1
package com.mfw;
2

3
import com.github.unidbg.linux.android.dvm.AbstractJni;
4
import com.github.unidbg.AndroidEmulator;
5
import com.github.unidbg.Module;
6
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
7
import com.github.unidbg.linux.android.AndroidResolver;
8
import com.github.unidbg.linux.android.dvm.*;
9
import com.github.unidbg.memory.Memory;
10
import java.io.File;
11
import java.util.ArrayList;
12
import java.util.List;
13
import com.github.unidbg.arm.backend.Backend;
14
import com.github.unidbg.pointer.UnidbgPointer;
15
import keystone.Keystone;
16
import keystone.KeystoneArchitecture;
17
import keystone.KeystoneMode;
18

19
public class Mfw extends AbstractJni{
20
    private final AndroidEmulator emulator;
21
    private final VM vm;
22
    private final Module module;
23

24
    Mfw() {
25
        emulator = AndroidEmulatorBuilder.for64Bit().setProcessName("com.mfw.roadbook").build(); // 创建模拟器实例
26
        Memory memory = emulator.getMemory(); // 模拟器的内存操作接口
27
        memory.setLibraryResolver(new AndroidResolver(23)); // 设置系统类库解析
28
        vm = emulator.createDalvikVM(new File("apks/mafengwo/mfw11.3.0.apk")); // 创建Android虚拟机
29
        DalvikModule dm = vm.loadLibrary(new File("apks/mafengwo/libmfw.so"), true); // 加载so到虚拟内存
30
        module = dm.getModule(); //获取本SO模块的句柄
31
        vm.setJni(this);
32
        vm.setVerbose(true);
33
        dm.callJNI_OnLoad(emulator);
34
    };
35

36

37

38
    public String xPreAuthencode(){
39
        List<Object> list = new ArrayList<>(10);
40
        list.add(vm.getJNIEnv()); // 第一个参数是env
41
        list.add(0); // 第二个参数，实例方法是jobject，静态方法是jclazz，直接填0，一般用不到。
42
        DvmObject<?> context = vm.resolveClass("android/content/Context").newObject(null);// context
43
        list.add(vm.addLocalObject(context));
44
        list.add(vm.addLocalObject(new StringObject(vm, "PUT&https%3A%2F%2Fmapi.mafengwo.cn%2Frest%2Fapp%2Fuser%2Flogin%2F&_mfwencode%3DeyJjb250ZW50IjoiWGwvbEhjM00rb24rdjRmOW5GZUU4T0xEUGlTRkFaZ0J2Yk5jVDV4ZU41aVcyZ0xUNXJQb2FRRlE3UlY1dXprZWhReHI4VDRvZ1F0QTZwTzI3UWZ5amdjR1o1bkpWKzRxL0ovaEZPNG5namNcdTAwM2QiLCJrZXkiOiJWbVU3ZUowNk1IUnZONldoQVp0VzZWVS9xTFFqZExUTHByb3BrZS93MkxMb1lpUFBRNW0vTE94Q2RoUG1RVHd0Q3NFdTQxWXh4NHpqdVkwVjJTNEM1YVhJWlRRY0JXSzh4cDkwL1M1Vm1oYVZhaTVvV2pqc3h1a1RZL3ZxQjYwTGlZaXNsSE1hcVNHeUY2eXUwaHcxcFFMa2IvQnRWa0c0L1g3ejJKOU9WSGtCTnVFZVVsZUt6ZXV6eWVNdFEwSThhN3dOWFhSbjF2UEwxSVdodXoveW1ZNTZxSjBROEJMUTFWSWdseFUybG9GREtGa0RFdDZNdTZ6RG1UT2swT3RQR25tZzJhSlVmZ3BHWmNDQU50VWVGeXdsbUJhYTVGeENzS21CcVJRSXJ4ODRIZzFhVHpBd21QdytRMlQ2WExZdWppOThPWlQ5Wldsbm5MNnAzYTc4ZVFcdTAwM2RcdTAwM2QiLCJ2ZXJzaW9uIjoxfQ%253D%253D%26after_style%3Ddefault%26android_oaid%3D00000000-0000-0000-0000-000000000000%26app_code%3Dcom.mfw.roadbook%26app_ver%3D11.3.0%26app_version_code%3D1108%26brand%3Dgoogle%26channel_id%3DVivo%26dev_ver%3DD2504.0%26device_id%3D1a225b1ca66cb7fd%26device_type%3Dandroid%26hardware_model%3DPixel%25202%26has_notch%3D0%26mfwsdk_ver%3D20140507%26o_coord%3Dwgs%26oauth_consumer_key%3D5%26oauth_nonce%3Dd0cb3997-2965-4a93-b22d-4f51f00b4c6d%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1770890982%26oauth_version%3D1.0%26open_udid%3D1a225b1ca66cb7fd%26put_style%3Ddefault%26screen_height%3D1794%26screen_scale%3D2.88%26screen_width%3D1080%26shumeng_id%3DDUE13wluwiFe0hoViIxIC9zGaccdbGJuC100RFVFMTN3bHV3aUZlMGhvVmlJeElDOXpHYWNjZGJHSnVDMTAwc2h1%26sys_ver%3D10%26time_offset%3D480%26x_auth_mode%3Dclient_auth")));
45
        list.add(vm.addLocalObject(new StringObject(vm, "com.mfw.roadbook")));
46

