加密相册管家分析

前期准备

包名com.luyun.secretboxmt先查个壳

使用jshook调用frida的脱壳脚本进行脱壳

这边就可以得到脱下来的dex

接下来打开MT的Activity记录，开始进行分析

去VIP

先找到对应的Activity

然后去查看调用，可以找到一些明显的判断位置

显然只要hook这个方法返回ture即可

使用算法助手进行hook

重新启动app就hook成功了，现在就可以设置伪密码，这里把真实的密码和伪密码都设置一下，看看区别

密码

跟踪查看代码，找到验证密码的方法

密文是加盐的sha1，跟一下盐，可以看到是通过文件读取的

通过aes来解密文件

解密算法是aescbc，密钥是secret_box_encrypt的SHA256值，iv全0

找到文件

用cyber进行解密，得到了密文，伪密文和盐

可以得到salt和目标哈希，这样写一个脚本就可以碰撞了

from hashlib import sha1

def hash_password(password):
    salt = '[-105, -110, 111, 70, -86, 57, 121, -106, -78, 76, 77, 4, 101, -101, -65, 42, 88, -42, -87, -38, 78, -23, -30, 10, -107, -113, 13, 127, -104, -1, 76, -20, 18, 84, -31, 61, 50, 20, -38, -33, -20, 83, 9, -11, 96, 85, -69, 4, 118, 25, -5, 84, 124, 28, -93, 30, -57, 79, 84, -25, 38, -93, 10, 116, -63, 53, -121, -91, -111, -110, -120, 91, -61, -50, 59, -7, -110, -37, 125, 52, -18, 117, 80, -113, 20, 71, -50, 127, 17, -91, -94, -100, 53, -47, -48, 27, -95, -17, 24, -100, -59, -102, -18, 22, 105, -48, 99, -86, 19, -75, 54, -74, -26, -124, -58, -48, -46, -123, 109, -2, -89, 66, -94, 46, -58, -97, 52, -17, -76, -80, 118, -33, 88, 4, -57, 108, -69, 11, -116, 114, -99, 54, 2, -41, 47, -90, -21, 91, -7, 56, 123, -19, 2, -94, -112, 68, 9, -21, -64, -17, -52, 64, 95, 65, -5, 51, -102, -80, -32, -69, -33, -20, -24, 42, 43, 63, -39, 22, -91, -73, 53, -96, 77, 59, 77, 127, -76, -125, 26, 81, -52, -55, 108, 94, 45, -88, 13, 38, 63, 31, -122, 15, 37, -105, -39, 109, -124, -69, -1, -7, 112, -64, 17, 26, 46, 115, 65, 24, 23, -96, 6, 36, -6, 111, -112, -77, -50, -88, 97, 34, -84, 113, 119, -121, -52, -24, 89, 109, -112, -17, -1, -33, -20, 110, 110, 115, -73, 86, -104, -99, -13, -14, 56, -35, -110, -78]'
    _sha1 = sha1((salt+password+salt).encode()).hexdigest()
    return _sha1

target = '562a3c468d4ec614c524540c792f373ea3e738d4'
for i in range(0,9999):
    password = str(i).zfill(4)
    if hash_password(password) == target:
        print(f'密码是：{password}')
# 2580

解密文件

首先找到加密文件位置，能看到后缀名是encrypt

检索一下可以找到相关代码

可以看到只对前1024个字节进行了异或操作

可以得到解密代码

from PIL import Image
from io import BytesIO

enc_path = './e996f9e388e501693d4ca2524c9c1a46.encrypt'
with open(enc_path,'rb') as fr:
    data = fr.read()
    fileData = bytearray(data)
    for i in range(1024):
        fileData[i] = data[i] ^ 18
    # 因为是图片，所以就直接展示了
    Image.open(BytesIO(fileData)).show()