libkwsgmain.so花指令分析

10.5.40.26392 去花

直接查看jni_onload，反汇编都不行

.text:00053744 03 B5                       PUSH            {R0,R1,LR}
.text:00053746 01 48                       LDR             R0, =6
.text:00053748 00 F0 04 F8                 BL              loc_53754

到这儿一直正常,ida在进行反汇编的时候依然能正常的识别出来二进制代码所走的流程,当走到下方的代码的时候ida这时反汇编不正常

.text:00053754 B9 F7 A4 EB                 BLX             sub_CEA0
.text:00053758 AC 01                       LSLS            R4, R5, #6
.text:0005375A 00 00                       MOVS            R0, R0
.text:0005375C C4 01                       LSLS            R4, R0, #7
.text:0005375E 00 00                       MOVS            R0, R0
.text:00053760 DC 01                       LSLS            R4, R3, #7
.text:00053762 00 00                       MOVS            R0, R0

那么我们看下sub_CEA0做了什么

.text:0000CEA0             sub_CEA0                                ; CODE XREF: .text:loc_7918↑p
.text:0000CEA0                                                     ; .text:loc_A8C0↑p ...
.text:0000CEA0
.text:0000CEA0             arg_8           =  8
.text:0000CEA0
.text:0000CEA0             ; __unwind {
.text:0000CEA0 01 10 CE E3                 BIC             R1, LR, #1
.text:0000CEA4 00 11 91 E7                 LDR             R1, [R1,R0,LSL#2]
.text:0000CEA8 0E 10 81 E0                 ADD             R1, R1, LR
.text:0000CEAC 08 E0 9D E5                 LDR             LR, [SP,#arg_8]
.text:0000CEB0 08 10 8D E5                 STR             R1, [SP,#arg_8]
.text:0000CEB4 03 80 BD E8                 POP             {R0,R1,PC}

BIC R1, LR, #1；R1 = LR and not #1
;把下一条指令的最低位,置为0,现在也就是说R1的值就是执行完CEA0函数后执行的地址值

LDR R1, [R1,R0,LSL#2]；R1 = R1+R04
；RO在上方赋值过了,R1又增加了0x104

ADD R1, R1, LR
;可以翻译为R1 = LR + LR(最低位置为0)+ R0*4

LDR LR, [SP,#arg_8]
;先从堆栈中保存LR寄存器的值

STR R1, [SP,#arg_8]
;然后用算出的R1覆盖掉堆栈的LR

POP {R0,R1,PC}
;恢复堆栈，但是现在PC已经被刚才计算出的R1覆盖了，下一条被执行的指令将要跳转到一个更远的地方

对上面代码的综上叙述，也就是根据在跳出CEA0这个函数的时候会根据R0的值,和LR的值,根据码表计算后赋值给PC寄存器从而跳转到一个地址,但是ida线性反汇编算不出来这个要跳转的地址。

使用脚本去花

import idc
from ida_bytes import patch_word

def put_unconditional_branch(source, destination):
   offset = (destination - source - 4) >> 1
   if offset > 2097151 or offset < -2097152:
       raise RuntimeError("Invalid offset")
   if offset > 1023 or offset < -1024:
       instruction1 = 0xf000 | ((offset >> 11) & 0x7ff)
       instruction2 = 0xb800 | (offset & 0x7ff)
       patch_word(source, instruction1)
       patch_word(source + 2, instruction2)
       patch_word(source + 4, 0xbf00)
       patch_word(source + 6, 0xbf00)
   else:
       instruction = 0xe000 | (offset & 0x7ff)
       patch_word(source, instruction)
       patch_word(source + 2, 0xbf00)
       patch_word(source + 4, 0xbf00)

def patch(ea):
   if idc.get_wide_word(ea) == 0xb503: # PUSH {R0,R1,LR}
       ea1 = ea + 2
       if idc.get_wide_word(ea) == 0xbf00:  # NOP
           ea1 += 2
       # ⽬的寄存器是通⽤寄存器 and ⽬的寄存器是r0 and 源寄存器是⽴即数
       if idc.get_operand_type(ea1, 0) == 1 and idc.get_operand_value(ea1, 0) == 0 and idc.get_operand_type(ea1,1) == 2:
           # get_operand_type 获取寄存器的类型
           index = idc.get_wide_dword(idc.get_operand_value(ea1, 1))
           print("index =", hex(index))
           ea1 += 2
           table = None
           # get_operand_type获取操作数的值
           # https://www.hex-rays.com/products/ida/support/idadoc/276.shtml
           if idc.get_operand_type(ea1, 0) == 7:
               print(222)
               # BL              loc_53754
               # 获取tabel表
               table = idc.get_operand_value(ea1, 0) + 4
           # elif idc.get_operand_type(ea1, 1) == 2:
           #     table = idc.get_operand_value(ea1, 1) + 4
           if table is None:
               print("Unable to find table")
           else:
               print("table =", hex(table))
               offset = idc.get_wide_dword(table + (index << 2))
               print("offset =", hex(offset))
               put_unconditional_branch(ea, table + offset)
               # 0x2f150`

def getAddrRange():
   start = ida_ida.inf_get_min_ea()
   size = ida_ida.inf_get_max_ea() - start
   # 将地址范围限定于text节
   for seg in idautils.Segments():
       seg = idaapi.getseg(seg)
       segName = ida_segment.get_segm_name(seg)
       if segName == ".text":
           start = seg.start_ea
           size = seg.size()
   return start, size

if __name__ == '__main__':
   # so中.text段的起始与结束位置
   start, size = getAddrRange()
   print("start: ", hex(start))
   print("size: ", hex(size))
   print("end: " ,hex(start + size))

   for i in range(0x7698, 0x662dc):
        patch(i)  
   print("finish")