【Android逆向】反调试绕过（nop 绕过）
1. 这是看雪上的一个题目，要求显示出 it is success
https://www.kanxue.com/work-task_read-800648.htm
第三题
2. apk 安装到手机，发现闪退
3. apk拖入到jadx中，观察
public class MainActivity extends AppCompatActivity {
public native String stringFromJNI();
static {
System.loadLibrary("native-lib");
}
/* JADX INFO: Access modifiers changed from: protected */
@Override // androidx.appcompat.app.AppCompatActivity, androidx.fragment.app.FragmentActivity, androidx.activity.ComponentActivity, androidx.core.app.ComponentActivity, android.app.Activity
public void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.activity_main);
TextView tv = (TextView) findViewById(R.id.sample_text);
stringFromJNI();
if (mystr()) {
tv.setText("it is success");
}
}
public boolean mystr() {
return false;
}
}
4. java层平平无奇，看来答案在native层
5. so拖入到IDA中进行分析，导出表中直接就有JNI_OnLoad 和静态注册对应的函数，没有init_array段,那么猜测反调试代码应该在JNI_OnLoad中,查看JNI_OnLoad
jint JNI_OnLoad(JavaVM *vm, void *reserved)
{
__int64 v2; // x0
__int64 v3; // x0
void *arg; // [xsp+18h] [xbp-38h]
__int64 v6; // [xsp+20h] [xbp-30h]
pthread_t newthread; // [xsp+38h] [xbp-18h] BYREF
__int64 v8[2]; // [xsp+40h] [xbp-10h] BYREF
v8[1] = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
sub_109B8(vm, v8, 65540LL);
v2 = sub_10184(); // 这里在检查maps 中的frida agent
v3 = sub_102BC(v2); // 检查是否存在 /data/local/tmp/re.frida.server
sub_10310(v3); // 检查frida监听端口27042
v6 = sub_109F8(v8[0], &unk_36030);
arg = (void *)sub_10A30(v8[0], v6, &unk_3604F, &unk_36055);
pthread_create(&newthread, 0LL, (void *(*)(void *))sub_10448, arg);
return 65540;
}
查看sub_10184,可以看到在检查内存中是否存在frida字符串，frdia工作时会把frida_agent加载进进程，会有一些特征字符串，这里就在搞这个事情
__int64 sub_10184()
{
__int64 result; // x0
FILE *v1; // [xsp+10h] [xbp-470h]
char v2[1024]; // [xsp+68h] [xbp-418h] BYREF
__int64 v3; // [xsp+468h] [xbp-18h]
v3 = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
v1 = fopen("/proc/self/maps", "r");
while ( 1 )
{
result = __fgets_chk(v2, 1024LL, v1, 1024LL);
if ( !result )
break;
if ( strstr(v2, "frida") )
*(int *)((char *)&dword_0 + 1) = 45465456;
}
_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2));
return result;
}
查看sub_102BC,这里再检查/data/local/tmp/re.frida.server 目录是否存在，frida_server启动会默认创建这个目录
__int64 sub_102BC()
{
__int64 result; // x0
result = access("/data/local/tmp/re.frida.server", 0);
if ( (int)result >= 0 )
*(int *)((char *)&dword_0 + 1) = 45465456;
return result;
}
查看sub_10310,这里再查看是否有再监听0x69A2（27042）frida的默认端口
// write access to const memory has been detected, the output may be wrong!
