devbox
你好赵伟
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

unidbg实现淘宝请求参数算法，实现脱离模拟器/手机请求淘宝、闲鱼_unidbg x-sign

作者：你好赵伟 | 2024-02-28 10:01:44

赞

踩

unidbg x-sign
本篇文章仅适用于学习。

最近一直在研究阿里系的请求问题，原来一直都是hook请求端口，虽然和很多人的hook参数生成x-sign不一样，可以说更稳定一些。但总归是脱离不了安卓环境——或者用模拟器，或者用真机。

对于逆向来说，非常的没有档次，没有逼格。

相对于直接逆向x-sign的算法而言，用unidbg调用so文件的难度要小很多。由易入难，unidbg这时候势在必行了。

但是，随着研究的深入，相关的学习资料越来越少，unidbg和直接逆向学习的资料，虽然有一些，但对于问题的深入，原理的解析，以及具体API方法的使用，可以说是少之又少。鱼和渔的问题，越来越尖锐了。

已经研究了差不多几个月，总感觉临门一脚了，程序调试也没有完全通过。虽然越挫越勇，会继续研究，但还是感觉得慢慢来，研究、学习，本身也是一场永远止境的修行。

下面的代码面向的是mtop6.5.27， 代码还存在不少问题，并不能直接使用。

  1. import android.content.Context;
  2. import com.github.unidbg.AndroidEmulator;
  3. import com.github.unidbg.Emulator;
  4. import com.github.unidbg.Module;
  5. import com.github.unidbg.arm.HookStatus;
  6. import com.github.unidbg.file.FileResult;
  7. import com.github.unidbg.file.IOResolver;
  8. import com.github.unidbg.file.linux.AndroidFileIO;
  9. import com.github.unidbg.hook.HookContext;
  10. import com.github.unidbg.hook.ReplaceCallback;
  11. import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
  12. import com.github.unidbg.linux.android.AndroidResolver;
  13. import com.github.unidbg.linux.android.dvm.*;
  14. import com.github.unidbg.linux.android.dvm.array.ByteArray;
  15. import com.github.unidbg.linux.android.dvm.jni.ProxyDvmObject;
  16. import com.github.unidbg.memory.Memory;
  17. import com.github.unidbg.pointer.UnidbgPointer;
  18. import com.github.unidbg.spi.SyscallHandler;
  19. import com.taobao.tao.TaobaoApplication;
  20. import org.json.JSONObject;
  21.  
  22. import java.io.File;
  23. import java.io.IOException;
  24. import java.util.HashMap;
  25. import java.util.LinkedHashMap;
  26. import java.util.Map;
  27.  
  28. public class TaoBao extends AbstractJni implements IOResolver<AndroidFileIO> {
  29.     private final AndroidEmulator emulator;
  30.     private final VM vm;
  31.     private final Context context;
  32.     private final JSONObject data;
  33.     private long slot;
  34.  
  35. //    private int num = 0;
  36.  
  37.     private TaoBao(File apk) throws  Exception{
  38.         emulator = AndroidEmulatorBuilder.for32Bit()
  39.                 .setRootDir(new File("D:\\DesktopTemp\\tb\\rootfs"))
  40.                 .build();
  41.  
  42.         Map<String, Integer> iNode = new LinkedHashMap<>();
  43.         iNode.put("/data/system", 671745);
  44.         iNode.put("/data/app", 327681);
  45.         iNode.put("/sdcard/android", 294915);
  46.         iNode.put("/data/user/0/com.taobao.taobao", 655781);
  47.         iNode.put("/data/user/0/com.taobao.taobao/files", 655864);
  48.         emulator.set("inode", iNode);
  49.         emulator.set("uid", 10074);
  50.  
  51.         Memory memory = emulator.getMemory();
  52.         memory.setLibraryResolver(new AndroidResolver(23));
  53.         SyscallHandler<AndroidFileIO> handler = emulator.getSyscallHandler();
  54.         handler.setVerbose(false);
  55.         handler.addIOResolver(this);
  56.         vm = emulator.createDalvikVM(apk);
  57.         vm.setJni(this);
  58.         vm.setVerbose(true);
  59.         context = new TaobaoApplication(vm);
  60.         data = new JSONObject("{\"Soft_SGTMAGIC\":\"4I1q9PXiORQGtBivoqf4hSwMk9pwm1D8o4NitR+kvgA=\",\"dynamicreid_dynamicreid\":\"d0666b5b6022eb0\",\"dynamicrsid_dynamicrsid\":\"e1a2607877e260b\",\"SgDyUpdate_ac7123c301ca455b\":\"1621600637\",\"LOCAL_DEVICE_INFO_982c1b269b8e023e5aede2421cbf9c48\":\"YKepcS4SY+ADAIS37Xj5c7s+\",\"DynamicData_accs_ssl_key2_https:\\/\\/ossgw.alicdn.com_21646297%[B\":\"nRWwrMQ\\/jz+oOTWkAZ5FOjhnS1k48SqJdb3w3u\\/ImZJMSXQnlxpD8g0Lyi4kEfgHy5Me33VQ8fyLfqHjPk5PXZ3SwQDtSG4Km7fj9RhEav6NeP85kaWorOA8KTx9u9MHnXdbQa4GVOpBTln\\/GKsPje5gRpmCtWUb71auNwVEO\\/s9LUhH\\/HOcH\\/fwdPixaJAi\\/wNKYYlijdORJgVTOwrtSls1DeUr61NyCDUQa0SkVhw6\\/8PI8gdM1JNt8QEcBIemgI0sM4zA3yyRxFTb0wwcu8CpLsBmIqxqZbvHA+2081dfYDIKuKguH9vYy4s\\/q++odPRvTB25RuEfvXWW\\/+IPtScYQXMx9\\/MG4RW7t80WR0+DOWZXHtkpVlPhTDcU9P2fI4bcQdRSTOIcaI6uFmnOdmb5b9QdtwU3qXgSOuBTh2Bdd6yTeyydRLChBzlWRtcZm6+tYgHOTJIWRNoDg8CxEw==\",\"llc-local_2c3c7f544c159842\":\"1621600921\",\"llc-local_abv2\":\"his:0\",\"llc-local_tcv2\":\"source:0,0,0\"}");
