1
function hook_map() {
2
    console.log("hook hashMap")
3
    var hashMap = Java.use("java.util.HashMap");
4
    hashMap.put.implementation = function (a, b) {
5
        if (a!=null&&a.equals("sign")) {
6
            console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
7
            console.log('输出-->', a, b)
8

9
        }
10
        return this.put(a, b)
11
    }
12
}
13
Java.perform(function(){
14
    hook_map()
15
})

1
function hook_getString(num) {
2
  Java.perform(function () {
3
    var StubApp = Java.use("com.stub.StubApp");
4
    console.log("num:", num,'-->',StubApp.getString2(num));
5
  })
6
}

1
function hook_md5_crypt(){
2
    Java.perform(function(){
3
        var ByteString = Java.use("com.android.okhttp.okio.ByteString");
4
        var Class = Java.use('com.luckincoffee.safeboxlib.CryptoHelper');
5
        Class['md5_crypt'].implementation = function(){
6
            console.log('sign参数加密位置::');
7
            var result = this['md5_crypt']['apply'](this,arguments);
8
            console.log('arg1:'+ByteString.of(arguments[0]).utf8());
9
            console.log('arg2:'+arguments[1]);
10
            console.log('result_sign:'+ByteString.of(result).utf8());
11
            return result;
12
        }
13
    })
14
}

1
package com.ruixing;
2

3
import com.github.unidbg.AndroidEmulator;
4
import com.github.unidbg.Emulator;
5
import com.github.unidbg.Module;
6
import com.github.unidbg.arm.context.RegisterContext;
7
import com.github.unidbg.debugger.BreakPointCallback;
8
import com.github.unidbg.file.FileResult;
9
import com.github.unidbg.file.IOResolver;
10
import com.github.unidbg.hook.hookzz.HookEntryInfo;
11
import com.github.unidbg.hook.hookzz.HookZz;
12
import com.github.unidbg.hook.hookzz.HookZzArm32RegisterContext;
13
import com.github.unidbg.hook.hookzz.WrapCallback;
14
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
15
import com.github.unidbg.linux.android.AndroidResolver;
16
import com.github.unidbg.linux.android.dvm.AbstractJni;
17
import com.github.unidbg.linux.android.dvm.DalvikModule;
18
import com.github.unidbg.linux.android.dvm.VM;
19
import com.github.unidbg.linux.android.dvm.array.ByteArray;
20
import com.github.unidbg.memory.Memory;
21
import com.github.unidbg.utils.Inspector;
22
import com.sun.jna.Pointer;
23

24
import java.io.File;
25
import java.nio.charset.StandardCharsets;
26
import java.util.ArrayList;
27

28

29
public class CryptoDD extends AbstractJni implements IOResolver {
30
    private final AndroidEmulator emulator;
31
    private final VM vm;
32
    private final Module module;
33

34
    //构造函数,配置相关信息
35
    CryptoDD() {
36
//        emulator = AndroidEmulatorBuilder
37
//                .for32Bit()
38
//                .setRootDir(new File("target/rootfs"))
39
//                .build(); // 创建模拟器实例，要模拟32位或者64位，在这里区分
40
//        emulator.getSyscallHandler().addIOResolver(this); // 绑定IO重定向接口
41
//        System.out.println("当前进程PID：" + emulator.getPid());
42
        emulator = AndroidEmulatorBuilder.for32Bit().build();
43
        final Memory memory = emulator.getMemory(); // 模拟器的内存操作接口
44
        memory.setLibraryResolver(new AndroidResolver(23)); // 设置系统类库解析
45
        vm = emulator.createDalvikVM(new File("apks/ruixing/ruixing.apk"));
46
        DalvikModule dm = vm.loadLibrary("cryptoDD", true);
47
        module = dm.getModule();
48
        vm.setJni(this);
49
        vm.setVerbose(true);
50
        dm.callJNI_OnLoad(emulator);
51

