1
function main() {
2
    Java.perform(function () {
3
        var LoginEncryptUtil = Java.use("com.ximalaya.ting.android.loginservice.LoginEncryptUtil");
4
        LoginEncryptUtil["WTWEctUfLf"].implementation = function (context, z, str) {
5
            console.log(`LoginEncryptUtil.WTWEctUfLf is called: context=${context}, z=${z}, str=${str}`);
6
            let result = this["WTWEctUfLf"](context, z, str);
7
            console.log(`LoginEncryptUtil.WTWEctUfLf result=${result}`);
8
            return result;
9
        };
10
    })
11
}
12

13
setImmediate(main);

1
package com.ximalaya;
2
import com.github.unidbg.AndroidEmulator;
3
import com.github.unidbg.Module;
4
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
5
import com.github.unidbg.linux.android.AndroidResolver;
6
import com.github.unidbg.linux.android.dvm.*;
7
import com.github.unidbg.memory.Memory;
8

9
import java.io.File;
10

11
//必须继承AbstractJni
12
public class EncryptUtil extends AbstractJni {
13
    public static AndroidEmulator emulator;  // 静态属性，以后对象和类都可以直接使用
14
    public static Memory memory;
15
    public static VM vm;
16
    public static Module module;
17
    public final DvmClass LoginEncryptUtil;
18
    // 1 构造方法--》用来初始化
19
    public EncryptUtil(){
20
        // 1.创建设备（32位或64位模拟器）， 具体看so文件在哪个目录。 在armeabi-v7a就选择32位
21
        // 传进设备时，如果是32位，后面so文件就要用32位，同理需要用64位的
22
        // 这个名字可以随便写,一般写成app的包名    以后可能会动
23
        emulator = AndroidEmulatorBuilder.for32Bit().setProcessName("com.ximalaya.ting.android").build();
24

25
        // 2.获取内存对象（可以操作内存）
26
        memory = emulator.getMemory();
27

28
        //3.设置安卓sdk版本（只支持19、23）
29
        memory.setLibraryResolver(new AndroidResolver(23));
30

31
        // 4.创建虚拟机（运行安卓代码需要虚拟机，就想运行py代码需要python解释器一样）    以后会动
32
        vm = emulator.createDalvikVM(new File("apks/ximalaya/xmly.apk"));
33
        vm.setJni(this); // 后期补环境会用，把要补的环境，写在当前这个类中，执行这个代码即可，但是必须继承AbstractJni
34
        vm.setVerbose(true); //是否展示调用过程的细节
35

36
        // 5.加载so文件
37
        DalvikModule dm = vm.loadLibrary("login_encrypt", false);   // 以后会动
38
        dm.callJNI_OnLoad(emulator); // jni开发动态注册，会执行JNI_OnLoad，如果是动态注册，需要执行一下这个，如果静态注册，这个不需要执行，车智赢案例是静态注册
39
        LoginEncryptUtil = vm.resolveClass("com.ximalaya.ting.android.loginservice.LoginEncryptUtil");
40
        // 6.dm代表so文件，dm.getModule()得到module对象，基于module对象可以访问so中的成员。
41
        module = dm.getModule(); // 把so文件加载到内存后，后期可以获取基地址，偏移量等，该变量代指so文件
42
    }
43