  61.      }
  62.  
  63.     public static void main(String[] args) throws Exception {
  64.         TaoBao taobao = new TaoBao(new File("D:\\DesktopTemp\\tb\\tb.apk"));
  65.  
  66.         AndroidEmulator emulator = taobao.emulator;
  67.         String methodSign = "doCommandNative(I[Ljava/lang/Object;)Ljava/lang/Object;";
  68.  
  69.         DvmClass targetClass = taobao.vm.resolveClass("com/taobao/wireless/security/adapter/JNICLibrary");
  70.         DalvikModule main = taobao.vm.loadLibrary("sgmainso-6.5.25", true);
  71.  
  72.         main.callJNI_OnLoad(emulator);
  73.  
  74.         targetClass.callStaticJniMethodObject(emulator, methodSign,
  75.                 10101, ProxyDvmObject.createObject(taobao.vm, new Object[]{
  76.                         taobao.context, 3, "", "/data/user/0/com.taobao.taobao/app_SGLib", ""
  77.                 }));
  78.  
  79.  
  80.         targetClass.callStaticJniMethodObject(emulator, methodSign,
  81.                 10102, ProxyDvmObject.createObject(taobao.vm, new Object[]{
  82.                         "main", "6.5.25", "/data/app/com.taobao.taobao-1/lib/arm/libsgmainso-6.5.25.so"
  83.                 }));
  84.  
  85.  
  86.         DalvikModule security = taobao.vm.loadLibrary("sgsecuritybodyso-6.5.33", true);
  87.         security.callJNI_OnLoad(emulator);
  88.  
  89.  
  90.         targetClass.callStaticJniMethodObject(emulator, methodSign,
  91.                 10102, ProxyDvmObject.createObject(taobao.vm, new Object[]{
  92.                         "securitybody", "6.5.33", "/data/app/com.taobao.taobao-1/lib/arm/libsgsecuritybodyso-6.5.33.so"
  93.                 }));
  94.  
  95.         DalvikModule middletier = taobao.vm.loadLibrary("sgmiddletierso-6.5.27", true);
  96.         middletier.callJNI_OnLoad(emulator);
  97.  
  98.         targetClass.callStaticJniMethodObject(emulator, methodSign,
  99.                 10102, ProxyDvmObject.createObject(taobao.vm, new Object[]{
  100.                         "middletier", "6.5.27", "/data/app/com.taobao.taobao-1/lib/arm/libsgmiddletierso-6.5.27.so"
  101.                 }));
  102.  
  103.         taobao.loadTest3Hook(middletier.getModule());
  104.  
  105.         DvmObject<?> dvmObject1 = targetClass.callStaticJniMethodObject(emulator, methodSign,
  106.                 70102, ProxyDvmObject.createObject(taobao.vm, new Object[]{
  107.                         "丢失", "丢失",
  108.                         false, 0, "mtop.alibaba.cro.umid.networksdk.savewb", "pageName=com.taobao.tao.welcome.Welcome&pageId=", null, null, null, "r_6"
  109.                 }));
  110.  
  111.         System.out.println(dvmObject1.getValue().toString());
  112.         try {
  113.             emulator.close();
  114.         } catch (IOException e) {
  115.             e.printStackTrace();
  116.         }
  117.     }
  118.  
  119.     @Override
  120.     public DvmObject<?> newObject(BaseVM vm, DvmClass dvmClass, String signature, VarArg varArg) {
  121.         switch (signature) {
  122.             case "java/lang/Integer-><init>(I)V":
  123.                 return ProxyDvmObject.createObject(vm, varArg.getIntArg(0));
  124.             case "java/lang/Long-><init>(J)V":
  125.                 return ProxyDvmObject.createObject(vm, varArg.getLongArg(0));
  126.             case "java/util/HashMap-><init>(I)V":
  127.                 return ProxyDvmObject.createObject(vm, new HashMap<>());
  128.         }
  129.         return super.newObject(vm, dvmClass, signature, varArg);
  130.     }
  131.  
  132.     @Override
  133.     public int getStaticIntField(BaseVM vm, DvmClass dvmClass, String signature) {