47
        Number number = module.callFunction(emulator, 0x396c8, list.toArray());
48
        String result = vm.getObject(number.intValue()).getValue().toString();
49
        return result;
50
    }
51

52
    public static void main(String[] args) throws Exception {
53
        Mfw test = new Mfw();
54
        System.out.println(test.xPreAuthencode());
55
    }
56
}

1
public void patch(){
2
  UnidbgPointer pointer = UnidbgPointer.pointer(emulator,module.base+0x3C9C4);
3
  // 修正模式为 LittleEndian
4
  Keystone keystone = new Keystone(KeystoneArchitecture.Arm64, KeystoneMode.LittleEndian);
5
  String s = "MOV W0, #1; RET";
6
  byte[] machineCode = keystone.assemble(s).getMachineCode();
7
  assert pointer != null;
8
  pointer.write(machineCode);
9
}

1
long baseAddr = module.base;
2
emulator.attach().addBreakPoint(baseAddr+0x3DF54L, new BreakPointCallback() {
3
  @Override
4
  public boolean onHit(Emulator<?> emulator, long address) {
5
    int x9 = emulator.getBackend().reg_read(Arm64Const.UC_ARM64_REG_X9).intValue();
6
    System.out.printf("获取到x9寄存器的值为:0x%02x\n", x9);
7

8
    return true;
9
  }
10
});

1
# sha1-v1
2
import struct
3

4
bitlen = lambda s: len(s) * 8
5

6

7
def ROL4(x, n):
8
    x &= 0xffffffff
9
    return ((x << n) | (x >> (32 - n))) & 0xffffffff
10

11

12
def madd(*args):
13
    return sum(args) & 0xffffffff
14

15

16
class sha1:
17
    block_size = 64
18
    digest_size = 20
19

20
    def __init__(self, data=b''):
21
        if data is None:
22
            self._buffer = b''
23
        elif isinstance(data, bytes):
24
            self._buffer = data
25
        elif isinstance(data, str):
26
            self._buffer = data.encode('ascii')
27
        else:
28
            raise TypeError('object supporting the buffer API required')
29

30
        self._sign = None
31

32
    def update(self, content):
33
        if isinstance(content, bytes):
34
            self._buffer += content
35
        elif isinstance(content, str):
36
            self._buffer += content.encode('ascii')
37
        else:
38
            raise TypeError('object supporting the buffer API required')
39