52
    }
53
    public void md5_crypt(){
54
        ArrayList<Object> list = new ArrayList<>(10);
55
        list.add(vm.getJNIEnv());
56
        list.add(0);
57
        String s = "cid=210101;q=3uda9DTWh1HzaMzrcZhTxcwe8AgwkxzHjqEegyMDUsEB79NUuaF-yz3Tr95ivqP96KFYlrb4g_m0H9p6GoIAdO7kWUXiBFQsl7SZEgHXBL0bzG5qAdTpfBhia0FXpCUZRxtjFsJ4IkBXUSYqY67IbCR1a-G8iola34uRO1D-R46WTsnmOy4LmWTW2CDNyo9v;uid=bd17e261-c511-4ca6-b8a1-5f3900b733b81771931072631";
58
        ByteArray byteArray = new ByteArray(vm,s.getBytes(StandardCharsets.UTF_8));
59
        list.add(vm.addLocalObject(byteArray));
60
        list.add(1);
61
        Number number = module.callFunction(emulator, 0x1a981, list.toArray());
62
        ByteArray result_arr = vm.getObject(number.intValue());
63
        String result = new String(result_arr.getValue());
64
        Inspector.inspect((byte[]) vm.getObject(number.intValue()).getValue(),"md5_crypt");
65
        System.out.println("sign==>"+ result);
66
    }
67
    public static void main(String[] args) {
68
        CryptoDD cryptoDD = new CryptoDD();
69
        cryptoDD.md5_crypt();
70
    }
71
    @Override
72
    public FileResult resolve(Emulator emulator, String pathname, int oflags) {
73
        System.out.println("pathname open:" + pathname);
74
        return null;
75
    }
76
}

1
import hashlib
2
import struct
3

4
def do_md5_sign_simulated(initial_msg: bytes):
5
    # 1. 计算标准 MD5
6
    m = hashlib.md5()
7
    m.update(initial_msg)
8
    v14 = m.digest() # 得到 16 字节数据
9

10
    # 2. 将 16 字节拆分为 4 个 32 位整数 (大端序，对应你之前的 bytesToInt)
11
    # '>4i' 表示 4 个有符号的 int32
12
    ints = struct.unpack('>4i', v14)
13
    print(ints)
14
    # 3. 对每个整数取绝对值，并转为字符串
15
    parts = []
16
    for val in ints:
17
        # 模拟 C 语言中的 if (v < 0) v = -v;
18
        abs_val = abs(val)
19
        parts.append(str(abs_val))
20

21
    # 4. 拼接所有字符串
22
    result_str = "".join(parts)
23

24
    # 返回结果及其长度 (对应 C 里的 v11)
25
    return result_str.encode('utf-8'), len(result_str)
26

27
msg = b"cid=210101;q=3uda9DTWh1HzaMzrcZhTxcwe8AgwkxzHjqEegyMDUsEB79NUuaF-yz3Tr95ivqP96KFYlrb4g_m0H9p6GoIAdO7kWUXiBFQsl7SZEgHXBL0bzG5qAdTpfBhia0FXpCUZRxtjFsJ4IkBXUSYqY67IbCR1a-G8iola34uRO1D-R46WTsnmOy4LmWTW2CDNyo9v;uid=bd17e261-c511-4ca6-b8a1-5f3900b733b81771931072631dJLdCJiVnDvM9JUpsom9"
28
digest_bytes, length = do_md5_sign_simulated(msg)
29
print(f"Digest: {digest_bytes.decode()}")  // 79903440421321686324907558431145496727
30
print(f"Length: {length}")

1
function hook_aes() {
2
  var String = Java.use('java.lang.String');
3
  var Base64 = Java.use('java.util.Base64');
4
  var CryptoHelper = Java.use("com.luckincoffee.safeboxlib.CryptoHelper");
5
  CryptoHelper["localAESWork4Api"].implementation = function (bArr, i2) {
6
    let result = this["localAESWork4Api"](bArr, i2);
7
    if (i2 == 0) {// 代表加密
8
     console.log("参数1::",String.$new(bArr))
9
     console.log("参数2::", i2)
10
     console.log("加密结果::",Base64.getEncoder().encodeToString(result))
11
    }
12
    if(i2 == 1){// 代表解密
13
      console.log("参数1::",Base64.getEncoder().encodeToString(bArr))
14
      console.log("参数2::",i2)
15
      console.log("解密结果::",String.$new(result))
16
    }
17
    return result;
18
  };
19
}

