

被修改的文件:

AndroidManifest.xml

classes.dex

0x02 壳流程分析

    我们用AndroidKiller反编译加固后的APK, 反编译出错,错误日志如下:

从图2可以看出反编译时出现了很多错误,我们用IDA对DEX进行反编译查看代码,发现方法指令都被零填充了,反编译后代码显示为nop样式,如图3所示。

         图3

我们再来看看APK中的AndroidManifest.xml文件被修改了什么地方?

从图4看到AndroidManifest.xml中的application新增了如下项做为壳的入口

android:name="com.edog.AppWrapper"该类为壳的入口,继续分析AppWrapper都做了些什么?

         图5

         图6

         图7

从图5-7可以看出最终会调用到libedog.so中的dl函数,下面就开始动态调试分析该so的功能流程(如何动态调试就不说了,网上己经有很多的教程了)。

通过动态分析libedog.so中的dl函数主要功能是: 获得系统版本号->验证加固前后的签名是否一致->反调试->将抽走的指令映射到内存中还原指令时用到->HOOK函数dvmResolveClass->结束

代码流程如下:

 1 libedog.so:5D692C18             Java_com_edog_ELibrary_d1
 2 libedog.so:5D692C18
 3 libedog.so:5D692C18             var_F0= -0xF0
 4 libedog.so:5D692C18             var_EC= -0xEC
 5 libedog.so:5D692C18             var_E4= -0xE4
 6 libedog.so:5D692C18             var_1C= -0x1C
 7 libedog.so:5D692C18             arg_0=  0
 8 libedog.so:5D692C18
 9 libedog.so:5D692C18 F0 B5       PUSH            {R4-R7,LR}
10 libedog.so:5D692C1A 28 4F       LDR             R7, =(dword_5D6A5E60 - 0x5D692C24)
11 libedog.so:5D692C1C B7 B0       SUB             SP, SP, #0xDC
12 libedog.so:5D692C1E 00 93       STR             R3, [SP,#0xF0+var_F0]
13 libedog.so:5D692C20 7F 44       ADD             R7, PC ; dword_5D6A5E60
14 libedog.so:5D692C22 3F 68       LDR             R7, [R7]
15 libedog.so:5D692C24 3C 99       LDR             R1, [SP,#0xF0+arg_0]
16 libedog.so:5D692C26 04 1C       MOVS            R4, R0
17 libedog.so:5D692C28 3B 68       LDR             R3, [R7]
18 libedog.so:5D692C2A 01 91       STR             R1, [SP,#0xF0+var_EC]
19 libedog.so:5D692C2C A9 21       MOVS            R1, #0xA9
20 libedog.so:5D692C2E 35 93       STR             R3, [SP,#0xF0+var_1C]
21 libedog.so:5D692C30 03 68       LDR             R3, [R0]
22 libedog.so:5D692C32 89 00       LSLS            R1, R1, #2
23 libedog.so:5D692C34 22 4D       LDR             R5, =(aFjFj0fjFjFj4fj - 0x5D692C42)
24 libedog.so:5D692C36 5B 58       LDR             R3, [R3,R1]
25 libedog.so:5D692C38 11 1C       MOVS            R1, R2
26 libedog.so:5D692C3A 00 22       MOVS            R2, #0
27 libedog.so:5D692C3C 98 47       BLX             R3
28 libedog.so:5D692C3E 7D 44       ADD             R5, PC                  ; "$fj] fj]0fj](fj],fj]4fj]i]"
29 libedog.so:5D692C40 2D 68       LDR             R5, [R5]                ; "$fj] fj]0fj](fj],fj]4fj]i]"
30 libedog.so:5D692C42 20 4E       LDR             R6, =(aFjFj0fjFjFj4fj+4 - 0x5D692C50)
31 libedog.so:5D692C44 28 60       STR             R0, [R5]
32 libedog.so:5D692C46 20 1C       MOVS            R0, R4
33 libedog.so:5D692C48 00 F0 5C F8 BL              _Z17ANDROID_API_LEVELP7_JNIEnv
34 libedog.so:5D692C4C 7E 44       ADD             R6, PC                  ; " fj]0fj](fj],fj]4fj]i]"
35 libedog.so:5D692C4E 36 68       LDR             R6, [R6]                ; " fj]0fj](fj],fj]4fj]i]"
36 libedog.so:5D692C50 30 60       STR             R0, [R6]
37 libedog.so:5D692C52 20 1C       MOVS            R0, R4
38 libedog.so:5D692C54 00 F0 82 F8 BL              _Z24ANDROID_PLATFORM_VERSIONP7_JNIEnv
39 libedog.so:5D692C58 20 1C       MOVS            R0, R4
40 libedog.so:5D692C5A 00 F0 A9 F8 BL              _Z22ANDROID_PLATFORM_MODELP7_JNIEnv
41 libedog.so:5D692C5E 20 1C       MOVS            R0, R4
42 libedog.so:5D692C60 00 F0 D0 F8 BL              _Z22ANDROID_PLATFORM_BRANDP7_JNIEnv
43 libedog.so:5D692C64 20 1C       MOVS            R0, R4
