package com.cxa;
import com.github.unidbg.Module;
import com.github.unidbg.arm.ARMEmulator;
import com.github.unidbg.linux.android.AndroidARMEmulator;
import com.github.unidbg.linux.android.AndroidResolver;
import com.github.unidbg.linux.android.dvm.*;
import com.github.unidbg.memory.Memory;

import java.io.File;
import java.io.IOException;

//毒app 4.16.0
public class du extends AbstractJni {

    //ARM模擬器
    private final ARMEmulator emulator;
    //vm
    private final VM vm;
    //載入的模組
    private final Module module;

    private final DvmClass TTEncryptUtils;

    //初始化
    public du() throws IOException {
        //建立毒程序，這裡其實可以不用寫的，我這裡是隨便寫的，使用app本身的程序就可以繞過程序檢測
        emulator = new AndroidARMEmulator("com.du.du");
        Memory memory = emulator.getMemory();
        //作者支援19和23兩個sdk
        memory.setLibraryResolver(new AndroidResolver(23));
        //建立DalvikVM，利用apk本身，可以為null
        //如果用apk檔案載入so的話，會自動處理簽名方面的jni，具體可看AbstractJni,這就是利用apk載入的好處
       //       vm = emulator.createDalvikVM(new File("src/test/resources/du/du4160.apk"));
        vm = ((AndroidARMEmulator) emulator).createDalvikVM(null);
        //載入so，使用armv8-64速度會快很多
        DalvikModule dm = vm.loadLibrary(new File("/Users/chennan/javaproject/unidbg/unidbg-android/src/test/resources/du/libJNIEncrypt.so"), false);
        //呼叫jni
        dm.callJNI_OnLoad(emulator);
        module = dm.getModule();
        //Jni呼叫的類，載入so
        TTEncryptUtils = vm.resolveClass("com/duapp/aesjni/AESEncrypt");
    }


    //關閉模擬器
    private void destroy() throws IOException {
        emulator.close();
        System.out.println("destroy");
    }

    public static void main(String[] args) throws IOException {
        du t = new du();
        t.encodeByte("lastIdloginTokenplatformandroidsellTime201912timestamp1577459413370uuid7337c8189240625v4.16.0");
        t.destroy();
    }

    private String encodeByte(String strs) {
        //除錯
        // 這裡還支援gdb除錯，
        //emulator.attach(DebuggerType.GDB_SERVER);
        //附加偵錯程式
//        emulator.attach(DebuggerType.SIMPLE);
//        emulator.traceCode();
        //這裡是打斷點，原地址0x00005028->新地址0x40005028 新地址需要改成0x4
//        emulator.attach().addBreakPoint(null, 0x40001188);//encode地址
//        emulator.attach().addBreakPoint(null, 0x40000D10);
//        Number ret = TTEncryptUtils.callStaticJniMethod(emulator, "getByteValues()Ljava/lang/String;");
        Object ret = TTEncryptUtils.callStaticJniMethodObject(emulator, "getByteValues()Ljava/lang/String;");

//        long hash = ret.intValue() & 0xffffffffL;
//        StringObject st1 = vm.getObject(hash);
        String byteString = (String) ((DvmObject) ret).getValue();
        //毒這裡要處理下字串
        StringBuilder builder = new StringBuilder(byteString.length());
        for (int i = 0; i < byteString.length(); i++) {
            if (byteString.charAt(i) == '0') {
                builder.append('1');
            } else {
                builder.append('0');
            }
        }
        //獲取encodeByte地址
        ret = TTEncryptUtils.callStaticJniMethodObject(emulator, "encodeByte(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;",
                //傳參，這裡需要兩個字串，所以就傳入兩個引數
                vm.addLocalObject(new StringObject(vm, strs)),
                vm.addLocalObject(new StringObject(vm, builder.toString())));
        //ret 返回的是地址，
        //或得其值
        String str = (String) ((DvmObject) ret).getValue();
        //毒這裡要處理下字串
        System.out.println(str);
        return str;
    }
}
 

原文:https://zhuanlan.zhihu.com/p/111793677