1
// attributes: thunk
2
__int64 SSL_CTX_set_custom_verify()
3
{
4
  return __imp_SSL_CTX_set_custom_verify();
5
}

1
void SSL_CTX_set_custom_verify(
2
    SSL_CTX *ctx,
3
    int mode,
4
    enum ssl_verify_result_t (*callback)(SSL *ssl, uint8_t *out_alert)
5
);

1
SSL_VERIFY_NONE                 // 0x00
2
SSL_VERIFY_PEER                 // 0x01
3
SSL_VERIFY_FAIL_IF_NO_PEER_CERT // 0x02
4
SSL_VERIFY_PEER_IF_NO_OBC       // 0x04
5
SSL_VERIFY_CLIENT_ONCE          // 0x08

1
function hook_dlopen(module_name, fun) {
2
    var android_dlopen_ext = Module.findExportByName(null, "android_dlopen_ext");
3
    if (android_dlopen_ext) {
4
        Interceptor.attach(android_dlopen_ext, {
5
            onEnter: function (args) {
6
                var pathptr = args[0];
7
                if (pathptr) {
8
                    this.path = (pathptr).readCString();
9
                    if (this.path.indexOf(module_name) >= 0) {
10
                        this.canhook = true;
11
                    }
12
                }
13
            },
14
            onLeave: function (retval) {
15
                if (this.canhook) {
16
                    let verifyadd = Module.getExportByName("libsscronet.so","SSL_CTX_set_custom_verify");
17
                    Interceptor.attach(verifyadd,{
18
                        onEnter(args){
19
                            Interceptor.attach(args[2],{
20
                                onLeave(retval){
21
                                    console.log("Hook成功！强制verify返回 0x0");
22
                                    retval.replace(0x0);
23
                                }
24
                            })
25
                        }
26
                    })
27
                }
28
            }
29
        });
30
    }
31
}
32

33
hook_dlopen("libsscronet.so");

1
const soName = "libsscronet.so";
2
const base = Module.findBaseAddress(soName);
3

4
if (base === null) {
5
    console.log("[-] module not found");
6
} else {
7
    const idaBase = 0x0;
8
    const funcOffset = 0x37ED64;
9
    const target = base.add(funcOffset - idaBase);
10
    Interceptor.attach(target, {
11
        onEnter(args) {
12
            var key = args[1].readPointer().readCString();
13
            var value = args[2].readPointer().readCString();
14

15
            // console.log("\n==== sub_37ED64 called ====");
16
            // console.log("key = " + key);
17
            // console.log("value = " + value);
18
            if(key == "X-Gorgon"){
19
                console.log("X-Gorgon堆栈信息如下")
20
                console.log(key,'==>',value);
21
                console.log('SetHeaders called from:\n' + Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n') + '\n');
22
            }
23

24
        },
25

26
        onLeave(retval) {
27
            // console.log("ret = " + retval);
28
        }
29
    });
30
}

1
const base = Module.findBaseAddress("libmetasec_ml.so");
2
var func_addr = base.add(0x2A6E38);
3
console.log("baseAddr from hook", base);
4
Interceptor.attach(func_addr, {
5
    onEnter: function (args) {
6
        console.log("=============入参开始==================")
7
        var arg0 = args[0].readUtf8String();
8
        var arg1 = args[1].readUtf8String();
9
        console.log("参数1" + arg0);
10
        console.log("参数2" + arg1);
11
    },
12
    onLeave: function (retval) {
13
        console.log("返回值地址:: " + retval);
14
        console.log("返回值:: " + retval.readUtf8String());
15
        console.log("=============返回值结束==================")
16
    }
17
});

1
package com.douyin;
2

3
import com.github.unidbg.AndroidEmulator;
4
import com.github.unidbg.Emulator;
5
import com.github.unidbg.Module;
6
import com.github.unidbg.arm.backend.Unicorn2Factory;
7
import com.github.unidbg.file.FileResult;
8
import com.github.unidbg.file.IOResolver;
9
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
10
import com.github.unidbg.linux.android.AndroidResolver;
11
import com.github.unidbg.linux.android.dvm.AbstractJni;
12
import com.github.unidbg.linux.android.dvm.BaseVM;
13
import com.github.unidbg.linux.android.dvm.DalvikModule;
14
import com.github.unidbg.linux.android.dvm.DvmClass;
15
import com.github.unidbg.linux.android.dvm.VaList;
16
import com.github.unidbg.linux.android.dvm.VM;
17
import com.github.unidbg.memory.Memory;
18
import com.github.unidbg.hook.hookzz.HookZz;
19
import com.github.unidbg.hook.hookzz.IHookZz;
20
import com.github.unidbg.hook.hookzz.HookEntryInfo;
21
import com.github.unidbg.arm.context.RegisterContext;
22
import com.github.unidbg.virtualmodule.android.AndroidModule;
23