44 libedog.so:5D692C66 01 99       LDR             R1, [SP,#0xF0+var_EC]
45 libedog.so:5D692C68 00 F0 8A FC BL              _Z6verifyP7_JNIEnvP8_jobject ; 比较加固前后的签名是否一致
46 libedog.so:5D692C6C 16 49       LDR             R1, =(aDataDataSLibLi - 0x5D692C76)
47 libedog.so:5D692C6E 2A 68       LDR             R2, [R5]
48 libedog.so:5D692C70 03 A8       ADD             R0, SP, #0xF0+var_E4
49 libedog.so:5D692C72 79 44       ADD             R1, PC                  ; "/data/data/%s/lib/libfdog.so"
50 libedog.so:5D692C74 FF F7 B0 EE BLX             sprintf
51 libedog.so:5D692C78 03 A8       ADD             R0, SP, #0xF0+var_E4
52 libedog.so:5D692C7A 01 1C       MOVS            R1, R0
53 libedog.so:5D692C7C 00 F0 02 FD BL              _Z4antiPKcS0_           ; 反调试
54 libedog.so:5D692C80 00 F0 3E F9 BL              _Z10openMemoryv         ; 将抽走的指令映射到内存中来
55 libedog.so:5D692C80                                                     ; assets中的data文件
56 libedog.so:5D692C84 23 68       LDR             R3, [R4]
57 libedog.so:5D692C86 A9 22 92 00 MOVS            R2, #0x2A4
58 libedog.so:5D692C8A 9B 58       LDR             R3, [R3,R2]
59 libedog.so:5D692C8C 00 99       LDR             R1, [SP,#0xF0+var_F0]
60 libedog.so:5D692C8E 20 1C       MOVS            R0, R4
61 libedog.so:5D692C90 00 22       MOVS            R2, #0
62 libedog.so:5D692C92 98 47       BLX             R3
63 libedog.so:5D692C94 0D 49       LDR             R1, =(unk_5D6A2A0D - 0x5D692C9A)
64 libedog.so:5D692C96 79 44       ADD             R1, PC
65 libedog.so:5D692C98 FF F7 A4 EE BLX             strstr
66 libedog.so:5D692C9C 00 28       CMP             R0, #0
67 libedog.so:5D692C9E 02 D1       BNE             loc_5D692CA6
68 libedog.so:5D692CA0 33 68       LDR             R3, [R6]
69 libedog.so:5D692CA2 14 2B       CMP             R3, #0x14               ; 判断版本
70 libedog.so:5D692CA4 00 DD       BLE             loc_5D692CA8            ; 根据操作系统的版本
71 libedog.so:5D692CA4                                                     ; hook对应的dvmResolveClass函数
72 libedog.so:5D692CA6
73 libedog.so:5D692CA6             loc_5D692CA6                            ; CODE XREF: Java_com_edog_ELibrary_d1+86j
74 libedog.so:5D692CA6 01 20       MOVS            R0, #1
75 libedog.so:5D692CA8
76 libedog.so:5D692CA8             loc_5D692CA8                            ; CODE XREF: Java_com_edog_ELibrary_d1+8Cj
77 libedog.so:5D692CA8 00 F0 E8 FB BL              _Z7restorei             ; 根据操作系统的版本
78 libedog.so:5D692CA8                                                     ; hook对应的dvmResolveClass函数
79 libedog.so:5D692CAC 35 9A       LDR             R2, [SP,#0xF0+var_1C]
80 libedog.so:5D692CAE 3B 68       LDR             R3, [R7]
81 libedog.so:5D692CB0 9A 42       CMP             R2, R3
82 libedog.so:5D692CB2 01 D0       BEQ             loc_5D692CB8
83 libedog.so:5D692CB4 FF F7 9C EE BLX             sub_5D6929F0
84 libedog.so:5D692CB8             ; ---------------------------------------------------------------------------
85 libedog.so:5D692CB8
86 libedog.so:5D692CB8             loc_5D692CB8                            ; CODE XREF: Java_com_edog_ELibrary_d1+9Aj
87 libedog.so:5D692CB8 37 B0       ADD             SP, SP, #0xDC
88 libedog.so:5D692CBA F0 BD       POP             {R4-R7,PC}
89 libedog.so:5D692CBA             ; End of function Java_com_edog_ELibrary_d1
90 libedog.so:5D692CBA
91 libedog.so:5D692CBA             ; -------------------------------------

