IDA动态破解登录验证

2023-03-12

逆向分析 / android / 案例分析

字数统计: 740 | 阅读时长≈ 3 分钟

IDA动态破解登录验证

在测试app中输入用户名和密码，程序弹框”登陆失败”

反编译

使用jeb打开测试app，没有搜索到”登陆失败”相关字符串，猜想字符串可能在so中

打开AndroidManifest.xml查看程序入口，这里”android:debuggable=true”表示该apk可动态调试

我们进入MainActivity入口类并反编译成java代码，分析可得会调用Native方法myJNI.check()来校验用户名和密码

public class MainActivity extends AppCompatActivity {
    EditText User_Name;
    EditText User_Pass;
    Context ct;
    myJNI mj;

    public MainActivity() {
        super();
        this.mj = new myJNI();
        this.ct = ((Context)this);
    }

    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        this.setContentView(2130968603);
        this.User_Name = this.findViewById(2131427416);
        this.User_Pass = this.findViewById(2131427417);
        this.findViewById(2131427418).setOnClickListener(new View$OnClickListener() {
            public void onClick(View view) {
                Toast.makeText(MainActivity.this, MainActivity.this.mj.check(MainActivity.this.ct, MainActivity
                        .this.User_Name.getText().toString().trim(), MainActivity.this.User_Pass.getText()
                        .toString().trim()), 0).show();
            }
        });
    }
}

可以看到JniTest.so文件中的native方法

静态分析

我们来具体分析分析这个JniTest.so文件，解压apk安装包是使用IDA打开该文件进行分析

在Exports导出表中可以找到myJNI_check方法

跟进该myJNI_check方法，该IDA中显示的为汇编语言

在IDA中按F5对其进行编译成C语言，为使得代码有好的可读性，添加jni.h文件，C语言代码如下

_JNIEnv *__cdecl Java_demo2_jni_com_myapplication_myJNI_check(int a1, int a2, int a3, int a4, int a5)
{
  _JNIEnv *v6; // eax
  const char *v7; // esi
  _JNIEnv *result; // eax
  int v9; // [esp+Ch] [ebp-30h]
  const char *v10; // [esp+18h] [ebp-24h]
  const char *v11; // [esp+1Ch] [ebp-20h]

  v6 = (_JNIEnv *)getSignature(a1, a2, a3);
  v7 = (const char *)(*(int (__cdecl **)(int, _JNIEnv *, _DWORD))(*(_DWORD *)a1 + 676))(a1, v6, 0);
  v10 = (const char *)(*(int (__cdecl **)(int, int, _DWORD))(*(_DWORD *)a1 + 676))(a1, a4, 0);
  v11 = (const char *)(*(int (__cdecl **)(int, int, _DWORD))(*(_DWORD *)a1 + 676))(a1, a5, 0);
  __android_log_print(4, "JNI_LOG", &unk_8C4, v7);
  if ( strcmp(
         v7,
         "308201dd30820146020101300d06092a864886f70d010105050030373116301406035504030c0d416e64726f69642044656275673110300"
         "e060355040a0c07416e64726f6964310b3009060355040613025553301e170d3138303332313033303431385a170d343830333133303330"
         "3431385a30373116301406035504030c0d416e64726f69642044656275673110300e060355040a0c07416e64726f6964310b30090603550"
         "4061302555330819f300d06092a864886f70d010101050003818d00308189028181008270f53e2cf8c7d7ed200863deb85a054defde773b"
         "e0b848ee792839d9a81da098dd9b74bbb9679c19ea30b63fe3bb74aabb270a5c9b3359ebe3fdf278b82fe576a6677f0d77f0eb5b088d071"
         "1b15d03cadae08b3b980f28055d0cde4bbc4a0b4b208b0f30f170b6ea77a8620269fa1d375442653663e1dd41293aa1c4910e3502030100"
         "01300d06092a864886f70d010105050003818100044b9ab7e85346a147926c2d1c6c30e8ffcce174f88acb9763cb776fb1f4dd62183c952"
         "4346738ff1aea16c5fa218c68da76d05a2422aee12fc23563b5e28925c3d96dff855a584fc1ec462aa768277bd25739085d52fe3fedfd39"
         "6e38180c13fbb289786e524535933dd8a99ed3154880544f3e41f044acc43ceefbbce3af59") )
  {
    __android_log_print(4, "JNI_LOG", &unk_8F3, v9);
    exit(0);
  }
  __android_log_print(4, "JNI_LOG", &unk_8DF, v9);
  if ( !strcmp(v10, "koudai") && !strcmp(v11, "black") )
    result = (_JNIEnv *)(*(int (__cdecl **)(int, void *))(*(_DWORD *)a1 + 668))(a1, &unk_916);
  else
    result = (_JNIEnv *)(*(int (__cdecl **)(int, void *))(*(_DWORD *)a1 + 668))(a1, &unk_923);
  return result;
}