__int64 sub_10310()
{
__int64 result; // x0
FILE *v1; // [xsp+10h] [xbp-470h]
char v2[1024]; // [xsp+68h] [xbp-418h] BYREF
__int64 v3; // [xsp+468h] [xbp-18h]
v3 = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
v1 = fopen("/proc/net/tcp", "r");
while ( 1 )
{
result = __fgets_chk(v2, 1024LL, v1, 1024LL);
if ( !result )
break;
if ( strstr(v2, ":69A2") )
*(int *)((char *)&dword_0 + 1) = 45465456;
}
_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2));
return result;
}
然后创建了一个线程去执行sub_10448，查看一下,这里时检查，这里时对入参进行检查，查询JAVA层的方法是否有native话，特征就是（~*(_DWORD *)(a1 + 4) & 0x80000) == 0），推测是检查是否有hook java层的方法，有的话就干掉进程
void __fastcall __noreturn sub_10448(__int64 a1)
{
while ( 1 )
{
while ( (~*(_DWORD *)(a1 + 4) & 0x80000) == 0 )
;
*(int *)((char *)&dword_0 + 1) = 45465456;
}
}
3. 再看Java_com_r0ysue_test1_MainActivity_stringFromJNI
__int64 __fastcall Java_com_r0ysue_test1_MainActivity_stringFromJNI(JNIEnv *env)
{
__int64 v2; // [xsp+0h] [xbp-560h]
__int64 v3; // [xsp+8h] [xbp-558h]
const char *v4; // [xsp+28h] [xbp-538h]
const char *v5; // [xsp+40h] [xbp-520h]
const char *nptr; // [xsp+58h] [xbp-508h]
FILE *v7; // [xsp+98h] [xbp-4C8h]
int v8; // [xsp+A4h] [xbp-4BCh]
unsigned __int64 v9; // [xsp+B0h] [xbp-4B0h]
unsigned int pthread_create_sym; // [xsp+CCh] [xbp-494h]
char v12[24]; // [xsp+130h] [xbp-430h] BYREF
char v13[1024]; // [xsp+148h] [xbp-418h] BYREF
__int64 v14; // [xsp+548h] [xbp-18h]
v14 = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
sub_FFF4(v12, "Hello from C++");
pthread_create_sym = sub_F690("/system/lib64/libc.so", "pthread_create");
__android_log_print(6, "r0ysue", "%x", pthread_create_sym);
v8 = 1;
v7 = fopen("/proc/self/maps", "r");
while ( __fgets_chk(v13, 1024LL, v7, 1024LL) )
{
if ( strstr(v13, "libc.so") )
{
if ( v8 == 2 )
{
nptr = strtok(v13, "-");
v9 = strtoul(nptr, 0LL, 16);
v5 = strtok(0LL, " ");
strtoul(v5, 0LL, 16);
}
else
{
strtok(v13, "-");
v4 = strtok(0LL, " ");
strtoul(v4, 0LL, 16);
}
++v8;
}
}
sub_1004C(pthread_create_sym, v9);
v3 = sub_100EC(v12);
v2 = sub_100B4(env, v3);
sub_10110(v12);
_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2));
return v2;
}
重点是sub_1004C,其中0xD61F020058000050LL 是一段frida hook native的特征码，这里应该是在检查是否有hook pthread_create 函数
const char *__fastcall sub_1004C(int a1, __int64 a2)
{
if ( *(_QWORD *)(a2 + a1) == 0xD61F020058000050LL )
*(int *)((char *)&dword_0 + 1) = 45465456;
return "Hello from C++";
}
inlinehook 检查内容参考博客
https://www.52pojie.cn/thread-1530251-1-1.html
由此可编写frida脚本
function hook_dlopen(soName) {
Interceptor.attach(Module.findExportByName(null, "dlopen"),
{
onEnter: function (args) {
var pathptr = args[0];
if (pathptr !== undefined && pathptr != null) {
var path = ptr(pathptr).readCString();
if (path.indexOf(soName) >= 0) {
this.is_can_hook = true;
}
}
},
onLeave: function (retval) {
if (this.is_can_hook) {
console.log("hook start...");
hook_func()
}
}
}
);
Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
{
onEnter: function (args) {
var pathptr = args[0];
if (pathptr !== undefined && pathptr != null) {
var path = ptr(pathptr).readCString();
if (path.indexOf(soName) >= 0) {
this.is_can_hook = true;
}
}
},