0x03 指令还原算法分析

原始指令还原时机就是在dvmResolveClass的hook函数中对对指令进行解密还原,以下结构的中的几个值会用到,因为被保护后的方法中的 debugInfoOff的值被修改成从0x20000000开始的一个值,该值在指令还原时起到重要作用。

1 struct DexCode {
2     u2  registersSize;
3     u2  insSize;
4     u2  outsSize;
5     u2  triesSize;
6     u4  debugInfoOff;      /* file offset to debug info stream */
7     u4  insnsSize;        /* size of the insns array, in u2 units */
8     u2  insns[1];
9 };

指令还原大致流程如下:

判断是否为保护的类->判断debuginfo值大于0x1FFFFFFF->将debuginfo值左移8位再右移6位->将移位后的值加上加密指令在内存中的开始址取4字节做为偏移->将偏移加上加密指令在内存中的开始地址定位到对应方法的指令->解密指令并还原->清零debuginfo值->结束。

解密指令算法流程如下:(每4字节进行xor)

XorArray函数中进行解密操作->将方法debuginfo值进行crc32计算得到一个值->crc32计算得到的值与指令每4字节进行xor->4字节结束后再将crc32值用PolyXorKey函数生成一个新的4字节数做为密钥,一直循环到解密完成。

代码流程如下

  1 libedog.so:5D693144
  2 libedog.so:5D693144             _Z13restoreMethodP11ClassObjectP6Method ; CODE XREF: _Z10replaceFunP11ClassObjectjb+22p
  3 libedog.so:5D693144                                                     ; _Z10replaceFunP11ClassObjectjb+3Ap
  4 libedog.so:5D693144
  5 libedog.so:5D693144             var_34= -0x34
  6 libedog.so:5D693144             Debug_info= -0x30
  7 libedog.so:5D693144             var_2C= -0x2C
  8 libedog.so:5D693144             codeSize= -0x28
  9 libedog.so:5D693144             data= -0x24
 10 libedog.so:5D693144             codeoffset= -0x1C
 11 libedog.so:5D693144
 12 libedog.so:5D693144 F0 B5       PUSH            {R4-R7,LR}
 13 libedog.so:5D693146 89 B0       SUB             SP, SP, #0x24
 14 libedog.so:5D693148 0F 1E       SUBS            R7, R1, #0
 15 libedog.so:5D69314A 5C D0       BEQ             loc_5D693206
 16 libedog.so:5D69314C 84 69       LDR             R4, [R0,#0x18]
 17 libedog.so:5D69314E 00 2C       CMP             R4, #0
 18 libedog.so:5D693150 59 D0       BEQ             loc_5D693206
 19 libedog.so:5D693152 20 1C       MOVS            R0, R4
 20 libedog.so:5D693154 4C 21       MOVS            R1, #'L'
 21 libedog.so:5D693156 FF F7 A0 EC BLX             strchr
 22 libedog.so:5D69315A 00 28       CMP             R0, #0
 23 libedog.so:5D69315C 53 D0       BEQ             loc_5D693206
 24 libedog.so:5D69315E 3E 6A       LDR             R6, [R7,#0x20]
 25 libedog.so:5D693160 00 2E       CMP             R6, #0
 26 libedog.so:5D693162 50 D0       BEQ             loc_5D693206
 27 libedog.so:5D693164 35 1C       MOVS            R5, R6
 28 libedog.so:5D693166 10 3D       SUBS            R5, #0x10
 29 libedog.so:5D693168 AA 68       LDR             R2, [R5,#8]
 30 libedog.so:5D69316A 02 92       STR             R2, [SP,#0x38+Debug_info]
 31 libedog.so:5D69316C EB 88       LDRH            R3, [R5,#6]
 32 libedog.so:5D69316E EA 68       LDR             R2, [R5,#0xC]
 33 libedog.so:5D693170 03 93       STR             R3, [SP,#0x38+var_2C]
 34 libedog.so:5D693172 04 92       STR             R2, [SP,#0x38+codeSize]
 35 libedog.so:5D693174 25 4B       LDR             R3, =0x1FFFFFFF
 36 libedog.so:5D693176 02 9A       LDR             R2, [SP,#0x38+Debug_info]
 37 libedog.so:5D693178 9A 42       CMP             R2, R3                  ; 判断debuginfo值大于 0x1FFFFFFF (因为被保护的方法debuginfo从0X20000000开始)
 38 libedog.so:5D69317A 44 D9       BLS             loc_5D693206
 39 libedog.so:5D69317C 24 49       LDR             R1, =(aLandroid - 0x5D693184)
 40 libedog.so:5D69317E 20 1C       MOVS            R0, R4
 41 libedog.so:5D693180 79 44       ADD             R1, PC                  ; "Landroid/"
 42 libedog.so:5D693182 FF F7 30 EC BLX             strstr                  ; 是系统的类就跳过
 43 libedog.so:5D693186 00 28       CMP             R0, #0
 44 libedog.so:5D693188 3D D1       BNE             loc_5D693206
 45 libedog.so:5D69318A 36 78       LDRB            R6, [R6]
 46 libedog.so:5D69318C 01 96       STR             R6, [SP,#0x38+var_34]
 47 libedog.so:5D69318E 00 2E       CMP             R6, #0
 48 libedog.so:5D693190 39 D1       BNE             loc_5D693206
 49 libedog.so:5D693192 20 4B       LDR             R3, =(aFjFj0fjFjFj4fj+0xC - 0x5D69319C)
 50 libedog.so:5D693194 07 A8       ADD             R0, SP, #0x38+codeoffset
 51 libedog.so:5D693196 07 96       STR             R6, [SP,#0x38+codeoffset]
 52 libedog.so:5D693198 7B 44       ADD             R3, PC                  ; "(fj],fj]4fj]i]"
 53 libedog.so:5D69319A 1B 68       LDR             R3, [R3]                ; "(fj],fj]4fj]i]"
 54 libedog.so:5D69319C 1B 68       LDR             R3, [R3]                ; data数据