44
    //2 sign 成员方法--》主要用来解密
45
    public void WTWEctUfLf(){
46
        DvmObject<?> context = vm.resolveClass("android/app/Application", vm.resolveClass("android/content/ContextWrapper", vm.resolveClass("android/content/Context"))).newObject(null);
47
        String param_str = "account=aqsgOa6SYFGEVnn8XH6KkcTVjfGFaVjlYYUHRIuf2/lypnQQ4NrBStm9weVzMdg8yaYGgyX4dP/F\n" +
48
                "dQ39TwXVXkE9ZnbeZCgbsQSPYycZ9tzBKs4e7+xw9yRmv7qZaQpPPK880mK408nf/wbLDvj6rb5F\n" +
49
                "sN0rVP9cOj0pC5lhLgQ=\n" +
50
                "&fdsOtp={\"captcha_id\":\"3723312ce42a04b5c0b40e605a882037\",\"lot_number\":\"fd6f39fe63c241c8b7a89e980dec5db6\",\"pass_token\":\"da453db61a283377f65ccaa7ab1554c58b7090e564d03ad7b4d4fb6a25397401\",\"gen_time\":\"1770081297\",\"captcha_output\":\"2Z76G2CapbcJxb3z0NRv6NWndrlIytoIjX7gLdfkJsQrgtBAoCtFZbq7qWs7QDkcQd2bgFHjUC0fpWFUpuIwd_k_JWPqHe9TBEOkJ1jqLFicEpmmAmdU2MEBYwncCxHVi33DvIRKYrwyoEByBsAa1SZ5X7mzDpdEWSMD5CpT3e4WcDXV-vnaQm-p5EaL0prpMKLRAaAfULuMBJJfkl3i6OAmTRc4uvulOTHp9dyw7BwQydb-aPAdat8c1xd9PMd9LO_PeIAdjPJ5oaVZSC5yzEtwgUg7CfIu90p6YDIwkUiBLfVCZVGT3a-y2eS9dcyLlGkAw1A898P__HBQHc8A4-D4lY5hm680D2jZwVLqqWr3GCeKyzOcR1fejMMH-RZIL-ocLdVl60cmTSXbRqNC-xH3CmQbFIBidbSXYUDDxXRKo7BuHaukYsTTuFmKfOzSV6L2kymVNIdw58k6eTRMbfvuL6bcwYaWmZ4_Ss02ZNt4UJeMcoQt733FkNET4fRPiAEwqzNxtesz-GAQ6Uyta3F84KBaFfY3Ix6tJVQVbQQ=\"}&nonce=0-22881C771F2437b725b395e8aa833f7a42e858ebd51c82129ebbb05eb53be0&password=EzHwdxwNPpKmd0jSSJO79ZQZa/Fu1lYTMGB2QBuRFNWTdtaxv2pIMECdzIdQHmfQkbaSQWjuSqCm\n" +
51
                "w1Q3ca6foQ6TpfucYKV5sQNZodaIjhF6EIpua/SffV7gWgO2g+mzBk5j3muCSKZCuEduWgtCOaqk\n" +
52
                "jVZvN+1LgaZSXqHrVdE=\n" +
53
                "&";
54
        String ret = LoginEncryptUtil.newObject(null).callJniMethodObject(emulator,"WTWEctUfLf(Landroid/content/Context;ZLjava/lang/String;)Ljava/lang/String;",context,false,param_str).getValue().toString();
55
        System.out.println(ret);
56
    }
57

58
    // 3 main方法---》右键直接运行
59
    public static void main(String[] args) {
60
        EncryptUtil loginEncryptUtil=new EncryptUtil();
61
        loginEncryptUtil.WTWEctUfLf();
62
    }
63
}

1
@Override
2
public DvmObject<?> callObjectMethod(BaseVM vm, DvmObject<?> dvmObject, String signature, VarArg varArg) {
3
   switch (signature){
4
     case "java/lang/String->toUpperCase()Ljava/lang/String;":{
5
       String str = (String) dvmObject.getValue();
6
       System.out.println("输入参数==>"+str);
7
       return new StringObject(vm,str.toUpperCase());
8
     }
9
   }
10
   return super.callObjectMethod(vm, dvmObject, signature, varArg);
11
}

1
@Override
2
public DvmObject<?> newObject(BaseVM vm, DvmClass dvmClass, String signature, VarArg varArg) {
3
  switch (signature){
4
    case "java/lang/StringBuilder-><init>()V":{
5
      return vm.resolveClass("java/lang/StringBuilder").newObject(new StringBuilder());
6
    }
7
  }
8
  return super.newObject(vm, dvmClass, signature, varArg);
9
}