onLeave: function (retval) {
if (this.is_can_hook) {
console.log("hook start...");
hook_func()
}
}
}
);
}
function hook_func() {
//把启动线程检查的地方nop掉
var lib_handler = Process.findModuleByName("libnative-lib.so")
//0x10984 pthread create 那一行
var dst_addr = new NativePointer(lib_handler.base.add(0x10984))
Memory.patchCode(dst_addr, 4, function (code) {
var cw = new Arm64Writer(code, { pc: dst_addr });
cw.putNop()
cw.flush();
});
var strStr = Module.findExportByName("libc.so", "strstr");
console.log("[*] strstr addr: " + strStr);
if (strStr) {
Interceptor.attach(strStr, {
onEnter: function(args) {
//console.log("[*] strstr hooked")
var arg0= ptr(args[0]).readCString();
var arg1= ptr(args[1]).readCString();
if(arg1.indexOf(":69A2")>=0){
console.log("[*]onEnter strstr hooked "+arg0+","+arg1+")");
this.flag_69A2=true
}
if(arg1.indexOf("frida")>=0){
console.log("[*]onEnter strstr hooked "+arg0+","+arg1+")");
this.flag_frida=true
}
},
onLeave: function(retval) {
if(this.flag_69A2){
console.log("[*]onLeave flag_69A2 hooked "+retval);
retval.replace(0x0);
this.flag_69A2 = false
}
if(this.flag_frida){
console.log("[*]onLeave flag_frida hooked "+retval);
retval.replace(0x0);
this.flag_frida = false
}
}
});
}
var access = Module.findExportByName("libc.so", "access");
console.log("[*] access addr: " + access);
if (access) {
Interceptor.attach(access, {
onEnter: function(args) {
//console.log("[*] access hooked")
var arg0= ptr(args[0]).readCString();
var arg1= args[1];
if(arg0.indexOf("re.frida.server")>=0){
console.log("[*]onEnter re.frida.server hooked"+arg0+","+arg1+")");
this.flag_reFrida=true
}
},
onLeave: function(retval) {
if(this.flag_reFrida){
console.log("[*]onLeave re.frida.server access hooked"+retval);
retval.replace(-1);
this.flag_reFrida = false
}
}
});
}
}
function main() {
hook_dlopen("libnative-lib.so")
Java.perform(function () {
var cls = Java.use("com.r0ysue.test1.MainActivity")
cls.mystr.implementation = function () {
console.log("call MainActivity mystr")
return true
}
})
}
// 不能延时启动，否则线程已经起来了
setImmediate(main)
frida -U -f com.r0ysue.test1 -l lesson12.js --no-pause
日志
......
[*]onEnter strstr hooked 6: 0F01A8C0:BD0B 2B1D467C:1B5C 01 00000000:00000000 00:00000000 00000000 10112 0 2123256 1 0000000000000000 24 4 30 10 -1
,:69A2)
[*]onLeave flag_69A2 hooked 0x0
[*]onEnter strstr hooked 7: 0100007F:B167 0100007F:69A2 01 00000000:00000000 00:00000000 00000000 2000 0 2125983 1 0000000000000000 21 4 30 10 16
,:69A2)
[*]onLeave flag_69A2 hooked 0x7fca407404
[*]onEnter strstr hooked 8: 0100007F:C105 0100007F:69A2 06 00000000:00000000 03:000013C9 00000000 0 0 0 3 0000000000000000
,:69A2)
[*]onLeave flag_69A2 hooked 0x7fca407404
[*]onEnter strstr hooked 9: 0100007F:69A2 0100007F:B167 01 00000000:00000000 00:00000000 00000000 0 0 2124098 1 0000000000000000 21 4 31 10 16
,:69A2)
[*]onLeave flag_69A2 hooked 0x7fca4073f6
[*]onEnter strstr hooked 10: 0100007F:A63D 0100007F:9933 01 00000000:000004A0 00:00000000 00000000 2000 0 2123640 2 0000000000000000 21 4 0 10 16
,:69A2)
[*]onLeave flag_69A2 hooked 0x0
脚本原理
- hook strstr 方法，对传入的字符串进行检查，凡是和frida相关的都重置返回值绕过
- hook access ，不检查目的目录
- 把启动线程检查的地方nop掉
- hook java层方法