 55 libedog.so:5D69319E 05 93       STR             R3, [SP,#0x38+data]
 56 libedog.so:5D6931A0 02 9B       LDR             R3, [SP,#0x38+Debug_info]
 57 libedog.so:5D6931A2 05 9A       LDR             R2, [SP,#0x38+data]
 58 libedog.so:5D6931A4 19 02       LSLS            R1, R3, #8
 59 libedog.so:5D6931A6 89 09       LSRS            R1, R1, #6
 60 libedog.so:5D6931A8 89 18       ADDS            R1, R1, R2
 61 libedog.so:5D6931AA 04 22       MOVS            R2, #4
 62 libedog.so:5D6931AC FF F7 68 EC BLX             memcpy_0
 63 libedog.so:5D6931B0 03 9A       LDR             R2, [SP,#0x38+var_2C]
 64 libedog.so:5D6931B2 04 9C       LDR             R4, [SP,#0x38+codeSize]
 65 libedog.so:5D6931B4 93 00       LSLS            R3, R2, #2
 66 libedog.so:5D6931B6 08 34       ADDS            R4, #8
 67 libedog.so:5D6931B8 E4 18       ADDS            R4, R4, R3
 68 libedog.so:5D6931BA 13 1C       MOVS            R3, R2
 69 libedog.so:5D6931BC 01 33       ADDS            R3, #1
 70 libedog.so:5D6931BE 9B 00       LSLS            R3, R3, #2
 71 libedog.so:5D6931C0 E4 18       ADDS            R4, R4, R3
 72 libedog.so:5D6931C2 64 00       LSLS            R4, R4, #1
 73 libedog.so:5D6931C4 20 1C       MOVS            R0, R4
 74 libedog.so:5D6931C6 FF F7 26 EC BLX             malloc
 75 libedog.so:5D6931CA 22 1C       MOVS            R2, R4
 76 libedog.so:5D6931CC 06 1C       MOVS            R6, R0
 77 libedog.so:5D6931CE 01 99       LDR             R1, [SP,#0x38+var_34]
 78 libedog.so:5D6931D0 FF F7 5C EC BLX             memset_0
 79 libedog.so:5D6931D4 29 1C       MOVS            R1, R5
 80 libedog.so:5D6931D6 22 1C       MOVS            R2, R4
 81 libedog.so:5D6931D8 30 1C       MOVS            R0, R6
 82 libedog.so:5D6931DA FF F7 52 EC BLX             memcpy_0
 83 libedog.so:5D6931DE 04 9B       LDR             R3, [SP,#0x38+codeSize]
 84 libedog.so:5D6931E0 05 9A       LDR             R2, [SP,#0x38+data]
 85 libedog.so:5D6931E2 07 99       LDR             R1, [SP,#0x38+codeoffset]
 86 libedog.so:5D6931E4 5D 00       LSLS            R5, R3, #1
 87 libedog.so:5D6931E6 02 98       LDR             R0, [SP,#0x38+Debug_info]
 88 libedog.so:5D6931E8 51 18       ADDS            R1, R2, R1
 89 libedog.so:5D6931EA 01 23       MOVS            R3, #1
 90 libedog.so:5D6931EC 2A 1C       MOVS            R2, R5
 91 libedog.so:5D6931EE 01 F0 1E EF BLX             dbone_crypt_ins         ; 解密指令
 92 libedog.so:5D6931F2 01 9B       LDR             R3, [SP,#0x38+var_34]
 93 libedog.so:5D6931F4 34 1C       MOVS            R4, R6
 94 libedog.so:5D6931F6 10 34       ADDS            R4, #0x10
 95 libedog.so:5D6931F8 01 1C       MOVS            R1, R0
 96 libedog.so:5D6931FA B3 60       STR             R3, [R6,#8]             ; 清空Debug_info
 97 libedog.so:5D6931FC 20 1C       MOVS            R0, R4
 98 libedog.so:5D6931FE 2A 1C       MOVS            R2, R5
 99 libedog.so:5D693200 FF F7 3E EC BLX             memcpy_0                ; 还原指令
100 libedog.so:5D693204 3C 62       STR             R4, [R7,#0x20]
101 libedog.so:5D693206
102 libedog.so:5D693206             loc_5D693206                            ; CODE XREF: _Z13restoreMethodP11ClassObjectP6Method+6j
103 libedog.so:5D693206                                                     ; _Z13restoreMethodP11ClassObjectP6Method+Cj ...
104 libedog.so:5D693206 09 B0       ADD             SP, SP, #0x24
105 libedog.so:5D693208 F0 BD       POP             {R4-R7,PC}
106 libedog.so:5D693208             ; End of function _Z13restoreMethodP1
107 解密指令
108 libedog.so:5D69502C
109 libedog.so:5D69502C             dbone_crypt_ins                         ; CODE XREF: _Z13restoreMethodP11ClassObjectP6Method+AAp
110 libedog.so:5D69502C
111 libedog.so:5D69502C             DecMode= -0x1C
112 libedog.so:5D69502C             codeSize= -0x18
113 libedog.so:5D69502C             codedata= -0x14
114 libedog.so:5D69502C             key= -0x10
115 libedog.so:5D69502C             crckey= -8
116 libedog.so:5D69502C
117 libedog.so:5D69502C 00 48 2D E9 STMFD           SP!, {R11,LR}
118 libedog.so:5D695030 04 B0 8D E2 ADD             R11, SP, #4
119 libedog.so:5D695034 18 D0 4D E2 SUB             SP, SP, #0x18
120 libedog.so:5D695038 10 00 0B E5 STR             R0, [R11,#key]
121 libedog.so:5D69503C 14 10 0B E5 STR             R1, [R11,#codedata]
122 libedog.so:5D695040 18 20 0B E5 STR             R2, [R11,#codeSize]
123 libedog.so:5D695044 1C 30 0B E5 STR             R3, [R11,#DecMode]      ; 1
