分析目標

• 少年三國志，包名：com.youzu.android.snsgz
• 全民水滸，包名：com.tencent.Q108

下面分析的主要是少年三國志。

Lua指令碼解密與DUMP

• LuaJit IDA分析呼叫樹：

  1. AppDelegate::applicationDidFinishLaunching(AppDelegate *__hidden this) EXPORT _ZN11AppDelegate29applicationDidFinishLaunchingEv

  2. cocos2d::CCLuaEngine::defaultEngine(cocos2d::CCLuaEngine *__hidden this) EXPORT _ZN7cocos2d11CCLuaEngine13defaultEngineEv

  3. cocos2d::CCLuaEngine::init(cocos2d::CCLuaEngine *__hidden this)
     EXPORT _ZN7cocos2d11CCLuaEngine4initEv

  4. cocos2d::CCLuaStack::create(cocos2d::CCLuaStack *__hidden this)
     EXPORT _ZN7cocos2d10CCLuaStack6createEv

  5. cocos2d::CCLuaStack::init(cocos2d::CCLuaStack *__hidden this)
     EXPORT _ZN7cocos2d10CCLuaStack4initEv

  6. cocos2dx_lua_loader

  7. cocos2d::CCLuaStack::lua_loadbuffer(lua_State , char const, int, char const*)
     EXPORT ZN7cocos2d10CCLuaStack14lua_loadbufferEP9lua_StatePKciS4

cocos2d::CCLuaStack::lua_loadbuffer先呼叫以下函式解密： cocos2d::extra::CCCrypto::decryptUF(uchar ,int,int ,int *) EXPORT ZN7cocos2d5extra8CCCrypto9decryptUFEPhiPiS3

因此可以直接對luaL_loadbuffer進行HOOK，進而DUMP出Lua指令碼，網上搜索函式宣告：

int luaL_loadbuffer (lua_State *L, const char *buff, size_t sz, const char *name);

進而實現HOOK程式碼：

//orig function copy
int (*luaL_loadbuffer_orig)(void *L, const char *buff, int size, const char *name) = NULL;

//local function
int luaL_loadbuffer_mod(void *L, const char *buff, int size, const char *name) {
    LOGD("[dumplua] luaL_loadbuffer name: %s lua: %s", name, buff);
    return luaL_loadbuffer_orig(L, buff, size, name);
}

void hook() {
    LOGD("[dumplua] hook begin");
    void *handle = dlopen("libgame.so", RTLD_NOW);
    if (handle == NULL) {
        LOGE("[dumplua]dlopen err: %s.", dlerror());
        return;
    }else{
        LOGD("[dumplua] libgame.so dlopen OK!");
    }


    void *pluaL_loadbuffer = dlsym(handle, "luaL_loadbuffer");
    if (pluaL_loadbuffer == NULL){
        LOGE("[dumplua] lua_loadbuffer not found!");
        LOGE("[dumplua] dlsym err: %s.", dlerror());
    }else{
        LOGD("[dumplua] luaL_loadbuffer found!");
        MSHookFunction(pluaL_loadbuffer, (void *)&luaL_loadbuffer_mod, (void **)&luaL_loadbuffer_orig);
    }
}

執行後攔截到的輸出資訊：

01-05 19:29:27.674 13191-13215/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: assets/scripts/main.lua lua: 
    function __G__TRACKBACK__(errorMessage)

      print("----------------------------------------")
      print("LUA ERROR: " .. tostring(errorMessage) .. "\n")
      local traceback = debug.traceback("", 2)
      print(traceback)
      print("----------------------------------------")


