攻防世界 reverse pingpong

pingpong  XCTF 3rd-BCTF-2017

 java层代码很简单：

package com.geekerchina.pingpongmachine;

import android.os.Bundle;
import android.support.v7.app.AppCompatActivity;
import android.view.Menu;
import android.view.MenuItem;
import android.view.View$OnClickListener;
import android.view.View;
import android.widget.TextView;

public class MainActivity extends AppCompatActivity {
    class com.geekerchina.pingpongmachine.MainActivity$1 implements View$OnClickListener {
        com.geekerchina.pingpongmachine.MainActivity$1(MainActivity arg1) {
            MainActivity.this = arg1;
            super();
        }

        public void onClick(View arg7) {
            if(MainActivity.this.tt % 2 == 1) {
                MainActivity.this.p = 0;
                MainActivity.this.num = 0;
                MainActivity.this.tt = MainActivity.this.ttt;
            }

            --MainActivity.this.tt;
            MainActivity.this.p = MainActivity.this.ping(MainActivity.this.p, MainActivity.this.num);
            ++MainActivity.this.num;
            if(MainActivity.this.num >= 7) {
                MainActivity.this.num = 0;
            }

            View v0 = MainActivity.this.findViewById(0x7F0B0056);
            ((TextView)v0).setText("PING");
            if(MainActivity.this.tt == 0) {
                ((TextView)v0).setText("FLAG: BCTF{MagicNum" + Integer.toString(MainActivity.this.p) + "}");
            }
        }
    }

    class com.geekerchina.pingpongmachine.MainActivity$2 implements View$OnClickListener {
        com.geekerchina.pingpongmachine.MainActivity$2(MainActivity arg1) {
            MainActivity.this = arg1;
            super();
        }

        public void onClick(View arg7) {
            if(MainActivity.this.tt % 2 == 0) {
                MainActivity.this.p = 0;
                MainActivity.this.num = 0;
                MainActivity.this.tt = MainActivity.this.ttt;
            }

            --MainActivity.this.tt;
            MainActivity.this.p = MainActivity.this.pong(MainActivity.this.p, MainActivity.this.num);
            ++MainActivity.this.num;
            if(MainActivity.this.num >= 7) {
                MainActivity.this.num = 0;
            }

            View v0 = MainActivity.this.findViewById(0x7F0B0056);
            ((TextView)v0).setText("PONG");
            if(MainActivity.this.tt == 0) {
                ((TextView)v0).setText("FLAG: BCTF{MagicNum" + Integer.toString(MainActivity.this.p) + "}");
            }
        }
    }

    View$OnClickListener jping;
    View$OnClickListener jpong;
    public int num;
    public int p;
    public int tt;
    public int ttt;

    static {
        System.loadLibrary("pp");
    }

    public MainActivity() {
        super();
        this.p = 0;
        this.num = 0;
        this.ttt = 1000000;
        this.tt = this.ttt;
        this.jping = new com.geekerchina.pingpongmachine.MainActivity$1(this);
        this.jpong = new com.geekerchina.pingpongmachine.MainActivity$2(this);
    }

    protected void onCreate(Bundle arg4) {
        super.onCreate(arg4);
        this.setContentView(0x7F04001B);
        this.findViewById(0x7F0B0057).setOnClickListener(this.jping);
        this.findViewById(0x7F0B0058).setOnClickListener(this.jpong);
    }

    public boolean onCreateOptionsMenu(Menu arg3) {
        this.getMenuInflater().inflate(0x7F0D0000, arg3);
        return 1;
    }

    public boolean onOptionsItemSelected(MenuItem arg3) {
        boolean v1 = arg3.getItemId() == 0x7F0B0070 ? true : super.onOptionsItemSelected(arg3);
        return v1;
    }

    public native int ping(int arg1, int arg2) {
    }

    public native int pong(int arg1, int arg2) {
    }
}

有两个按钮，分别调用natice层 ping方法、pong方法

先随便点一个，然后先ping 后pong，总共点击1000000次后输出flag

libpp.so 中的方法ping、pong中都有调用sleep(1) ，我们需要修改so文件，将其参数设为0

 

 网上的一些wp都是新建个工程，然后调用so中方法。

那我们直接使用frida调用不就好了。

frida脚本：

import frida, sys


def on_message(message, data):
    if message['type'] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

jscode = """
setImmediate(function () {
    Java.perform(function () {
        console.log("start");
        //so层hook
        //导出函数
        //var exports = Module.enumerateExportsSync("libpp.so");
        //for(var i=0;i<exports.length;i++){
        //    send("name:"+exports[i].name+"  address:"+exports[i].address);
        // }

