【Android逆向】破解看雪9月算法破解第一题

1. 安装apk到手机

2. 随意输入账号和密码，点击register，报错crackme1:ERROR

3. 将apk拖入到jadx中进行观察

    public native String register(String str);

    static {
        System.loadLibrary("native-lib");
    }

    /* JADX INFO: Access modifiers changed from: protected */
    @Override // androidx.fragment.app.FragmentActivity, androidx.activity.ComponentActivity, androidx.core.app.ComponentActivity, android.app.Activity
    public void onCreate(Bundle bundle) {
        super.onCreate(bundle);
        setContentView(R.layout.activity_main);
        initViews();
    }

    private void initViews() {
        this.edt_code = (EditText) findViewById(R.id.edt_code);
        this.edt_username = (EditText) findViewById(R.id.edt_username);
        Button button = (Button) findViewById(R.id.btn_register);
        this.btn_register = button;
        button.setOnClickListener(new View.OnClickListener() { // from class: com.r0ysue.first.MainActivity.1
            @Override // android.view.View.OnClickListener
            public void onClick(View view) {
                String obj = MainActivity.this.edt_username.getText().toString();
                String obj2 = MainActivity.this.edt_code.getText().toString(); // password
                if (obj.equals("")) {
                    Toast.makeText(MainActivity.this, "用户名不能为空", 0).show();
                    return;
                }
                String register = MainActivity.this.register(obj);
                if (register.equals(obj2) && !register.equals("Error!")) {
                    Toast.makeText(MainActivity.this, "SUCCESS!", 0).show();
                } else {
                    Toast.makeText(MainActivity.this, "ERROR!", 0).show();
                }
            }
        });
    }

那么很明显就是账号通过native函数处理后与密码进行比较来判断成功与失败

4. 加压缩apk， 拿到so文件，丢入到IDA中进行静态分析看看

__int64 __fastcall Java_com_r0ysue_first_MainActivity_register(JNIEnv *env, jobject object, void *name)
{
  const char *char_arr; // x21
  JNIEnv t_env; // x8
  __int128 *ret_chars; // x1
  unsigned int str_len; // w0
  __int128 v10[6]; // [xsp+0h] [xbp-90h] BYREF
  int v11; // [xsp+60h] [xbp-30h]
  __int64 v12; // [xsp+68h] [xbp-28h]

  v12 = *(_QWORD *)(_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) + 40);
  char_arr = (*env)->GetStringUTFChars(env, name, 0LL);
  if ( strlen(char_arr) - 6 < 0xF )
  {
    v11 = 0;
    memset(v10, 0, sizeof(v10));
    str_len = strlen(char_arr);
    base64_encode((const unsigned __int8 *)char_arr, str_len, (char *)v10);
    (*env)->ReleaseStringUTFChars(env, name, char_arr);
    t_env = *env;
    ret_chars = v10;
  }
  else
  {
    (*env)->ReleaseStringUTFChars(env, name, char_arr);
    t_env = *env;
    ret_chars = (__int128 *)"Error!";
  }
  return (__int64)t_env->NewStringUTF(env, (const char *)ret_chars);
}

这里可以看到 输入的字符串长度必须大于6 且小于20才可以，并且会进行base64_encode处理，这里是不是正真base64呢? 打开函数看看,整理后可得

unsigned __int8 *__fastcall base64_encode(unsigned __int8 *char_arr_p, unsigned int length, char *ret_v10)
{
  unsigned __int8 *t_char; // x8
  int v4; // w13
  int v5; // w12
  __int64 i; // x10
  char t_tbale_char; // w14
  int v8; // w15
  __int64 v9; // x13
  int step; // w14
  unsigned __int64 tt_Char; // x11
  int v12; // w9
  int v13; // w10
  int v14; // w9