1
public void localAESWork4Api(){
2
  ArrayList<Object> list = new ArrayList<>(10);
3
  list.add(vm.getJNIEnv());
4
  list.add(0);
5
  String arg1 = "{\"regId\":\"\",\"appversion\":\"5001\",\"deviceId\":\"android_lucky_f92362bbcc270362\",\"systemVersion\":\"29\",\"deviceBrand\":\"google\"}";
6
  ByteArray byteArray = new ByteArray(vm, arg1.getBytes(StandardCharsets.UTF_8));
7
  list.add(vm.addLocalObject(byteArray));
8
  list.add(0);
9
  Number number = module.callFunction(emulator, 0x1b1cd, list.toArray());
10
  Inspector.inspect((byte[]) vm.getObject(number.intValue()).getValue(), "localAESWork4Api");
11
  System.out.println("result==>" + Base64.getEncoder().encodeToString((byte[]) vm.getObject(number.intValue()).getValue()));
12
}

1
emulator.attach().addBreakPoint(module.base+0x17BD);

1
emulator.attach().addBreakPoint(module.base+0x15320); // aes128_enc_wb_coff
2
emulator.attach().addBreakPoint(module.base+0x15C8C); // aes128_enc_wb_xlc

1
emulator.attach().addBreakPoint(module.base + 0x14F98, new BreakPointCallback() {
2
  int count = 0;
3
  @Override
4
  public boolean onHit(Emulator<?> emulator, long address) {
5
    count += 1;
6
    System.out.println("count==>" + count);
7
    return true;
8
  }
9
});

1
public void dfaAttack(){
2
  emulator.attach().addBreakPoint(module.base + 0x14F98, new BreakPointCallback() {
3
    int count = 0;
4
    UnidbgPointer arg0Pointer;
5

6
    @Override
7
    public boolean onHit(Emulator<?> emulator, long address) {
8
      count += 1;
9
      arg0Pointer = emulator.getContext().getPointerArg(0);
10
//                System.out.println("count==>" + count);
11
      if (count % 9 == 0) {
12
        arg0Pointer.setByte(randInt(0,15),(byte) randInt(0,0xff));
13
      }
14
      return true;
15
    }
16
  });
17
}

1
package com.ruixing;
2

3
import com.github.unidbg.AndroidEmulator;
4
import com.github.unidbg.Emulator;
5
import com.github.unidbg.Module;
6
import com.github.unidbg.arm.context.RegisterContext;
7
import com.github.unidbg.debugger.BreakPointCallback;
8
import com.github.unidbg.file.FileResult;
9
import com.github.unidbg.file.IOResolver;
10
import com.github.unidbg.hook.hookzz.HookEntryInfo;
11
import com.github.unidbg.hook.hookzz.HookZz;
12
import com.github.unidbg.hook.hookzz.HookZzArm32RegisterContext;
13
import com.github.unidbg.hook.hookzz.WrapCallback;
14
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
15
import com.github.unidbg.linux.android.AndroidResolver;
16
import com.github.unidbg.linux.android.dvm.AbstractJni;
17
import com.github.unidbg.linux.android.dvm.DalvikModule;
18
import com.github.unidbg.linux.android.dvm.VM;
19
import com.github.unidbg.linux.android.dvm.array.ByteArray;
20
import com.github.unidbg.memory.Memory;
21
import com.github.unidbg.memory.MemoryBlock;
22
import com.github.unidbg.pointer.UnidbgPointer;
23
import com.github.unidbg.utils.Inspector;
24
import com.github.unidbg.virtualmodule.android.AndroidModule;
25
import com.sun.jna.Pointer;
26

