1
服务端响应 -> RspHead.phoneGuid
2
-> Global.setPhoneGuid(head.phoneGuid)
3
-> Global.mPhoneGuid
4
-> FileUtil.write(files/.pid)
5
-> 下次启动 Global.genPhoneGuid() 再读取这个.pid文件的值

1
package com.yinyongbao;
2

3
import com.github.unidbg.AndroidEmulator;
4
import com.github.unidbg.Emulator;
5
import com.github.unidbg.Module;
6
import com.github.unidbg.arm.context.RegisterContext;
7
import com.github.unidbg.file.FileResult;
8
import com.github.unidbg.file.IOResolver;
9
import com.github.unidbg.hook.hookzz.HookEntryInfo;
10
import com.github.unidbg.hook.hookzz.HookZz;
11
import com.github.unidbg.hook.hookzz.HookZzArm64RegisterContext;
12
import com.github.unidbg.hook.hookzz.IHookZz;
13
import com.github.unidbg.hook.hookzz.WrapCallback;
14
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
15
import com.github.unidbg.linux.android.AndroidResolver;
16
import com.github.unidbg.linux.android.SystemPropertyHook;
17
import com.github.unidbg.linux.android.SystemPropertyProvider;
18
import com.github.unidbg.linux.android.dvm.*;
19
import com.github.unidbg.linux.android.dvm.api.Bundle;
20
import com.github.unidbg.memory.Memory;
21
import com.github.unidbg.pointer.UnidbgPointer;
22
import com.github.unidbg.virtualmodule.android.AndroidModule;
23
import com.sun.jna.Pointer;
24

25
import java.io.File;
26
import java.io.FileNotFoundException;
27
import java.io.FileOutputStream;
28
import java.io.PrintStream;
29
import java.util.HashMap;
30
import java.util.Map;
31

32
public class OZ extends AbstractJni implements IOResolver {
33

34
    // ================= 配置区 =================
35

36
    // true 表示加载 arm64-v8a；false 表示加载 armeabi-v7a
37
    private static final boolean IS_64BIT = true;
38

39
    // 模拟进程名 / 包名
40
    private static final String PROCESS_NAME = "com.tencent.android.qqdownloader";
41

42
    // APK 路径。若不需要加载 APK，可设为 null
43
    private static final String APK_PATH = "apks/yyb/base.apk";
44

45
    // so 加载方式说明：
46
    // false = 按 SO_PATH 指定的完整路径加载
47
    // true  = 按 SO_NAME 让 unidbg 从 APK 中解析并加载
48
    private static final boolean LOAD_BY_NAME = true;
49
    private static final String SO_PATH = ""; // LOAD_BY_NAME=false 时使用
50
    private static final String SO_NAME = "qimei"; // LOAD_BY_NAME=true 时使用，不带 lib 前缀和 .so 后缀
51

52
    // 是否打印 JNI 调用日志
53
    private static final boolean VERBOSE = true;
54

55
    // ========================================
56

57
    public static AndroidEmulator emulator;
58
    public static Memory memory;
59
    public static VM vm;
60
    public static Module module;
61

62
    private static final String TARGET_STR = "F3LI7aF/FS8taYJD7vm5YwZvcozu1G3c8Ryl/ZRsqqk=";
63

64
    // 这里可用于缓存 Bundle 模拟数据
65
    private final Map<String, String> bundleData = new HashMap<>();
66

67
    public OZ() {
68
        // 1. 创建模拟器
69
        emulator = IS_64BIT
70
                ? AndroidEmulatorBuilder.for64Bit().setProcessName(PROCESS_NAME).build()
71
                : AndroidEmulatorBuilder.for32Bit().setProcessName(PROCESS_NAME).build();
72

73
        // 2. 获取内存对象
74
        memory = emulator.getMemory();
75

76
        // 3. 设置 Android SDK 版本
77
        memory.setLibraryResolver(new AndroidResolver(23));
78

79
        // 4. 创建 Dalvik VM
80
        vm = APK_PATH != null
81
                ? emulator.createDalvikVM(new File(APK_PATH))
82
                : emulator.createDalvikVM();
83
        vm.setJni(this);
84
        vm.setVerbose(VERBOSE);
85