      --只有G_Report初始過後才會對錯誤日誌做處理
      if G_Report ~= nil then
          G_Report:onTrackBack(errorMessage, traceback)
      end


      if SHOW_EXCEPTION_TIP and uf_notifyLayer ~= nil then 
        uf_notifyLayer:getDebugNode():removeChildByTag(10000)
        local text = tostring(errorMessage)
          require("upgrade.ErrMsgBox").showErrorMsgBox(text)

      end
    end



    function traceMem(desc)
      if desc == nil then
          desc = "memory:"
      end


      if CCLuaObjcBridge then
          local callStaticMethod = CCLuaObjcBridge.callStaticMethod

          local ok, ret = callStaticMethod("NativeProxy", "getUsedMemory", nil)

          if ok then
              pri
01-05 19:29:27.679 13191-13215/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: upgrade.AntiAddictionLayer lua: LJ-
01-05 19:29:27.679 13191-13215/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: upgrade.ComSdkUtils lua: LJA
01-05 19:29:27.684 13191-13215/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: upgrade.config lua: LJ�    
01-05 19:29:27.684 13191-13215/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: upgrade.ConfigLayer lua: LJ]
01-05 19:29:27.684 13191-13215/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: upgrade.EffectNode_Upgrade lua: LJ�
01-05 19:29:27.684 13191-13215/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: upgrade.ErrMsgBox lua: LJP
01-05 19:29:27.684 13191-13215/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: upgrade.game lua: LJ�
01-05 19:29:27.684 13191-13215/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: upgrade.NativeCallUtils lua: LJ�
01-05 19:29:27.684 13191-13215/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: upgrade.NativeProxy lua: LJ�
01-05 19:29:27.684 13191-13215/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: upgrade.Patcher lua: LJ�
01-05 19:29:27.689 13191-13215/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: upgrade.SplashLayer lua: LJ-
01-05 19:29:27.689 13191-13215/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: upgrade.upgrade lua: LJ6

可見，有些Lua指令碼是原始碼形式，有些是LuaJit編譯的，可以改寫以上程式碼把指令碼DUMP到檔案中再進一步分析，此處略。

資源解密與DUMP

主要函式： cocos2d::CCImage::initWithImageFile呼叫 cocos2d::CCImage::initWithImageData

但是IDA分析發現initWithImageData會呼叫cocos2d::extra::CCCrypto::decryptXXTEA和cocos2d::extra::CCCrypto::decryptUF進行解密，最後再載入圖片資源。以下是initWithImageData部分程式碼：

if ( s )
  {
    v12 = (unsigned __int8 *)strlen(s);
    v13 = (void *)cocos2d::extra::CCCrypto::decryptXXTEA(v9, v11, (int)s, v12, (int)v24, v22);
    v14 = v13;
    if ( v13 )
      v9 = (cocos2d::extra::CCCrypto *)v13;
    goto LABEL_28;
  }
  v14 = 0;
  if ( (signed int)a3 > 3 && *(_BYTE *)this == 85 && *((_BYTE *)this + 1) == 70 )
  {
    v25 = 0;
    cocos2d::extra::CCCrypto::decryptUF(this, (int)a3, (int)&v25, v24, v21);
    v15 = v25 >> 4;
    if ( (v25 & 0xFu) <= 9 )
      *(_DWORD *)(v8 + 36) = v25 & 0xF;
    switch ( v15 )
    {
      case 1:
        v16 = 1067030938;
        break;
      case 2:
        v16 = 1068708659;

也即會呼叫cocos2d::extra::CCCrypto::decryptXXTEA和cocos2d::extra::CCCrypto::decryptUF進行解密操作。我們看下cocos2d::extra::CCCrypto::decryptUF這個函式，通過IDA的F5外掛，並不斷修改變數名可以獲得一個比較清晰的C程式碼。

int __fastcall cocos2d::extra::CCCrypto::decryptUF(cocos2d::extra::CCCrypto *pInBuff, int nlen, int a3, int *pOutLen, int *name)
{
  cocos2d::extra::CCCrypto *pInBuff2; // r5@1
  int *pOutLen2; // r7@1
  int v7; // r3@4
  int v8; // r6@5
  int v9; // r1@6
  int result; // r0@9
  int v11; // r4@10
  int v12; // r6@12
  int v13; // r6@15
  signed int v14; // r0@19
  int v15; // [sp+0h] [bp-28h]@5
  int v16; // [sp+0h] [bp-28h]@10
  int v17; // [sp+4h] [bp-24h]@5