124 libedog.so:5D695048 10 30 4B E2 SUB             R3, R11, #-key
125 libedog.so:5D69504C 03 00 A0 E1 MOV             R0, R3
126 libedog.so:5D695050 04 10 A0 E3 MOV             R1, #4
127 libedog.so:5D695054 47 01 00 EB BL              _Z5crc32Phj
128 libedog.so:5D695058 00 30 A0 E1 MOV             R3, R0
129 libedog.so:5D69505C 08 30 0B E5 STR             R3, [R11,#crckey]
130 libedog.so:5D695060 1C 30 1B E5 LDR             R3, [R11,#DecMode]
131 libedog.so:5D695064 01 00 53 E3 CMP             R3, #1
132 libedog.so:5D695068 06 00 00 1A BNE             loc_5D695088
133 libedog.so:5D69506C 08 20 1B E5 LDR             R2, [R11,#crckey]
134 libedog.so:5D695070 18 30 1B E5 LDR             R3, [R11,#codeSize]
135 libedog.so:5D695074 02 00 A0 E1 MOV             R0, R2
136 libedog.so:5D695078 14 10 1B E5 LDR             R1, [R11,#codedata]
137 libedog.so:5D69507C 14 20 1B E5 LDR             R2, [R11,#codedata]
138 libedog.so:5D695080 80 00 00 EB BL              _Z8XorArrayjPhS_j
139 libedog.so:5D695084 0D 00 00 EA B               loc_5D6950C0
140 libedog.so:5D695088             ; ---------------------------------------------------------------------------
141 libedog.so:5D695088
142 libedog.so:5D695088             loc_5D695088                            ; CODE XREF: dbone_crypt_ins+3Cj
143 libedog.so:5D695088 1C 30 1B E5 LDR             R3, [R11,#DecMode]
144 libedog.so:5D69508C 00 00 53 E3 CMP             R3, #0
145 libedog.so:5D695090 06 00 00 1A BNE             loc_5D6950B0
146 libedog.so:5D695094 10 20 1B E5 LDR             R2, [R11,#key]
147 libedog.so:5D695098 18 30 1B E5 LDR             R3, [R11,#codeSize]
148 libedog.so:5D69509C 02 00 A0 E1 MOV             R0, R2
149 libedog.so:5D6950A0 14 10 1B E5 LDR             R1, [R11,#codedata]
150 libedog.so:5D6950A4 14 20 1B E5 LDR             R2, [R11,#codedata]
151 libedog.so:5D6950A8 B1 00 00 EB BL              _Z13XorArray_0x99jPhS_j
152 libedog.so:5D6950AC 03 00 00 EA B               loc_5D6950C0
153 libedog.so:5D6950B0             ; ---------------------------------------------------------------------------
154 libedog.so:5D6950B0
155 libedog.so:5D6950B0             loc_5D6950B0                            ; CODE XREF: dbone_crypt_ins+64j
156 libedog.so:5D6950B0 18 30 9F E5 LDR             R3, =(aUsageDbone_cry - 0x5D6950BC)
157 libedog.so:5D6950B4 03 30 8F E0 ADD             R3, PC, R3              ; "USAGE:dbone_crypt_ins(key,ins,ins_lenth"...
158 libedog.so:5D6950B8 03 00 A0 E1 MOV             R0, R3
159 libedog.so:5D6950BC 99 F6 FF EB BL              puts
160 libedog.so:5D6950C0
161 libedog.so:5D6950C0             loc_5D6950C0                            ; CODE XREF: dbone_crypt_ins+58j
162 libedog.so:5D6950C0                                                     ; dbone_crypt_ins+80j
163 libedog.so:5D6950C0 14 30 1B E5 LDR             R3, [R11,#codedata]
164 libedog.so:5D6950C4 03 00 A0 E1 MOV             R0, R3
165 libedog.so:5D6950C8 04 D0 4B E2 SUB             SP, R11, #4
166 libedog.so:5D6950CC 00 88 BD E8 LDMFD           SP!, {R11,PC}
167 libedog.so:5D6950CC             ; End of function dbone_crypt_ins
168 libedog.so:5D6950CC
169 libedog.so:5D6950CC             ; -------------
170 
171 //循环解密
172 
173 libedog.so:5D695288             _Z8XorArrayjPhS_j                       ; CODE XREF: dbone_crypt_file+180p
174 libedog.so:5D695288                                                     ; dbone_crypt_ins+54p
175 libedog.so:5D695288
176 libedog.so:5D695288             codeSize= -0x24
177 libedog.so:5D695288             codedata1= -0x20
178 libedog.so:5D695288             codedata= -0x1C
179 libedog.so:5D695288             crckey= -0x18
180 libedog.so:5D695288             crckey1= -0x14
181 libedog.so:5D695288             crckeyaddr= -0x10
182 libedog.so:5D695288             crckeyindex= -0xC
183 libedog.so:5D695288             index= -8
184 libedog.so:5D695288
185 libedog.so:5D695288 00 48 2D E9 STMFD           SP!, {R11,LR}
186 libedog.so:5D69528C 04 B0 8D E2 ADD             R11, SP, #4
187 libedog.so:5D695290 20 D0 4D E2 SUB             SP, SP, #0x20
188 libedog.so:5D695294 18 00 0B E5 STR             R0, [R11,#crckey]
189 libedog.so:5D695298 1C 10 0B E5 STR             R1, [R11,#codedata]
190 libedog.so:5D69529C 20 20 0B E5 STR             R2, [R11,#codedata1]
191 libedog.so:5D6952A0 24 30 0B E5 STR             R3, [R11,#codeSize]