86
        // 5. 注册系统模块并加载目标 so
87
        new AndroidModule(emulator, vm).register(memory);
88
        DalvikModule dm = LOAD_BY_NAME
89
                ? vm.loadLibrary(SO_NAME, false)
90
                : vm.loadLibrary(new File(SO_PATH), false);
91

92
        // 6. 调用 JNI_OnLoad
93
        dm.callJNI_OnLoad(emulator);
94

95
        // 7. 保存模块对象，后续下断点 / trace 要用
96
        module = dm.getModule();
97
    }
98

99
    private static String safeReadCString(Pointer p) {
100
        if (p == null) {
101
            return "null";
102
        }
103
        try {
104
            return p.getString(0);
105
        } catch (Throwable e) {
106
            return "<bad-ptr:" + p + ">";
107
        }
108
    }
109

110
    @Override
111
    public DvmObject<?> callObjectMethodV(BaseVM vm, DvmObject<?> dvmObject, String signature, VaList vaList) {
112
        switch (signature) {
113
            case "com/qq/AppService/RealAstApp->getPackageName()Ljava/lang/String;": {
114
                return new StringObject(vm, "com.tencent.android.qqdownloader");
115
            }
116
            case "com/qq/AppService/RealAstApp->getContentResolver()Landroid/content/ContentResolver;": {
117
                return vm.resolveClass("android/content/ContentResolver").newObject(null);
118
            }
119

120
            case "android/content/ContentResolver->call(Landroid/net/Uri;Ljava/lang/String;Ljava/lang/String;Landroid/os/Bundle;)Landroid/os/Bundle;": {
121
                // 这里记录 ContentResolver.call 的 method / arg，后续在 Bundle.getString 再补返回值
122
                String lastMethod = vaList.getObjectArg(1).getValue().toString();
123
                String arg = vaList.getObjectArg(2).getValue().toString();
124

125
                System.out.println("[*] ContentResolver.call => method=" + lastMethod + ", arg=" + arg);
126

127
                // 返回一个 Bundle 对象，供后续 native 继续取值
128
                return vm.resolveClass("android/os/Bundle").newObject(null);
129
            }
130
            case "android/os/Bundle->getString(Ljava/lang/String;)Ljava/lang/String;": {
131
                String key = vaList.getObjectArg(0).getValue().toString();
132
                System.out.println("[*] Bundle.getString => key=" + key);
133

134
                // libqimei.so 在这里取 settings 中的 android_id
135
                // 从 trace 可知：调用 GET_secure 后，会继续读取 key="value"
136
                if ("value".equals(key)) {
137
                    String androidId = "22577096caea2b28";
138
                    System.out.println("[+] 返回模拟的 Android ID: " + androidId);
139
                    return new StringObject(vm, androidId);
140
                }
141

142
                // 其余 key 默认返回空字符串，避免 native 层拿到 null
143
                return new StringObject(vm, "");
144
            }
145
        }
146
        return super.callObjectMethodV(vm, dvmObject, signature, vaList);
147
    }
148

149
    @Override
150
    public DvmObject<?> callStaticObjectMethodV(BaseVM vm, DvmClass dvmClass, String signature, VaList vaList) {
151
        switch (signature) {
152
            case "android/net/Uri->parse(Ljava/lang/String;)Landroid/net/Uri;": {
153
                String urlString = vaList.getObjectArg(0).getValue().toString();
154
                return vm.resolveClass("android/net/Uri").newObject(urlString);
155
            }
156
        }
157
        return super.callStaticObjectMethodV(vm, dvmClass, signature, vaList);
158
    }
159

160
    @Override
161
    public DvmObject<?> getStaticObjectField(BaseVM vm, DvmClass dvmClass, String signature) {
162
        switch (signature) {
163
            case "android/os/Bundle->EMPTY:Landroid/os/Bundle;": {
164
                return vm.resolveClass("android/os/Bundle").newObject(null);
165
            }
166
        }
167
        return super.getStaticObjectField(vm, dvmClass, signature);
168
    }
169

170
    public void z() {
171
        DvmClass appClass = vm.resolveClass(
172
                "com/qq/AppService/RealAstApp",
173
                vm.resolveClass("android/app/Application"));
174
        DvmObject<?> context = appClass.newObject(null);
175
        DvmClass uClass = vm.resolveClass("com/tencent/qimei/uin/U");
176

177
        DvmObject<?> ret = uClass.callStaticJniMethodObject(
178
                emulator,
179
                "z(Landroid/content/Context;)Ljava/lang/String;",
180
                context);
181