  134.         if ("android/os/Build$VERSION->SDK_INT:I".equals(signature)) {
  135.             return 23;
  136.         }
  137.         return super.getStaticIntField(vm, dvmClass, signature);
  138.     }
  139.  
  140.     @Override
  141.     public long getStaticLongField(BaseVM vm, DvmClass dvmClass, String signature) {
  142.         if ("com/alibaba/wireless/security/framework/SGPluginExtras->slot:J".equals(signature)) {
  143.             return slot;
  144.         }
  145.         return super.getStaticLongField(vm, dvmClass, signature);
  146.     }
  147.  
  148.     @Override
  149.     public DvmObject<?> getObjectField(BaseVM vm, DvmObject<?> dvmObject, String signature) {
  150.         if ("android/content/pm/ApplicationInfo->nativeLibraryDir:Ljava/lang/String;".equals(signature)) {
  151.             return new StringObject(vm, "/data/app/com.taobao.taobao-1/lib/arm");
  152.         } else if ("android/content/pm/ApplicationInfo->sourceDir:Ljava/lang/String;".equals(signature)) {
  153.             return new StringObject(vm, this.context.getPackageCodePath());
  154.         }
  155.         return super.getObjectField(vm, dvmObject, signature);
  156.     }
  157.  
  158.     @Override
  159.     public void setStaticLongField(BaseVM vm, DvmClass dvmClass, String signature, long value) {
  160.         if ("com/alibaba/wireless/security/framework/SGPluginExtras->slot:J".equals(signature)) {
  161.             slot = value;
  162.             return;
  163.         }
  164.         super.setStaticLongField(vm, dvmClass, signature, value);
  165.     }
  166.  
  167.     @Override
  168.     public DvmObject<?> callStaticObjectMethod(BaseVM vm, DvmClass dvmClass, String signature, VarArg varArg) {
  169.         switch (signature) {
  170.             case "com/alibaba/wireless/security/securitybody/SecurityGuardSecurityBodyPlugin->getPluginClassLoader()Ljava/lang/ClassLoader;":
  171.                 return vm.resolveClass("dalvik/system/PathClassLoader").newObject(this.getClass().getClassLoader());
  172.             case "java/net/NetworkInterface->getNetworkInterfaces()Ljava/util/Enumeration;":
  173.                 try {
  174.                     return Context.getNetworkInterfaces(vm);
  175.                 } catch (Exception e) {
  176.                     e.printStackTrace();
  177.                 }
  178.                 return null;
  179.         }
  180.         return super.callStaticObjectMethod(vm, dvmClass, signature, varArg);
  181.     }
  182.  
  183.     @Override
  184.     public void callStaticVoidMethod(BaseVM vm, DvmClass dvmClass, String signature, VarArg varArg) {
  185.         switch (signature) {
  186.             case "com/alibaba/wireless/security/open/edgecomputing/ECMiscInfo->registerAppLifeCyCleCallBack()V":
  187.             case "com/alibaba/wireless/security/securitybody/LifeCycle->setAccessibilityDelegateToView()V":
  188.                 return;
  189.         }
  190.         super.callStaticVoidMethod(vm, dvmClass, signature, varArg);
  191.     }
  192.  
  193.     @Override
  194.     public int callStaticIntMethod(BaseVM vm, DvmClass dvmClass, String signature, VarArg varArg) {
  195.         switch (signature) {
  196.             case "com/taobao/wireless/security/adapter/common/SPUtility2->saveToFileUnifiedForNative(Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;Z)I":
  197.                 return 2;
  198.             case "com/alibaba/wireless/security/framework/utils/UserTrackMethodJniBridge->utAvaiable()I":
  199.             case "com/uc/crashsdk/JNIBridge->registerInfoCallback(Ljava/lang/String;IJI)I":
  200.                 return 1;
  201.             case "android/provider/Settings$Secure->getInt(Landroid/content/ContentResolver;Ljava/lang/String;I)I":
  202.                 return context.getInt(varArg.getObjectArg(1).getValue().toString(), varArg.getIntArg(2));