192 libedog.so:5D6952A4 18 30 1B E5 LDR             R3, [R11,#crckey]
193 libedog.so:5D6952A8 14 30 0B E5 STR             R3, [R11,#crckey1]
194 libedog.so:5D6952AC 14 30 4B E2 SUB             R3, R11, #-crckey1
195 libedog.so:5D6952B0 10 30 0B E5 STR             R3, [R11,#crckeyaddr]
196 libedog.so:5D6952B4 00 30 A0 E3 MOV             R3, #0
197 libedog.so:5D6952B8 08 30 0B E5 STR             R3, [R11,#index]
198 libedog.so:5D6952BC 00 30 A0 E3 MOV             R3, #0
199 libedog.so:5D6952C0 0C 30 0B E5 STR             R3, [R11,#crckeyindex]
200 libedog.so:5D6952C4 00 30 A0 E3 MOV             R3, #0
201 libedog.so:5D6952C8 08 30 0B E5 STR             R3, [R11,#index]
202 libedog.so:5D6952CC 1E 00 00 EA B               loc_5D69534C
203 libedog.so:5D6952D0             ; ---------------------------------------------------------------------------
204 libedog.so:5D6952D0
205 libedog.so:5D6952D0             loc_5D6952D0                            ; CODE XREF: _Z8XorArrayjPhS_j+E0j
206 libedog.so:5D6952D0 08 30 1B E5 LDR             R3, [R11,#index]
207 libedog.so:5D6952D4 20 20 1B E5 LDR             R2, [R11,#codedata1]
208 libedog.so:5D6952D8 03 30 82 E0 ADD             R3, R2, R3
209 libedog.so:5D6952DC 08 20 1B E5 LDR             R2, [R11,#index]
210 libedog.so:5D6952E0 1C 10 1B E5 LDR             R1, [R11,#codedata]
211 libedog.so:5D6952E4 02 20 81 E0 ADD             R2, R1, R2
212 libedog.so:5D6952E8 00 10 D2 E5 LDRB            R1, [R2]
213 libedog.so:5D6952EC 0C 20 1B E5 LDR             R2, [R11,#crckeyindex]
214 libedog.so:5D6952F0 10 00 1B E5 LDR             R0, [R11,#crckeyaddr]
215 libedog.so:5D6952F4 02 20 80 E0 ADD             R2, R0, R2
216 libedog.so:5D6952F8 00 20 D2 E5 LDRB            R2, [R2]
217 libedog.so:5D6952FC 02 20 21 E0 EOR             R2, R1, R2
218 libedog.so:5D695300 FF 20 02 E2 AND             R2, R2, #0xFF
219 libedog.so:5D695304 00 20 C3 E5 STRB            R2, [R3]
220 libedog.so:5D695308 0C 30 1B E5 LDR             R3, [R11,#crckeyindex]
221 libedog.so:5D69530C 03 00 53 E3 CMP             R3, #3                  ; 比较key是否结束
222 libedog.so:5D695310 07 00 00 1A BNE             loc_5D695334
223 libedog.so:5D695314 14 30 1B E5 LDR             R3, [R11,#crckey1]
224 libedog.so:5D695318 03 00 A0 E1 MOV             R0, R3
225 libedog.so:5D69531C 6C FF FF EB BL              _Z10PolyXorKeyj
226 libedog.so:5D695320 00 30 A0 E1 MOV             R3, R0
227 libedog.so:5D695324 14 30 0B E5 STR             R3, [R11,#crckey1]
228 libedog.so:5D695328 00 30 A0 E3 MOV             R3, #0
229 libedog.so:5D69532C 0C 30 0B E5 STR             R3, [R11,#crckeyindex]
230 libedog.so:5D695330 02 00 00 EA B               loc_5D695340
231 libedog.so:5D695334             ; ---------------------------------------------------------------------------
232 libedog.so:5D695334
233 libedog.so:5D695334             loc_5D695334                            ; CODE XREF: _Z8XorArrayjPhS_j+88j
234 libedog.so:5D695334 0C 30 1B E5 LDR             R3, [R11,#crckeyindex]
235 libedog.so:5D695338 01 30 83 E2 ADD             R3, R3, #1
236 libedog.so:5D69533C 0C 30 0B E5 STR             R3, [R11,#crckeyindex]
237 libedog.so:5D695340
238 libedog.so:5D695340             loc_5D695340                            ; CODE XREF: _Z8XorArrayjPhS_j+A8j
239 libedog.so:5D695340 08 30 1B E5 LDR             R3, [R11,#index]
240 libedog.so:5D695344 01 30 83 E2 ADD             R3, R3, #1
241 libedog.so:5D695348 08 30 0B E5 STR             R3, [R11,#index]
242 libedog.so:5D69534C
243 libedog.so:5D69534C             loc_5D69534C                            ; CODE XREF: _Z8XorArrayjPhS_j+44j
244 libedog.so:5D69534C 24 20 1B E5 LDR             R2, [R11,#codeSize]
245 libedog.so:5D695350 08 30 1B E5 LDR             R3, [R11,#index]
246 libedog.so:5D695354 03 00 52 E1 CMP             R2, R3
247 libedog.so:5D695358 00 30 A0 D3 MOVLE           R3, #0
248 libedog.so:5D69535C 01 30 A0 C3 MOVGT           R3, #1
249 libedog.so:5D695360 FF 30 03 E2 AND             R3, R3, #0xFF
250 libedog.so:5D695364 00 00 53 E3 CMP             R3, #0
251 libedog.so:5D695368 D8 FF FF 1A BNE             loc_5D6952D0
252 libedog.so:5D69536C 04 D0 4B E2 SUB             SP, R11, #4
253 libedog.so:5D695370 00 88 BD E8 LDMFD           SP!, {R11,PC}
254 libedog.so:5D695370             ; End of function _Z8XorArrayjPhS_j
255 libedog.so:5D695370
256 libedog.so:5D695374
257 libedog.so:5D695374             ; =============== S U B R O U T