        //遍历模块找基址
        Process.enumerateModules({
            onMatch: function (exp) {
                if (exp.name == 'libpp.so') {
                    send('enumerateModules find');
                    send(exp.name + "|" + exp.base + "|" + exp.size + "|" + exp.path);
                    send(exp);
                    return 'stop';
                }
            },
            onComplete: function () {
                send('enumerateModules stop');
            }
        });

        //通过模块名直接查找基址
        var soAddr = Module.findBaseAddress("libpp.so");
        send("soAddr:" + soAddr);

        var aping=0x1308+1
        var apong=0x1564+1
        //   hook导出函数 通过函数名

        var fping=Module.findExportByName("libpp.so", "Java_com_geekerchina_pingpongmachine_MainActivity_ping")
        send("findExportByName ping():" +fping );
        fping=new NativePointer(soAddr).add(aping);
        //NativePointer   简写ptr
        send("findExportByName ping():" +fping );
        var ping=new NativeFunction(fping, "int", ['pointer','pointer','int', 'int']);


        //send("findExportByName edit():"+Module.findExportByName("libpp.so", "_ZL4editP7_JNIEnvP8_jobjecti"))
        // Interceptor.attach(fping, {
        //     onEnter: function (args) {
        //         send("ping() began p:" + args[2] + ", num:" + args[3] );
        //     },
        //     onLeave: function (retval) {
        //         send("ping() return:" + retval);
        //     }
        // });

        //   hook导出函数 通过函数名
        var fpong=Module.findExportByName("libpp.so", "Java_com_geekerchina_pingpongmachine_MainActivity_pong")
        send("findExportByName pong():" +fpong );
        fpong=new NativePointer(soAddr).add(apong);
        send("findExportByName pong():" +fpong );
        var pong=new NativeFunction(fpong, "int", ['pointer','pointer','int', 'int']);
        //send("findExportByName edit():"+Module.findExportByName("libpp.so", "_ZL4editP7_JNIEnvP8_jobjecti"))
        // Interceptor.attach(fpong, {
        //     onEnter: function (args) {
        //         send("pong() began p:" + args[2] + ", num:" + args[3] );
        //     },
        //     onLeave: function (retval) {
        //         send("pong() return:" + retval);
        //     }
        // });
        var env = Java.vm.getEnv();
        var obj=ptr(0);
        var check = 1000000;
        var beFlag = 0;
        var num = 0;
        while (true) {               //下面这部分代码参考 https://blog.csdn.net/jasalee/article/details/70242837
            if (check % 2 == 1) {
                --check;
                beFlag = pong(env,obj,beFlag,num);
                ++num;
                if(num >= 7) {
                    num = 0;
                }
            } else {
                --check;
                beFlag = ping(env,obj,beFlag,num);
                ++num;
                if(num >= 7){
                    num = 0;
                }
            }
            if (check == 0) {
                send("check:"+check+" num:"+num)
                send("FLAG : "+"BCTF{MagicNum" + beFlag+ "}");
                break;
            }
        }
        
    });
});
"""


# 运行中hook
process = frida.get_usb_device().attach('com.geekerchina.pingpongmachine')
script = process.create_script(jscode)
script.on('message', on_message)
print('[*] Running test')
script.load()
sys.stdin.read()


'''
[*] Running test
start
[*] enumerateModules find
[*] libpp.so|0xd4c48000|24576|/data/app/com.geekerchina.pingpongmachine-6gshbHpfeBmTBFRYBxQpNg==/lib/arm/libpp.so
[*] {'name': 'libpp.so', 'base': '0xd4c48000', 'size': 24576, 'path': '/data/app/com.geekerchina.pingpongmachine-6gshbHpfeBmTBFRYBxQpNg==/lib/arm/libpp.so'}
[*] enumerateModules stop
[*] soAddr:0xd4c48000
[*] findExportByName ping():0xd34c9309
[*] findExportByName ping():0xd4c49309
[*] findExportByName pong():0xd34c9565
[*] findExportByName pong():0xd4c49565
[*] check:0 num:1
[*] FLAG : BCTF{MagicNum4500009}
'''

 大约要跑4、5分钟的样子，没去分析ping、pong方法，大佬们可以分析一波 0.0

BCTF{MagicNum4500009}

脚本编写中也发现了一个问题：

　　Module.findExportByName 得到的地址不正确。

应该使用 基地址+函数偏移地址（thumb指令下偏移地址+1）