  203.         }
  204.         return super.callStaticIntMethod(vm, dvmClass, signature, varArg);
  205.     }
  206.  
  207.     @Override
  208.     public boolean callBooleanMethod(BaseVM vm, DvmObject<?> dvmObject, String signature, VarArg varArg) {
  209.         switch (signature) {
  210.             case "java/lang/Boolean->booleanValue()Z":
  211.                 return (Boolean) dvmObject.getValue();
  212.             case "android/view/accessibility/AccessibilityManager->isEnabled()Z":
  213.             case "android/view/accessibility/AccessibilityManager->isTouchExplorationEnabled()Z":
  214.                 return false;
  215.             case "java/util/Enumeration->hasMoreElements()Z":
  216.                 return ((Enumeration) dvmObject).hasMoreElements();
  217.             case "java/net/NetworkInterface->isUp()Z":
  218.                 return ((Context.mNetworkInterface) dvmObject.getValue()).isUp();
  219.         }
  220.         return super.callBooleanMethod(vm, dvmObject, signature, varArg);
  221.     }
  222.  
  223.     @Override
  224.     public void callVoidMethod(BaseVM vm, DvmObject<?> dvmObject, String signature, VarArg varArg) {
  225.         if ("com/taobao/dp/util/CallbackHelper->onUpdated(IILjava/lang/String;)V".equals(signature)) {
  226.             return;
  227.         }
  228.         super.callVoidMethod(vm, dvmObject, signature, varArg);
  229.     }
  230.  
  231.     @Override
  232.     public int callIntMethod(BaseVM vm, DvmObject<?> dvmObject, String signature, VarArg varArg) {
  233.         if ("java/lang/Integer->intValue()I".equals(signature)) {
  234.             return (Integer) dvmObject.getValue();
  235.         } else if ("android/telephony/TelephonyManager->getSimState()I".equals(signature)) {
  236.             return ((Context) dvmObject.getValue()).getSimState();
  237.         }
  238.         return super.callIntMethod(vm, dvmObject, signature, varArg);
  239.     }
  240.  
  241.     @Override
  242.     public DvmObject<?> callObjectMethod(BaseVM vm, DvmObject<?> dvmObject, String signature, VarArg varArg) {
  243.         switch (signature) {
  244.             case "java/lang/String->getBytes()[B":
  245.                 return new ByteArray(vm, ((String) dvmObject.getValue()).getBytes());
  246.             case "com/taobao/tao/TaobaoApplication->getPackageCodePath()Ljava/lang/String;":
  247.                 return new StringObject(vm, ((Context) dvmObject.getValue()).getPackageCodePath());
  248.             case "com/taobao/tao/TaobaoApplication->getFilesDir()Ljava/io/File;":
  249.             case "android/content/Context->getFilesDir()Ljava/io/File;":
  250.                 return ProxyDvmObject.createObject(vm, ((Context) dvmObject.getValue()).getFilesDir());
  251.             case "java/io/File->getAbsolutePath()Ljava/lang/String;":
  252.                 return new StringObject(vm, ((File) dvmObject.getValue()).getPath().replace('\\', '/'));
  253.             case "com/taobao/tao/TaobaoApplication->getApplicationInfo()Landroid/content/pm/ApplicationInfo;":
  254.                 return super.callObjectMethod(vm, dvmObject,
  255.                         "android/content/Context->getApplicationInfo()Landroid/content/pm/ApplicationInfo;", varArg);
  256.             case "android/content/Context->getSystemService(Ljava/lang/String;)Ljava/lang/Object;":
  257.                 return ((TaobaoApplication) dvmObject.getValue()).getSystemService(varArg.getObjectArg(0).getValue().toString());
  258.             case "dalvik/system/PathClassLoader->findClass(Ljava/lang/String;)Ljava/lang/Class;":
  259.                 return vm.resolveClass(varArg.getObjectArg(0).getValue().toString());
  260.             case "java/util/Enumeration->nextElement()Ljava/lang/Object;":
  261.                 return ((Enumeration) dvmObject).nextElement();