27
import java.io.File;
28
import java.nio.charset.StandardCharsets;
29
import java.util.ArrayList;
30
import java.util.Base64;
31
import java.util.Random;
32

33

34
public class CryptoDD extends AbstractJni implements IOResolver {
35
    private final AndroidEmulator emulator;
36
    private final VM vm;
37
    private final Module module;
38

39
    //构造函数,配置相关信息
40
    CryptoDD() {
41
//        emulator = AndroidEmulatorBuilder
42
//                .for32Bit()
43
//                .setRootDir(new File("target/rootfs"))
44
//                .build(); // 创建模拟器实例，要模拟32位或者64位，在这里区分
45
//        emulator.getSyscallHandler().addIOResolver(this); // 绑定IO重定向接口
46
//        System.out.println("当前进程PID：" + emulator.getPid());
47
        emulator = AndroidEmulatorBuilder.for32Bit().build();
48
        final Memory memory = emulator.getMemory(); // 模拟器的内存操作接口
49
        memory.setLibraryResolver(new AndroidResolver(23)); // 设置系统类库解析
50
        vm = emulator.createDalvikVM(new File("apks/ruixing/ruixing.apk"));
51
        new AndroidModule(emulator,vm).register(memory);
52
        DalvikModule dm = vm.loadLibrary("cryptoDD", true);
53
        module = dm.getModule();
54
        vm.setJni(this);
55
        vm.setVerbose(false);
56
        dm.callJNI_OnLoad(emulator);
57

58
    }
59

60
    public void md5_crypt() {
61
//        emulator.attach().addBreakPoint(module.base + 0x14D54);
62
//        emulator.attach().addBreakPoint(module.base + 0x13E3C);
63
        ArrayList<Object> list = new ArrayList<>(10);
64
        list.add(vm.getJNIEnv());
65
        list.add(0);
66
        String s = "cid=210101;q=3uda9DTWh1HzaMzrcZhTxcwe8AgwkxzHjqEegyMDUsEB79NUuaF-yz3Tr95ivqP96KFYlrb4g_m0H9p6GoIAdO7kWUXiBFQsl7SZEgHXBL0bzG5qAdTpfBhia0FXpCUZRxtjFsJ4IkBXUSYqY67IbCR1a-G8iola34uRO1D-R46WTsnmOy4LmWTW2CDNyo9v;uid=bd17e261-c511-4ca6-b8a1-5f3900b733b81771931072631";
67
        ByteArray byteArray = new ByteArray(vm, s.getBytes(StandardCharsets.UTF_8));
68
        list.add(vm.addLocalObject(byteArray));
69
        list.add(1);
70
        Number number = module.callFunction(emulator, 0x1a981, list.toArray());
71
        ByteArray result_arr = vm.getObject(number.intValue());
72
        String result = new String(result_arr.getValue());
73
        Inspector.inspect((byte[]) vm.getObject(number.intValue()).getValue(), "md5_crypt");
74
        System.out.println("sign==>" + result);
75
    }
76

77

78
    public static int randInt(int min, int max) {
79
        Random rand = new Random();
80
        return rand.nextInt((max - min) + 1) + min;
81
    }
82
    public static int randint(int min, int max) {
83
        Random rand = new Random();
84
        return rand.nextInt((max - min) + 1) + min;
85
    }
86

87
    public void dfaAttack(){
88
        emulator.attach().addBreakPoint(module.base + 0x14F98, new BreakPointCallback() {
89
            int count = 0;
90
            UnidbgPointer arg0Pointer;
91

