安卓加固與脫殼零基礎(chǔ)掌握vm18.百阿愛測殼

1看雪懸賞問答資料導(dǎo)智能設(shè)AndroidiOS安軟件逆向編程技術(shù)加殼脫殼算法資源WEB安全CTF招聘專區(qū)職業(yè)生涯外文翻茶余飯后會(huì)員專企業(yè)SRC項(xiàng)版發(fā)發(fā)新1『Android安全1 scxc4小時(shí)前加固逆向分析—dex還上DEXdump與修復(fù)下面開始一、首先，我們知dex必然會(huì)調(diào)用dalvik/vm/DvmDex.cpp中以下兩個(gè)函數(shù)任意一個(gè)dvmDexFileOpenFromFddvmDexFileOpenFromFdDexFile DexFile1dvmDexFileOpenFromFd(int DvmDex**23 4DexFile*5MemMap6 parseFlags 7 result -8 9parseFlags|= (lseek(fd, SEEK_SET) ALOGE("lseek goto} (sysMapFileInShmemWritableReadOnly(fd, ALOGE("Unable mapgoto pDexFile dexFileParse((u1*)memMap.addr,memMap.length, (pDexFile NULL)ALOGE("DEXparsegoto = (pDvmDex NULL)dexFilegoto} sysCopyMap(&pDvmDex->memMap,pDvmDex->isMappedReadOnly *ppDvmDex = 1 2 directly-mapped header3 DexOptHeader*4 pointers directly-mappedstructs arrays 5 6 7 8 9 These mapped of "auxillary" included the DexClassLookup* // points start DEX data track overheadforauxillarystructures additionalapp-specificdatastructureswith 通過pDexFile->baseAddr獲取到dex加載的基址 1DexHeader2 includesversion3 adler32checksum4 SHA- 5 lengthof 6 offset 7 8 9 通過pDexFile->pHeader->fileSize獲取到dex文件大小 fd open("/sdcard/dump.dex",O_CREAT O_WRONLY,write(fd,pDexFile->baseAddr,pDexFile->pHeader-這這時(shí)我們已經(jīng)得到dex了。 殼對(duì)dex做了什么？1、修改DexClassDef中的classDataOff字段保存的偏移為負(fù)偏22、將classdata數(shù)據(jù)classdata的數(shù)據(jù)保存在/data/data/xxxx/.1/1.jardex之前先分配空間給jar包，所以他的偏移為負(fù)值，內(nèi)存結(jié)構(gòu)如下圖：1、獲取到pDexFile后，我們遍歷pDexFile->pClassDefs調(diào)用dexGetClassData獲取到ClassData。將ClassData經(jīng)過wri eb128函數(shù)編碼，寫入到文件classdata并記錄每個(gè)class的大?。―exhunter做法#definelog(...){FILE =fopen("/sdcard/dumpdex.log", if

VA_ARGSloghookvoid{constDexClassDef*pClassDefs=pDexFile- classDefsSize=pDexFile->pHeader-DexMapList* =(DexMapList*)(g_pDexFile->baseAddr pDexFile- cls_dat_off i i pMaps- {

if(pMaps->list[i].type //0x2000{cls_dat_off=pMaps->list[i].offset; }log("classdata_offset:0x%x\n", classdata (u4 i<classDefsSize;{const data dexGetClassData(g_pDexFile,DexClassData =if(!pData) int open("/sdcard/classdata",O_APPEND O_CREAT intclass_data_len=uint8_t*out EncodeClassData(pData,log("%d,",class_data_len);//classdatacls_dat_off write(fd,out, 以以上ReadClassData、EncodeClassData函數(shù)用的Dexhunter的。Dexhunter作者3、將classdata寫入到classdata偏移處4、通過程序修復(fù)classdef中的偏移5、運(yùn)行完后我們已經(jīng)獲取到正確的 out.dex拖入JEB已經(jīng)可以正常解析baidu_unpack_so.zip上次的so的idbdump.zipclassdata、dump.dex、log文件out.zipbaidu_unpack_so.zip（1.72MB，38）dump.zip（3.46MB，33）out.zip（3.45MB，33 回回復(fù) 帖已收到0次贊賞，累計(jì)￥06收ddddddfx4時(shí)2樓scxc4時(shí)3樓1回回ddddddfxddddddfx怪客3時(shí)4樓2zfdyqzfdyq3時(shí)5樓1不知世事3時(shí)6樓hanhaochi3時(shí)7樓回回scxc3時(shí)8樓1hanhaochiYoungs3Youngs3時(shí)9樓峰峰3時(shí)10樓大神，onCreateinvoke-static{v1,p00},Lcom/baidu/protect/A;->V(ILjava/lang/Object;[Ljbject;)V，這個(gè)函數(shù)，流程的沒法看了clumsybirda2時(shí)11樓看見樓上的評(píng)論白高興了唉，oncreatedexscxc1時(shí) 1

12樓峰峰大神，onCreatevoke-static{v1,p0,v0},Lcom/baidu/protect/A;->V(ILjavect;[L