  262.             case "android/content/Context->getContentResolver()Landroid/content/ContentResolver;":
  263.                 return ((Context) dvmObject.getValue()).getContentResolver();
  264.             case "java/net/NetworkInterface->getName()Ljava/lang/String;":
  265.                 return new StringObject(vm, ((Context.mNetworkInterface) dvmObject.getValue()).getName());
  266.             case "java/lang/Thread->getStackTrace()[Ljava/lang/StackTraceElement;":
  267.                 return ProxyDvmObject.createObject(vm, ((Thread) dvmObject.getValue()).getStackTrace());
  268.             case "java/lang/StackTraceElement->toString()Ljava/lang/String;":
  269.                 return new StringObject(vm, ((StackTraceElement) dvmObject.getValue()).toString());
  270.             case "java/util/HashMap->put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;":
  271.                 return ProxyDvmObject.createObject(vm, ((HashMap<Object, Object>) dvmObject.getValue())
  272.                         .put(varArg.getObjectArg(0).getValue(), varArg.getObjectArg(1).getValue()));
  273.         }
  274.         return super.callObjectMethod(vm, dvmObject, signature, varArg);
  275.     }
  276.  
  277.     @Override
  278.     public DvmObject<?> callObjectMethodV(BaseVM vm, DvmObject<?> dvmObject, String signature, VaList vaList) {
  279.         switch (signature) {
  280.             case "android/content/Context->getClassLoader()Ljava/lang/ClassLoader;":
  281.                 return ProxyDvmObject.createObject(vm, this.getClass().getClassLoader());
  282.             case "android/content/Context->getPackageResourcePath()Ljava/lang/String;":
  283.                 return ProxyDvmObject.createObject(vm, ((Context) dvmObject.getValue()).getPackageResourcePath());
  284.             case "android/content/Context->getFilesDir()Ljava/io/File;":
  285.                 return ProxyDvmObject.createObject(vm, ((Context) dvmObject.getValue()).getFilesDir());
  286.             case "java/io/File->getPath()Ljava/lang/String;":
  287.                 return ProxyDvmObject.createObject(vm, ((File) dvmObject.getValue()).getPath().replace('\\', '/'));
  288.         }
  289.         return super.callObjectMethodV(vm, dvmObject, signature, vaList);
  290.     }
  291.  
  292.     @Override
  293.     public FileResult<AndroidFileIO> resolve(Emulator<AndroidFileIO> emulator, String pathname, int oflags) {
  294.         switch (pathname) {
  295.             case "/data/app/com.taobao.taobao-1/base.apk":
  296.             case "/data/user/0/com.taobao.taobao/files/sg_oc.lock":
  297.             case "/data/user/0/com.taobao.taobao/files/ab914f43b8296c2c.lock":
  298.             case "/data/user/0/com.taobao.taobao/files/0a231bd8575dcf72.txt":
  299.             case "/data/user/0/com.taobao.taobao/files/.ba2f9c85.lock":
  300.             case "/data/user/0/com.taobao.taobao/files/JX0WDG83P1ZN.txt":
  301.             case "/data/user/0/com.taobao.taobao/files/sgFile.lock":
  302.             case "/data/user/0/com.taobao.taobao/app_SGLib/SG_INNER_DATA":
  303.                 return FileResult.success(emulator.getFileSystem().createSimpleFileIO(
  304.                         new File("D:\\DesktopTemp\\tb\\rootfs", pathname), oflags, pathname));
  305.             case "/data/data/com.taobao.taobao/app_SGLib/sec":
  306.             case "/data/user/0/com.taobao.taobao/app_SGLib/sec":
  307.             case "/data/user/0/com.taobao.taobao/app_SGLib/lvmreport":
  308.                 return FileResult.success(emulator.getFileSystem().createDirectoryFileIO(
  309.                         new File("D:\\DesktopTemp\\tb\\rootfs", pathname), oflags, pathname));
  310.             default:
  311.                 return null;
  312.         }
  313.     }
  314.  
  315. }

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/你好赵伟/article/detail/158465
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号