92
            @Override
93
            public boolean onHit(Emulator<?> emulator, long address) {
94
                count += 1;
95
                arg0Pointer = emulator.getContext().getPointerArg(0);
96
//                System.out.println("count==>" + count);
97
                if (count % 9 == 0) {
98
                    arg0Pointer.setByte(randInt(0,15),(byte) randInt(0,0xff));
99
                }
100
                return true;
101
            }
102
        });
103
    }
104
    public static byte[] hexToBytes(String hexString) {
105
        if (hexString.isEmpty()) {
106
            return null;
107
        }
108
        hexString = hexString.toLowerCase();
109
        final byte[] byteArray = new byte[hexString.length() >> 1];
110
        int index = 0;
111
        for (int i = 0; i < hexString.length(); i++) {
112
            if (index  > hexString.length() - 1) {
113
                return byteArray;
114
            }
115
            byte highDit = (byte) (Character.digit(hexString.charAt(index), 16) & 0xFF);
116
            byte lowDit = (byte) (Character.digit(hexString.charAt(index + 1), 16) & 0xFF);
117
            byteArray[i] = (byte) (highDit << 4 | lowDit);
118
            index += 2;
119
        }
120
        return byteArray;
121
    }
122

123
    public static String bytesToHex(byte[] bytes) {
124
        StringBuffer sb = new StringBuffer();
125
        for(int i = 0; i < bytes.length; i++) {
126
            String hex = Integer.toHexString(bytes[i] & 0xFF);
127
            if(hex.length() < 2){
128
                sb.append(0);
129
            }
130
            sb.append(hex);
131
        }
132
        return sb.toString();
133
    }
134
    public void localAESWork4Api() {
135
//        emulator.attach().addBreakPoint(module.base+0x17BD4);
136
//        emulator.attach().addBreakPoint(module.base+0x15320); // aes128_enc_wb_coff
137
//        emulator.attach().addBreakPoint(module.base+0x15C8C); // aes128_enc_wb_xlc
138

139
//        emulator.attach().addBreakPoint(module.base+0x15AD6);
140
//        emulator.attach().addBreakPoint(module.base+0x14F98);
141

142
        ArrayList<Object> list = new ArrayList<>(10);
143
        list.add(vm.getJNIEnv());
144
        list.add(0);
145
        String arg1 = "0xnonce";
146
        ByteArray byteArray = new ByteArray(vm, arg1.getBytes(StandardCharsets.UTF_8));
147
        list.add(vm.addLocalObject(byteArray));
148
        list.add(0);
149
        Number number = module.callFunction(emulator, 0x1b1cd, list.toArray());
150
//        Inspector.inspect((byte[]) vm.getObject(number.intValue()).getValue(), "localAESWork4Api");
151
        System.out.println(bytesToHex((byte[]) vm.getObject(number.intValue()).getValue()));
152
    }
153

154
    public void wbaes_ecb(){
155
        MemoryBlock inputBlock = emulator.getMemory().malloc(16, true);
156
        UnidbgPointer inPtr = inputBlock.getPointer();
157
        MemoryBlock outBlock = emulator.getMemory().malloc(16, true);
158
        UnidbgPointer outPtr = outBlock.getPointer();
159
        byte[] inByteData = hexToBytes("30786e6f6e63650b0b0b0b0b0b0b0b0b");
160
        assert inByteData != null;
161
        inPtr.write(0,inByteData,0,inByteData.length);
162
        module.callFunction(emulator, 0x17bd5, inPtr, 16, outPtr, 0);
163
        String ret = bytesToHex(outPtr.getByteArray(0, 0x10));
164
        System.out.println(ret);
165
        inputBlock.free();
166
        outBlock.free();
167

168

169
    }
170

171
    public static void main(String[] args) {
172
        CryptoDD cryptoDD = new CryptoDD();
173
//        cryptoDD.md5_crypt();
174
//        for (int i = 0; i < 200; i++) {
175
//            cryptoDD.dfaAttack();
176
//            cryptoDD.wbaes_ecb();
177
//        }
178
        cryptoDD.wbaes_ecb();
179
//        cryptoDD.localAESWork4Api();
180
    }
181

182
    @Override
183
    public FileResult resolve(Emulator emulator, String pathname, int oflags) {
184
        System.out.println("pathname open:" + pathname);
185
        return null;
186
    }
187
}

1
import phoenixAES
2

3

4
phoenixAES.crack_file("./tracefile",[],True,False,verbose=2)