【Android逆向】脱壳项目 frida-dexdump 原理分析

1. 项目代码地址

https://github.com/hluwa/frida-dexdump

2. 核心逻辑为

def dump(self):
        logger.info("[+] Searching...")
        st = time.time()
        ranges = self.agent.search_dex(enable_deep_search=self.enable_deep)
        et = time.time()
        logger.info("[*] Successful found {} dex, used {} time.".format(len(ranges), int(et - st)))
        logger.info("[+] Starting dump to '{}'...".format(self.output))
        idx = 1
        for dex in ranges:
            try:
                bs = self.agent.memory_dump(dex['addr'], dex['size'])
                md = md5(bs)
                if md in self.mds:
                    continue
                self.mds.add(md)
                bs = fix_header(bs)
                out_path = os.path.join(self.output, "classes{}.dex".format('%d' % idx if idx != 1 else ''))
                with open(out_path, 'wb') as out:
                    out.write(bs)
                logger.info("[+] DexMd5={}, SavePath={}, DexSize={}"
                            .format(md, out_path, hex(dex['size'])))
                idx += 1
            except Exception as e:
                logger.exception("[-] {}: {}".format(e, dex))
        logger.info("[*] All done...")

这里面有三个比较核心的方法 1 self.agent.search_dex 2 self.agent.memory_dump 3 fix_header, 分别对应着在内存中寻找dex，然后dump下来 ，最后修后dex的header

3. search_dex 分析

// /agent/src/search.ts

export function searchDex(deepSearch: boolean) {
    const result: any = [];
    Process.enumerateRanges('r--').forEach(function (range: RangeDetails) {
        try {
            Memory.scanSync(range.base, range.size, "64 65 78 0a 30 ?? ?? 00").forEach(function (match) {
                ......
                }
            });

            if (deepSearch) {
                Memory.scanSync(range.base, range.size, "70 00 00 00").forEach(function (match) {
                    const dex_base = match.address.sub(0x3C);
                    if (dex_base < range.base) {
                        return;
                    }
                    if (dex_base.readCString(4) != "dex\n" && verify(dex_base, range, true)) {
                        const real_dex_size = get_dex_real_size(dex_base, range.base, range.base.add(range.size));
                        if (!verify_ids_off(dex_base, real_dex_size)) {
                            return;
                        }
                        result.push({
                            "addr": dex_base,
                            "size": real_dex_size
                        });
                        const max_size = range.size - dex_base.sub(range.base).toInt32();
                        if (max_size != real_dex_size) {
                            result.push({
                                "addr": dex_base,
                                "size": max_size
                            });
                        }
                    }
                })
            } else {
                if (range.base.readCString(4) != "dex\n" && verify(range.base, range, true)) {
                    const real_dex_size = get_dex_real_size(range.base, range.base, range.base.add(range.size));
                    result.push({
                        "addr": range.base,
                        "size": real_dex_size
                    });
                }
            }

        } catch (e) {
        }
    });

    return result;
}

原理：

1. Process.enumerateRanges('r--') 枚举可读的内存区块
   
   2.1. 非深度搜索 ：Memory.scanSync(range.base, range.size, "64 65 78 0a 30 ?? ?? 00")，这里就是在搜索 DEX.035. 但是很多加壳软件会修改掉这个DEX的标志（不影响虚拟机的加载，但会影响静态分析），这里就不展开解读了
   
   2.2 深度搜索： Memory.scanSync(range.base, range.size, "70 00 00 00") ， DEX 头的大小是 0x70 = 112，而紧挨着头的是string_ids区域，那么它的偏移必然是0x70,这个值是固定的，那么stringIdsOffset在DEX header里的值必然是"70 00 00 00"，可以通过搜索它来缩小一波范围，成为怀疑对象
2. 执行verify 来确认是不是dex

function verify(dexptr: NativePointer, range: RangeDetails, enable_verify_maps: boolean): boolean {

    if (range != null) {
        var range_end = range.base.add(range.size);
        // verify header_size
        if (dexptr.add(0x70) > range_end) {
            return false;
        }

        if (enable_verify_maps) {

            var maps_address = get_maps_address(dexptr, range.base, range_end);
            if (!maps_address) {
                return false;
            }

            var maps_end = get_maps_end(maps_address, range.base, range_end);
            if (!maps_end) {
                return false;
            }
            return verify_by_maps(dexptr, maps_address)
        } else {
            return dexptr.add(0x3C).readUInt() === 0x70;
        }
    }

    return false;