0x04 编写修复程序

         修复程序主要分为解析dex与解密两个步骤来完成,这里只贴出部分代码详细的请看工程,代码写得比较粗操,看下思路就行了,有性趣的就慢慢撸吧!

  1 void fixdexClassData()
  2 {
  3 
  4     DexFile *dexFile = &gDexFile;
  5 
  6     char * Tag = "L";
  7     char * ClassTag = "Landroid/";
  8 
  9     const DexClassDef* classdef;
 10     u4 count = dexFile->pHeader->classDefsSize;
 11 
 12     printf("该DEX共有%d 个类\n", count);
 13 
 14     const u1* pEncodedData = NULL;
 15     DexClassData* pClassData = NULL;
 16     const char *descriptor = NULL;
 17 
 18 
 19     int FileSize = file_size();
 20 
 21     gCodeData = (u1*)malloc(FileSize);
 22     if (NULL == gCodeData)
 23     {
 24         printf("分配内存失败!\n");
 25         return;
 26     }
 27     memset(gCodeData, 0, FileSize);
 28 
 29     //获得加密指令数据
 30     GetCodeData(gCodeData, FileSize);
 31 
 32     if (NULL == gCodeData)
 33     {
 34         printf("获取加密指令数据出错!\n");
 35         return;
 36     }
 37 
 38     for(u4 i=0; i<count; i++){
 39         classdef = dexGetClassDef(dexFile, i);
 40 
 41         descriptor = getTpyeIdString(dexFile, classdef->classIdx);
 42 
 43         if (strstr(descriptor,Tag) == NULL)
 44         {
 45             continue;
 46         }
 47 
 48         //跳过一些系统的类
 49         if (strstr(descriptor, ClassTag) != NULL)
 50         {
 51             continue;
 52         }
 53 
 54         pEncodedData = dexFile->baseAddr + classdef->classDataOff;
 55         pClassData = dexReadAndVerifyClassData(&pEncodedData, NULL);
 56 
 57         if (pClassData == NULL) {
 58             continue;
 59         }
 60 
 61       FixdexMethodInsns(dexFile, pClassData, descriptor);
 62 
 63     }
 64 
 65 }
 66 
 67 void FixdexMethodInsns(DexFile *dexFile, const DexClassData*classData ,const char* className)
 68 {
 69     int idx = 0;
 70     DexMethod *method = NULL;
 71     const DexMethodId* methodId = NULL;
 72     DexCode* code = NULL;
 73     const char* methodName;
 74     method = classData->directMethods;
 75     methodId = dexFile->pMethodIds;
 76     unsigned int CodeDataOffset = 0;
 77     u1 * tempCode = NULL;
 78     for (int i = 0; i < (int) classData->header.directMethodsSize; i++) {
 79         idx = classData->directMethods[i].methodIdx;
 80 
 81         methodId = dexGetMethodId(dexFile, idx);
 82         methodName = dexStringById(dexFile, methodId->nameIdx);
 83 
 84         DexCode* pCode = dexGetCode(dexFile, &classData->directMethods[i]);
 85         if (NULL == pCode)
 86         {
 87             continue;
 88         }
 89         //判断是否为保护后的方法,如果是就修复指令
 90         if ( (pCode->debugInfoOff > 0x1FFFFFFF) && (pCode->insns[0] == 0X00))
 91         {
 92             //求加密指令的偏移
 93             CodeDataOffset = pCode->debugInfoOff << 0x8;
 94             CodeDataOffset >>= 0x6;
 95             //解密指令
 96             tempCode = DecCode(gCodeData+CodeDataOffset, pCode->insnsSize*sizeof(u2), pCode->debugInfoOff, gCodeData);
 97             //修复指令
 98             memcpy(pCode->insns, tempCode, (pCode->insnsSize)*sizeof(u2));
 99             pCode->debugInfoOff = 0x00;
100             printf("修复%s 类中的%s 方法成功! 大小%X\n",className, methodName,pCode->insnsSize);
101             if (NULL != tempCode)
102             {
103                 free(tempCode);
104                 tempCode = NULL;
105             }
106         }
107     }
108 
109     for (int i = 0; i < (int) classData->header.virtualMethodsSize; i++) {
110         idx = classData->virtualMethods[i].methodIdx;
111 
112         methodId = dexGetMethodId(dexFile, idx);
113         methodName = dexStringById(dexFile, methodId->nameIdx);
114 
115         DexCode* pCode = dexGetCode(dexFile, &classData->virtualMethods[i]);
116         if (NULL == pCode)
117         {
118             continue;
119         }
120         //判断是否为保护后的方法,如果是就修复指令
121         if ( (pCode->debugInfoOff > 0x1FFFFFFF) && (pCode->insns[0] == 0X00))
122         {
123             //求加密指令的偏移
124             CodeDataOffset = pCode->debugInfoOff << 0x8;
125             CodeDataOffset >>= 0x6;
126             //解密指令
127             tempCode = DecCode(gCodeData+CodeDataOffset, pCode->insnsSize*sizeof(u2), pCode->debugInfoOff, gCodeData);
128             //修复指令
129             memcpy(pCode->insns, tempCode, (pCode->insnsSize)*sizeof(u2));
130             pCode->debugInfoOff = 0x00;
131             printf("修复%s 类中的%s 方法成功! 大小%X\n",className, methodName,pCode->insnsSize);
132             if (NULL != tempCode)
133             {
134                 free(tempCode);
135                 tempCode = NULL;
136             }
137         }
138     }
139     return;
140 }
141 unsigned int PolyXorKey(DWORD crckey)
142 {
143     unsigned int dwKey;
144     char temp;
145     unsigned __int8 temp1;
146     unsigned __int8 temp2;
147     char *pKey;
148     int temp3;
149     int j;
150     int i;
151 
152     j = 0;
153     temp3 = 0;
154     pKey = (char *)&dwKey;
155     temp2 = 0;
156     temp1 = 0;
157     temp = 0;
158     dwKey = crckey ^ 0xDF138530;
159     i = 0;
160     while ( i <= 3 )
161     {
162         temp2 = *pKey;
163         j = 128;
164         temp3 = 7;
165         while ( j > 1 )
166         {
167             temp = (temp2 & j / 2) >> (temp3 - 1);
168             temp1 = ((signed int)(unsigned __int8)(temp2 & j) >> temp3) ^ temp;
169             temp1 <<= temp3;
170             temp2 |= temp1;
171             j /= 2;
172             --temp3;
173         }
174         temp = temp2 & 1;
175         temp1 = temp2 & 1 ^ temp2 & 1;
176         *pKey = temp2;
177         ++i;
178         ++pKey;
179     }
180     return dwKey;
181 }