1
@Override
2
public DvmObject<?> callStaticObjectMethod(BaseVM vm, DvmClass dvmClass, String signature, VarArg varArg) {
3
   switch (signature){
4
     case "java/security/MessageDigest->getInstance(Ljava/lang/String;)Ljava/security/MessageDigest;":{
5
       String algorithm = varArg.getObjectArg(0).getValue().toString();
6
       try {
7
         MessageDigest md = MessageDigest.getInstance(algorithm);
8
         return vm.resolveClass("java/security/MessageDigest").newObject(md);
9
       } catch (NoSuchAlgorithmException e) {
10
         throw new RuntimeException(e);
11
       }
12
     }
13
   }
14
   return super.callStaticObjectMethod(vm, dvmClass, signature, varArg);
15
}

1
@Override
2
public void callVoidMethod(BaseVM vm, DvmObject<?> dvmObject, String signature, VarArg varArg) {
3
  switch (signature){
4
    case "java/security/MessageDigest->update([B)V":{
5
      MessageDigest md = (MessageDigest)dvmObject.getValue();
6
      byte[] data = (byte[]) varArg.getObjectArg(0).getValue();
7
      md.update(data);
8
      return;
9
    }
10
  }
11
  super.callVoidMethod(vm, dvmObject, signature, varArg);
12
}

1
case "java/security/MessageDigest->digest()[B":{
2
  MessageDigest md = (MessageDigest)dvmObject.getValue();
3
  return new ByteArray(vm,md.digest());
4
}

1
case "java/lang/Integer->toHexString(I)Ljava/lang/String;":{
2
  int value = varArg.getIntArg(0);
3
  String hex = Integer.toHexString(value);
4
  return new StringObject(vm,hex);
5
}

1
@Override
2
public int callIntMethod(BaseVM vm, DvmObject<?> dvmObject, String signature, VarArg varArg) {
3
  switch (signature){
4
    case "java/lang/String->length()I":{
5
      String str = (String) dvmObject.getValue();
6
      return str.length();
7
    }
8
  }
9
  return super.callIntMethod(vm, dvmObject, signature, varArg);
10
}

1
case "java/lang/StringBuilder->append(Ljava/lang/String;)Ljava/lang/StringBuilder;": {
2
  Object value = dvmObject.getValue();
3
  if (value instanceof StringBuilder){
4
    StringBuilder sb = (StringBuilder)value;
5
    sb.append(varArg.getObjectArg(0).getValue().toString());
6
    return vm.resolveClass("java/lang/StringBuilder");
7
  }
8
}
9
case "java/lang/StringBuilder->append(I)Ljava/lang/StringBuilder;":{
10
  Object value = dvmObject.getValue();
11
  if (value instanceof StringBuilder){
12
    StringBuilder sb = (StringBuilder)value;
13
    sb.append(varArg.getIntArg(0));
14
    return vm.resolveClass("java/lang/StringBuilder");
15
  }
16
}

1
public void traceCode() {
2
  String traceFile = "unidbg-android/src/test/java/com/ximalaya/traceCode.log"; // 输出的路径
3
  PrintStream traceStream = null; // 打印流
4
  try {
5
    traceStream = new PrintStream(new FileOutputStream(traceFile), true);
6
  } catch (FileNotFoundException e) {
7
    throw new RuntimeException(e);
8
  }
9
  // traceCode 对代码进行监控
10
  emulator.traceCode(module.base, module.base + module.size).setRedirect(traceStream);
11
}

1
emulator.attach().addBreakPoint(module.findSymbolByName("memcpy").getAddress(), new BreakPointCallback() {
2
  @Override
3
  public boolean onHit(Emulator<?> emulator, long address) {
4
    RegisterContext registerContext = emulator.getContext();
5
    UnidbgPointer src = registerContext.getPointerArg(1);
6
    int length = registerContext.getIntArg(2);
7
    Inspector.inspect(src.getByteArray(0, length), "memcpy:" + src.toString());
8
    return true;
9
  }
10
});

1
emulator.attach().addBreakPoint(module.base+0x5B1A);

1
emulator.traceWrite(0x1220d018, 0x1220d018 +0x13);