}

其他的比较简单，核心是 verify_by_maps

function verify_by_maps(dexptr: NativePointer, mapsptr: NativePointer): boolean {
    const maps_offset = dexptr.add(0x34).readUInt();
    const maps_size = mapsptr.readUInt();
    for (let i = 0; i < maps_size; i++) {
        const item_type = mapsptr.add(4 + i * 0xC).readU16();
        if (item_type === 4096) {
            const map_offset = mapsptr.add(4 + i * 0xC + 8).readUInt();
            if (maps_offset === map_offset) {
                return true;
            }
        }
    }
    return false;
}

通过 map_off 找到 DEX 的 map_list， 通过解析它，并得到type为 TYPE_MAP_LIST(4096) 的item。理论上讲，这个条目里面的索引值应该要与 map_off 一致，那么通过校验这两个地方，就可以实现一个更加精确的验证方案。

这里涉及到Dex MapItem的数据结构

  struct MapItem {
     uint16_t type_;
     uint16_t unused_;
     uint32_t size_;
     uint32_t offset_;
   };

确认完毕后，开始获取dex的大小get_dex_real_size,(内存中的 DEX Header 并不只有 magic 可以抹掉，还有另一个运行时无关但对我们至关重要的字段：file_size，也就是文件的大小)

function get_dex_real_size(dexptr: NativePointer, range_base: NativePointer, range_end: NativePointer): Number {
    const dex_size = dexptr.add(0x20).readUInt();

    const maps_address = get_maps_address(dexptr, range_base, range_end);
    if (!maps_address) {
        return dex_size;
    }

    const maps_end = get_maps_end(maps_address, range_base, range_end);
    if (!maps_end) {
        return dex_size;
    }

    return maps_end.sub(dexptr).toInt32();
}

function get_maps_address(dexptr: NativePointer, range_base: NativePointer, range_end: NativePointer): NativePointer | null {
    const maps_offset = dexptr.add(0x34).readUInt();
    if (maps_offset === 0) {
        return null;
    }

    const maps_address = dexptr.add(maps_offset);
    if (maps_address < range_base || maps_address > range_end) {
        return null;
    }

    return maps_address;
}

function get_maps_end(maps: NativePointer, range_base: NativePointer, range_end: NativePointer): NativePointer | null {
    const maps_size = maps.readUInt();
    if (maps_size < 2 || maps_size > 50) {
        return null;
    }
    const maps_end = maps.add(maps_size * 0xC + 4);
    if (maps_end < range_base || maps_end > range_end) {
        return null;
    }

    return maps_end;
}

原理就是根据range的大小，和dex mapSize中的信息，确认出maps_end的地址，因为map就是dex的结尾，

获得了maps_end的地址，减去dexptr，即为整个dex的实际大小

searchDex最后 将数据写入到result返回

                        result.push({
                            "addr": dex_base,
                            "size": real_dex_size
                        });

4. 找到dex在内存中的位置了，就执行memory_dump 将数据dump出来

5. 然后修复dex头 fix_header

def fix_header(dex_bytes):
    import struct
    dex_size = len(dex_bytes)

    if dex_bytes[:4] != b"dex\n":
        dex_bytes = b"dex\n035\x00" + dex_bytes[8:]

    if dex_size >= 0x24:
        dex_bytes = dex_bytes[:0x20] + struct.Struct("<I").pack(dex_size) + dex_bytes[0x24:]

    if dex_size >= 0x28:
        dex_bytes = dex_bytes[:0x24] + struct.Struct("<I").pack(0x70) + dex_bytes[0x28:]

    if dex_size >= 0x2C and dex_bytes[0x28:0x2C] not in [b'\x78\x56\x34\x12', b'\x12\x34\x56\x78']:
        dex_bytes = dex_bytes[:0x28] + b'\x78\x56\x34\x12' + dex_bytes[0x2C:]

    return dex_bytes

这里一共做了四件事

1. 修复magic， dex.035。
2. 修复filesize
3. 修复stringIdsOffset
4. 修复小端特征 "78 56 34 12"