0x05 测试与总结

         将加固后的 APK中assets文件夹中的data文件与classes.dex放在修复程序同一个目录中,然后运行修复程序。

去掉AndroidManifest.xml中的壳入口,将修复后的classes.dex重新打包反编译,成功运行,如图9所示能正常反编译源码,至此,分析完毕。

         图9

壳流程总结:

AndroidManifest.xml中的壳入口->com.edog.AppWrapper->

so中Java_com_edog_ELibrary_d1->hook dvmResolveClass函数->在dvmResolveClass hook函数中修复指令->结束。

语言表达不行,说的很杂,自己都觉得文章没有任何逻辑可言,如果大家能从中获得一些思路那也是好的, 不过这次分析让自己学到了很多,感谢APK加固作者。

样本及pdf文档下载

http://yunpan.cn/cmApFwTesyPGk (提取码:b37f)

本文参与腾讯云自媒体分享计划,欢迎正在阅读的你也加入,一起分享。

我来说两句

0 条评论
登录 后参与评论

相关文章

  • 爱加密so保护简单脱壳测试

    1.   最近研究so文件的保护,在网上搜索发现爱加密支持对so文件的保护,然后联系客户,本来是想让客户保护一个自己的so文件来做测试的,结果客户各种不愿意,说...

    我是小三
  • 360 so动态脱壳

    目前so加壳有很多家,我己知的有 爱加密,梆梆,360, 娜迦等 各有所长。今天把学习360的脱壳笔记记录下来与小菜共同学习,没有其它目的,大神请绕道!

    我是小三
  • 360加固保动态脱壳

    1.我是通过对dvmLoadNativeCode函数下断,分析它执行流程最后到达壳入口(如果您有更好的办法还请告知,感谢中...),函数dvmLoadNativ...

    我是小三
  • Docker容器之最小JDK基础镜像 原

        2、因为java依赖glibc,所以基础镜像使用的是alpine-glibc而非alpine,alpine-glibc大概是11.1M。

    尚浩宇
  • MySQL从删库到跑路_高级(二)——自定义函数

    自定义函数 (user-defined function UDF)是一种对MySQL扩展的途径,其用法和内置函数相同。 自定义函数的两个必要条件: A、参数 B...

    良月柒
  • 基于Spring Boot 的Blog开发 原

    之前写过几篇关于利用Spring MVC来开发的博客,从博客下面的评论以及GitHub上的Issues看还是会出现许多的问题,且大部分的问题都出在配置上。虽然说...

    Gaussic
  • 【网摘】身在腾讯:浪潮之巅的惶惑与自救

    沈唁
  • 一线互联网公司技术面试的流程以及注意事项

    最后hr面:主要了解面试者与企业文化相不相符,面试者的职业发展,offer的选择以及介绍一下企业提供的薪资待遇等等

    代码随想录
  • 听说你 “精通” C++???

    我等这条短信等得太久了。想起这几个月求职的心酸、无助,再想想拜托了无数网友内推换来的是网友们的失望与笔试结果的石沉大海,看到了这条短信我简直快要哭了出来。

    Java帮帮
  • /sbin/ldconfig.real: /usr/local/lib/libcudnn.so.7 不是符号链接

    (adsbygoogle = window.adsbygoogle || []).push({});

    Pulsar-V

扫码关注云+社区

领取腾讯云代金券