  if ( length )
  {
    t_char = char_arr_p;
    v4 = 0;
    v5 = 0;
    LODWORD(char_arr_p) = 0;
    i = length;
    do
    {
      tt_Char = *t_char;
      if ( v5 == 2 )
      {
        t_tbale_char = word_8FC[((unsigned int)tt_Char >> 6) & 0xFFFFFFC3 | (4 * (v4 & 0xF))];
        v5 = 0;
        v8 = (_DWORD)char_arr_p + 1;
        v9 = tt_Char & 0x3F;
        ret_v10[(unsigned int)char_arr_p] = t_tbale_char;
        step = 2;
      }
      else if ( v5 == 1 )
      {
        v5 = 2;
        v9 = (16 * v4) & 0x30LL | (tt_Char >> 4);
        step = 1;
        v8 = (int)char_arr_p;
      }
      else
      {
        v9 = tt_Char >> 2;
        step = 1;
        v8 = (int)char_arr_p;
        v5 = 1;
      }
      char_arr_p = (unsigned __int8 *)(unsigned int)((_DWORD)char_arr_p + step);
      ret_v10[v8] = word_8FC[v9];
      --i;
      ++t_char;
      v4 = tt_Char;
    }
    while ( i );
    if ( v5 == 2 )
    {
      v14 = (_DWORD)char_arr_p + 1;
      ret_v10[(unsigned int)char_arr_p] = word_8FC[(4 * (int)tt_Char) & 0x3CLL];
      char_arr_p = (unsigned __int8 *)(unsigned int)((_DWORD)char_arr_p + 2);
      ret_v10[v14] = 61;
    }
    else if ( v5 == 1 )
    {
      v12 = (_DWORD)char_arr_p + 1;
      v13 = (_DWORD)char_arr_p + 2;
      ret_v10[(unsigned int)char_arr_p] = word_8FC[(16 * (int)tt_Char) & 0x30LL];
      char_arr_p = (unsigned __int8 *)(unsigned int)((_DWORD)char_arr_p + 3);
      ret_v10[v12] = 61;
      ret_v10[v13] = 61;
      ret_v10[(unsigned int)char_arr_p] = 0;
      return char_arr_p;
    }
    ret_v10[(unsigned int)char_arr_p] = 0;
  }
  else
  {
    char_arr_p = 0LL;
    *ret_v10 = 0;
  }
  return char_arr_p;
}

这里有一个关键的变量 word_8FC,点进去看看

.rodata:00000000000008FC 41 42 43 44 45 46 47 48 49 4A+aAbcdefghijklmn DCB "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
.rodata:00000000000008FC 4B 4C 4D 4E 4F 50 51 52 53 54+                                        ; DATA XREF: base64_encode(uchar const*,uint,char *)+4↑o
.rodata:00000000000008FC 55 56 57 58 59 5A 61 62 63 64+

可以看到一个标准的base64编解码表"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"

由此可以推测，这就是一个标准的base64编码函数

5. 用frida调用验证一下

function main() {
    Java.perform(function () {

        var MainActivityHandler = Java.use('com.r0ysue.first.MainActivity')

        console.log('1111')
        if (MainActivityHandler != undefined) {
            console.log('2222' )
            MainActivityHandler.register.implementation = function (str) {
                console.log('hooked i = ' + str)
                var ret = this.register(str)
                console.log('hooked ret = ' + ret)

                return ret
            }
        }

    })

}

setTimeout(main, 1000)

日志

ooked i = dfdd
hooked ret = Error!
hooked i = dfddfggv
hooked ret = ZGZkZGZnZ3Y=
hooked i = 1234567
hooked ret = MTIzNDU2Nw==
hooked i = 1234567
hooked ret = MTIzNDU2Nw==
hooked i = 12345678
hooked ret = MTIzNDU2Nzg=
hooked i = ddddddd
hooked ret = ZGRkZGRkZA==
hooked i = dddd
hooked ret = Error!
hooked i = ddddd
hooked ret = Error!
hooked i = dddddd
hooked ret = ZGRkZGRk
hooked i = dddddd
hooked ret = ZGRkZGRk
hooked i = dddddd
hooked ret = ZGRkZGRk

使用在线编解码工具测试，确实是正确的

6. 使用python开发注册机

import base64

while True:
    username = input("请输入用户名(长度小于等于20): ")
    if len(username) > 20:
        print("输入长度超过20，请重新输入")
    elif len(username) < 6:
        print("输入长度小于6，请重新输入")
    else:
        b64_byt = base64.b64encode(username.encode('utf-8'))
        print("密码：", b64_byt)