关于flutter框架安卓应用抓包问题,以及解决方法

小小咸鱼YwY

发布于 2023-07-10 14:37:43

7850

发布于 2023-07-10 14:37:43

参考文档https://bbs.kanxue.com/thread-261941.htm

一.从安装的app所在文件夹目录中提出libflutter.so

cd /data/app/包名/lib/xxx/..../...libflutter.so

二.将其拖入ida中进行分析

字符串窗口搜索ssl_server
按x进入

F5看了一下和上面博客说的相似

不理解上面说的也没事模仿总会吧访问https://armconverter.com 把函数入口的内容复制进去

修改js

function hook_ssl_verify_result(address) {
    Interceptor.attach(address, {
        onEnter: function(args) {
            console.log("Disabling SSL validation")
        },
        onLeave: function(retval) {
            console.log("Retval: " + retval);
            retval.replace(0x1);
            console.log("Modified Retval: " + retval);
        }
    });
}

function hookFlutter() {
    var m = Process.findModuleByName("libflutter.so");
    console.log(m)
    var pattern = "2D E9 F0 4F 85 B0 06 46 50 20 10 70";
    console.log(m.base, m.size)
    var res = Memory.scan(m.base, m.size, pattern, {
        onMatch: function(address, size){
            console.log('[+] ssl_verify_result found at: ' + address.toString());

           hook_ssl_verify_result(address.add(0x01));
            // hook_ssl_verify_result(address);
        },
        onError: function(reason){
            console.log('[!] There was an error scanning memory');
        },
        onComplete: function() {
            console.log("All done")
        }
    });
}

hookFlutter();

然后开始hook