24
import java.io.File;
25

26
public class DouYin extends AbstractJni implements IOResolver {
27

28
    // ========== 每次新项目只改这里 ==========
29

30
    // 模拟器位数：so在armeabi-v7a目录下填false，arm64-v8a目录下填true
31
    private static final boolean IS_64BIT         = true;
32

33
    // app包名（随意，一般填真实包名）
34
    private static final String  PROCESS_NAME     = "com.ss.android.ugc.aweme";
35

36
    // apk路径，不需要apk时填null（填null时LOAD_BY_NAME必须为false）
37
    private static final String  APK_PATH         = "apks/douyin/douyin.apk";
38

39
    // so加载方式：
40
    //   false = 传文件路径（用SO_PATH），不依赖apk，最常用
41
    //   true  = 传库名（用SO_NAME），unidbg自动去apk内查找，必须提供APK_PATH
42
    private static final boolean LOAD_BY_NAME     = true;
43
    private static final String  SO_PATH          = ""; // LOAD_BY_NAME=false时生效
44
    private static final String  SO_NAME          = "metasec_ml";                // LOAD_BY_NAME=true时生效，不带lib前缀和.so后缀
45

46

47
    // 是否打印JNI调用细节，调试时改true
48
    private static final boolean VERBOSE          = true;
49

50

51
    // ========================================
52

53
    public static AndroidEmulator emulator;
54
    public static Memory memory;
55
    public static VM vm;
56
    public static Module module;
57

58
    // 1. 构造方法 —— 初始化模拟器
59
    public DouYin() {
60

61
        // 1. 创建模拟器（32/64位由IS_64BIT控制）
62
        emulator = IS_64BIT
63
                ? AndroidEmulatorBuilder.for64Bit().setProcessName(PROCESS_NAME).addBackendFactory(new Unicorn2Factory(true)).build()
64
                : AndroidEmulatorBuilder.for32Bit().setProcessName(PROCESS_NAME).addBackendFactory(new Unicorn2Factory(true)).build();
65

66
        // 2. 获取内存对象
67
        memory = emulator.getMemory();
68

69
        // 3. 设置安卓SDK版本（只支持19、23）
70
        memory.setLibraryResolver(new AndroidResolver(23));
71

72
        // 4. 创建虚拟机
73
        vm = APK_PATH != null
74
                ? emulator.createDalvikVM(new File(APK_PATH))
75
                : emulator.createDalvikVM();
76
        vm.setJni(this);
77
        vm.setVerbose(VERBOSE);
78

79
        // 5. 加载so文件（两种方式由LOAD_BY_NAME控制）
80
        DalvikModule dm = LOAD_BY_NAME
81
                ? vm.loadLibrary(SO_NAME, false)
82
                : vm.loadLibrary(new File(SO_PATH), false);
83

84
        // 6. 动态注册才需要执行JNI_OnLoad
85
        dm.callJNI_OnLoad(emulator);
86

87
        // 7. 获取module对象（后续拿基址、偏移等）
88
        module = dm.getModule();
89

90
    }
91

92

93

94

95

96
    // 5. main方法 —— 右键直接运行
97
    public static void main(String[] args) {
98
        DouYin douYin = new DouYin();
99
    }
100

101
    @Override
102
    public FileResult resolve(Emulator emulator, String pathname, int oflags) {
103
        System.out.println("pathname:" + pathname);
104
        return null;
105
    }
106
}

1
new AndroidModule(emulator,vm).register(memory);

1
MS = vm.resolveClass("com.bytedance.mobsec.metasec.ml.MS",vm.resolveClass("ms.bd.c.i2",vm.resolveClass("ms.bd.c.y2")));

1
@Override
2
public DvmObject<?> callStaticObjectMethodV(BaseVM vm, DvmClass dvmClass, String signature, VaList vaList) {
3
  switch(signature){
4
    case "com/bytedance/mobsec/metasec/ml/MS->b(IIJLjava/lang/String;Ljava/lang/Object;)Ljava/lang/Object;":{
5
      int arg = vaList.getIntArg(0);
6
      System.out.println("参数==>"+arg);
7
    }
8
  }
9
  return super.callStaticObjectMethodV(vm, dvmClass, signature, vaList);
10
}