182
        System.out.println("[+] U.z() 返回值: " + ret.getValue());
183
    }
184

185
    public void consoleDebugger() {
186
        emulator.attach().addBreakPoint(module.base + 0x6BB94);
187
//        emulator.attach().addBreakPoint(module.base + 0xD0734);
188
    }
189

190
    public void traceCode() {
191
        String traceFile = "unidbg-android/src/test/java/com/yinyongbao/traceCode.log";
192
        PrintStream traceStream = null;
193
        try {
194
            traceStream = new PrintStream(new FileOutputStream(traceFile), true);
195
        } catch (FileNotFoundException e) {
196
            throw new RuntimeException(e);
197
        }
198

199
        // 对整个 libqimei.so 做指令级 trace，并重定向到日志文件
200
        emulator.traceCode(module.base, module.base + module.size).setRedirect(traceStream);
201
    }
202

203
    public static void main(String[] args) {
204
        OZ oz = new OZ();
205
        oz.z();
206
    }
207

208
    @Override
209
    public FileResult resolve(Emulator emulator, String pathname, int oflags) {
210
        System.out.println("[IO] 访问路径: " + pathname);
211
        return null;
212
    }
213
}

1
public void hookMemcpy() {
2
  final RegisterContext registerContext = emulator.getContext();
3
  Symbol memcpySymbol = module.findSymbolByName("memcpy");
4
  emulator.attach().addBreakPoint(memcpySymbol.getAddress(), new BreakPointCallback() {
5
    @Override
6
    public boolean onHit(Emulator<?> emulator, long address) {
7
      System.out.print("call memcpy");
8
      UnidbgPointer srcAddress = registerContext.getPointerArg(1);
9
      int length = registerContext.getIntArg(2);
10
      Inspector.inspect(srcAddress.getByteArray(0, length), "source:" + srcAddress);
11
      return true;
12
    }
13
  });
14
}

1
emulator.traceWrite(0x125bd000, 0x125bd000 + 32);

1
emulator.attach().addBreakPoint(module.base+0x2732C);

1
emulator.attach().addBreakPoint(module.base + 0x2732C, new BreakPointCallback() {
2
  @Override
3
  public boolean onHit(Emulator<?> emulator, long address) {
4
    int x15 = emulator.getBackend().reg_read(Arm64Const.UC_ARM64_REG_X15).intValue();
5
    int x16 = emulator.getBackend().reg_read(Arm64Const.UC_ARM64_REG_X16).intValue();
6
    System.out.printf("x15:: 0x%02x,x16:: 0x%02x%n,xor:: 0x%02x%n", x15, x16,x16^x15);
7
    return true;
8
  }
9
});

1
emulator.attach().addBreakPoint(module.base + 0x270A4, new BreakPointCallback() {
2
  @Override
3
  public boolean onHit(Emulator<?> emulator, long address) {
4
    int x12 = emulator.getBackend().reg_read(Arm64Const.UC_ARM64_REG_X12).intValue();
5
    int x14 = emulator.getBackend().reg_read(Arm64Const.UC_ARM64_REG_X14).intValue();
6
    System.out.printf("x12:: 0x%02x,x14:: 0x%02x%n,xor:: 0x%02x%n", x12, x14,x12^x14);
7
    return true;
8
  }
9
});

1
from Crypto.Cipher import AES
2
from Crypto.Util.Padding import pad
3
import base64
4

5
def qimei_encrypt(text, key, iv):
6
    """
7
    AES-128-CBC 加密 + Base64 编码
8
    """
9
    key_bytes = key.encode('utf-8')
10
    iv_bytes = iv.encode('utf-8')
11
    cipher = AES.new(key_bytes, AES.MODE_CBC, iv_bytes)
12
    padded_data = pad(text.encode('utf-8'), AES.block_size)
13
    encrypted_bytes = cipher.encrypt(padded_data)
14
    result = base64.b64encode(encrypted_bytes).decode('utf-8')
15
    return result
16

17
key = "lvcwmSYVr2Axv1gn"
18
iv = "Zs0ntDqG2jyhKN0c"
19
plaintext = "22577096caea2b28"
20

21
final_result = qimei_encrypt(plaintext, key, iv)
22
print(f"明文: {plaintext}")
23
print(f"加密结果: {final_result}")