40
        self._sign = None
41

42
    def copy(self):
43
        other = self.__class__.__new__(self.__class__)
44
        other._buffer = self._buffer
45
        return other
46

47
    def hexdigest(self):
48
        result = self.digest()
49
        return result.hex()
50

51
    def digest(self):
52
        if not self._sign:
53
            self._sign = self._current()
54
        return self._sign
55

56
    def _current(self):
57
        msg = self._buffer
58

59
        # standard magic number
60
        # A = 0x67452301
61
        # B = 0xEFCDAB89
62
        # C = 0x98BADCFE
63
        # D = 0x10325476
64
        # E = 0xC3D2E1F0
65

66
        A = 0x67452301
67
        B = 0xEFCDAB89
68
        C = 0x98BADCFE
69
        D = 0x5E4A1F7C
70
        E = 0x10325476
71

72
        msg_len = bitlen(msg) & 0xffffffffffffffff
73

74
        zero_pad = (56 - (len(msg) + 1) % 64) % 64
75
        msg = msg + b'\x80'
76
        msg = msg + b'\x00' * zero_pad + struct.pack('>Q', msg_len)
77

78
        for idx in range(0, len(msg), 64):
79
            W = list(struct.unpack('>16I', msg[idx:idx + 64])) + [0] * 64
80

81
            for t in range(16, 80):
82
                T = W[t - 3] ^ W[t - 8] ^ W[t - 14] ^ W[t - 16]
83
                W[t] = ROL4(T, 1)
84

85
            a, b, c, d, e = A, B, C, D, E
86

87
            # main loop:
88
            for t in range(0, 80):
89
                if t <= 15:
90
                    f = (b & c) | ((~b) & d)
91
                    k = 0x5a827999
92

93
                elif  t <= 19:
94
                    f = b ^ c ^ d
95
                    k = 0x6ED9EBA1
96

97

98
                elif  t <= 39:
99
                    f = (b & c) | (b & d) | (c & d)
100
                    k = 0x8F1BBCDC
101

102
                elif t<=59:
103
                    f = (b & c) | ((~b) & d)
104
                    k = 0x5a827999
105

106
                elif 60 <= t <= 79:
107
                    f = b ^ c ^ d
108
                    k = 0xCA62C1D6
109

110
                S0 = madd(ROL4(a, 5), f, e, k, W[t])
111
                S1 = ROL4(b, 30)
112
                if t ==79:
113
                    a, b, d, c, e = S0, a, S1, c, d
114
                else:
115
                    a, b, c, d, e = S0, a, S1, c, d
116

117

118
            A = madd(A, a)
119
            B = madd(B, b)
120
            C = madd(C, c)
121
            D = madd(D, d)
122
            E = madd(E, e)
123

124
        result = struct.pack('>5I', A, B, C, D, E)
125
        return result
126

127

128
if __name__ == '__main__':
129
    s = b'0xnonce'
130
    s0 = sha1(s).hexdigest()
131
    print(s0) # 8a625bcfaced1023f4a3e33f5413c4525f825702

1
public String xAuthencode(){
2
  List<Object> list = new ArrayList<>(10);
3
  list.add(vm.getJNIEnv());
4
  list.add(0);
5
  DvmObject<?> context = vm.resolveClass("android/content/Context").newObject(null);
6
  list.add(vm.addLocalObject(context));
7
  list.add(vm.addLocalObject(new StringObject(vm, "0xnonce")));
8
  list.add(vm.addLocalObject(new StringObject(vm,"")));
9
  list.add(vm.addLocalObject(new StringObject(vm, "com.mfw.roadbook")));
10
  list.add(vm.addLocalObject(DvmBoolean.valueOf(vm,true)));
11
  Number number = module.callFunction(emulator, 0x3998c, list.toArray());
12
  String result = vm.getObject(number.intValue()).getValue().toString();
13
  return result;
14
}