1
@Override
2
public long callLongMethodV(BaseVM vm, DvmObject<?> dvmObject, String signature, VaList vaList) {
3
  switch (signature){
4
    case "java/lang/Long->longValue()J":{
5
      return (Long)dvmObject.getValue();
6
    }
7
  }
8
  return super.callLongMethodV(vm, dvmObject, signature, vaList);
9
}

1
public void metaSec() throws IOException {
2
        byte[] urlBytes = Files.readAllBytes(Paths.get("apks/douyin/url.txt"));
3
        byte[] headerBytes = Files.readAllBytes(Paths.get("apks/douyin/headers.txt"));
4

5
        MemoryBlock urlBlock = memory.malloc(urlBytes.length + 1, true);
6
        UnidbgPointer urlPtr = urlBlock.getPointer();
7
        urlPtr.write(0, urlBytes, 0, urlBytes.length);
8

9
        MemoryBlock headerBlock = memory.malloc(headerBytes.length + 1, true);
10
        UnidbgPointer headerPtr = headerBlock.getPointer();
11
        headerPtr.write(0, headerBytes, 0, headerBytes.length);
12

13
        Number result = module.callFunction(emulator, 0x2A6E38, urlPtr, headerPtr);
14

15
        UnidbgPointer resultPtr = memory.pointer(result.longValue());
16
        System.out.println(resultPtr.getString(0));
17

18
    }

1
@Override
2
public DvmObject<?> callObjectMethodV(BaseVM vm, DvmObject<?> dvmObject, String signature, VaList vaList) {
3
  switch (signature) {
4
    case "java/lang/Integer->getBytes(Ljava/lang/String;)[B": {
5
      String str = dvmObject.getValue().toString();
6
      String charset = vaList.getObjectArg(0).getValue().toString();
7
      System.out.println("getBytes str=" + str + " charset=" + charset);
8
      try {
9
        return new ByteArray(vm, str.getBytes(charset));
10
      } catch (Exception e) {
11
        return new ByteArray(vm, str.getBytes());
12
      }
13
    }
14
  }
15
  return super.callObjectMethodV(vm, dvmObject, signature, vaList);
16
}

1
java.lang.UnsupportedOperationException: java/lang/Thread->getStackTrace()[Ljava/lang/StackTraceElement;
2
  at com.github.unidbg.linux.android.dvm.AbstractJni.callObjectMethodV(AbstractJni.java:417)
3
  at com.douyin.DouYin.callObjectMethodV(DouYin.java:161)
4
  at com.github.unidbg.linux.android.dvm.AbstractJni.callObjectMethodV(AbstractJni.java:262)
5
  at com.github.unidbg.linux.android.dvm.DvmMethod.callObjectMethodV(DvmMethod.java:89)
6
  at com.github.unidbg.linux.android.dvm.DalvikVM64$32.handle(DalvikVM64.java:559)

1
case "java/lang/Thread->getStackTrace()[Ljava/lang/StackTraceElement;":{
2
  StackTraceElement[] elements = Thread.currentThread().getStackTrace();
3
  DvmObject[] objs = new DvmObject[elements.length];
4
  for (int i = 0; i < elements.length; i++) {
5
    objs[i] = vm.resolveClass("java/lang/StackTraceElement").newObject(elements[i]);
6
  }
7
  return new ArrayObject(objs);
8
}

1
case "java/lang/StackTraceElement->getClassName()Ljava/lang/String;":{
2
  StackTraceElement stackTraceElement = (StackTraceElement)dvmObject.getValue();
3
  return new StringObject(vm,stackTraceElement.getClassName());
4
}

1
case "java/lang/StackTraceElement->getMethodName()Ljava/lang/String;":{
2
  StackTraceElement stackTraceElement = (StackTraceElement)dvmObject.getValue();
3
  return new StringObject(vm,stackTraceElement.getMethodName());
4
}

1
case "java/lang/Thread->getBytes(Ljava/lang/String;)[B":{
2
   String arg = vaList.getObjectArg(0).getValue().toString();
3
   return new ByteArray(vm,arg.getBytes(StandardCharsets.UTF_8));
4
}