Code Monkey home page Code Monkey logo

Comments (2)

zhkl0228 avatar zhkl0228 commented on August 27, 2024

下载最新的代码即可

from unidbg.

zhkl0228 avatar zhkl0228 commented on August 27, 2024

`package com.dexshell.protect;

import cn.banny.auxiliary.Inspector;
import cn.banny.unidbg.Module;
import cn.banny.unidbg.Symbol;
import cn.banny.unidbg.arm.ARMEmulator;
import cn.banny.unidbg.file.FileIO;
import cn.banny.unidbg.file.IOResolver;
import cn.banny.unidbg.linux.android.AndroidARMEmulator;
import cn.banny.unidbg.linux.android.AndroidResolver;
import cn.banny.unidbg.linux.android.dvm.*;
import cn.banny.unidbg.memory.Memory;
import cn.banny.unidbg.pointer.UnicornPointer;
import com.sun.jna.Pointer;

import java.io.File;
import java.io.IOException;

public class DexShellUtil extends AbstractJni implements IOResolver {

private static final int SDK_INT = 19;
private static final String APP_PACKAGE_NAME = "com.zz.yzzj.aligames";

private final ARMEmulator emulator;

private static final String APK_PATH = "src/test/resources/app/yzzj.apk";

private final Module module;

private final DvmClass DexShell;

private DexShellUtil() throws IOException {
    emulator = new AndroidARMEmulator(APP_PACKAGE_NAME);
    emulator.getSyscallHandler().addIOResolver(this);
    System.out.println("== init ===");

    final Memory memory = emulator.getMemory();
    memory.setLibraryResolver(new AndroidResolver(SDK_INT));
    memory.setCallInitFunction();

    VM vm = emulator.createDalvikVM(new File(APK_PATH));
    vm.setJni(this);
    DalvikModule dm = vm.loadLibrary("dexshell", true);
    dm.callJNI_OnLoad(emulator);
    module = dm.getModule();

    DexShell = vm.resolveClass("com/dexshell/protect/DexShell");
}

private void destroy() throws IOException {
    emulator.close();
    System.out.println("module=" + module);
    System.out.println("== destroy ===");
}

public static void main(String[] args) throws Exception {
    DexShellUtil test = new DexShellUtil();

    test.Decrypt();

    test.destroy();
}

private void Decrypt() throws IOException {
    Symbol aeskey = module.findSymbolByName("aes_key");
    System.out.println("aeskey address = " + aeskey.getAddress());
    System.out.println("base address = " + module.base);
    Inspector.inspect(aeskey.createPointer(emulator).getByteArray(0, 32), "aes_key");

    byte[] result = new byte[128];

    Symbol AES_set_decrypt_key = module.findSymbolByName("AES_set_decrypt_key");
    System.out.println("address = " + AES_set_decrypt_key.getAddress());
    System.out.println("base = " + module.base);
    Number[] numbers = AES_set_decrypt_key.call(emulator, aeskey.createPointer(emulator), 128, result);
    int ret = numbers[0].intValue();
    Pointer p1 = UnicornPointer.pointer(emulator, numbers[1].intValue() & 0xffffffffL);

    assert p1 != null;
    Inspector.inspect(p1.getByteArray(0, 128), "AES_set_decrypt_key ret=" + ret);
}

@Override
public FileIO resolve(File workDir, String pathname, int oflags) {
    return null;
}

@Override
public int callStaticIntMethod(BaseVM vm, DvmClass dvmClass, String signature, VarArg varArg) {
    if ("com/dexshell/protect/Util->getSDKINT()I".equals(signature)) {
        return SDK_INT;
    }

    return super.callStaticIntMethod(vm, dvmClass, signature, varArg);
}

}`

from unidbg.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.