  pInBuff2 = pInBuff;
  pOutLen2 = pOutLen;
  if ( nlen <= 3 )
  {
    v14 = 1;
    return -v14;
  }
  if ( *(_BYTE *)pInBuff != 'U' || *((_BYTE *)pInBuff + 1) != 'F' )
  {
    v14 = 2;
    return -v14;
  }
  *(_DWORD *)a3 = *((_BYTE *)pInBuff + 2);
  v7 = *((_BYTE *)pInBuff + 3);
  if ( v7 == 1 )
  {
    v15 = nlen - 5;
    v17 = *((_BYTE *)pInBuff + 4);
    v8 = 0;
    while ( v8 < v15 )
    {
      v9 = (v8++ + v17) % 0x21;
      *(_BYTE *)pInBuff2 = *((_BYTE *)pInBuff2 + 5) ^ byte_6D192C[v9];
      pInBuff2 = (cocos2d::extra::CCCrypto *)((char *)pInBuff2 + 1);
    }
    *pOutLen2 = v15;
  }
  else
  {
    result = 0;
    if ( v7 != 2 )
      return result;
    v11 = 0;
    v16 = *((_BYTE *)pInBuff2 + 4);
    do
    {
      *((_BYTE *)pInBuff2 + v11) = *((_BYTE *)pInBuff2 + nlen + v11 - 5) ^ byte_6D192C[(v11 + v16) % 33 + 33];
      ++v11;
    }
    while ( v11 != 5 );
    v12 = nlen - 10;
    if ( nlen - 10 > 95 )
      v12 = 95;
    v13 = v12 + 4;
    while ( v13 >= v11 )
    {
      *((_BYTE *)pInBuff2 + v11) ^= byte_6D192C[(v11 + v16) % 33 + 33];
      ++v11;
    }
    *pOutLen2 = nlen - 5;
  }
  return 0;
}

其實看到這裡應該也是比較容易逆向分析出解密的演算法的，應該說比較簡單，可以直接寫一個指令碼來解密assets裡的資源。但是為了保證通用性，還是寫HOOK程式碼比較好。

本來分析以為最終都會呼叫_initWithWebpData、_initWithJpgData、_initWithBpgData、_initWithPngData、_initWithTiffData、_initWithRawData這些函式的，但是實際上分別HOOK後並沒有被攔截，所以最後還是HOOK了下cocos2d::extra::CCCrypto::decryptUF。

static string g_strDataPath;
static int g_nCount = 1;

string getNextFilePath(const char *fileExt) {
    char buff[100] = {0};
    ++g_nCount;
    sprintf(buff, "%s/cache/%d%s", g_strDataPath.c_str(), g_nCount, fileExt);
    return buff;
}

bool saveFile(const void* addr, int len, const char *outFileName)
{
    bool bSuccess = false;
    FILE* file = fopen(outFileName, "wb+");
    if (file != NULL) {
        fwrite(addr, len, 1, file);
        fflush(file);
        fclose(file);
        bSuccess = true;
        chmod(outFileName, S_IRWXU | S_IRWXG | S_IRWXO);
    }else{
        LOGE("[%s] fopen failed, error: %s", __FUNCTION__, dlerror());
    }

    return bSuccess;
}

//hook decryptUF
int (*decryptUF_orig)(void *pInBuff, int len, int *n, int *poutlen, char *name) = NULL;
int decryptUF_mod(void *pInBuff, int len, int *n, int *poutlen, char *name) {
    int ret = decryptUF_orig(pInBuff, len, n, poutlen, name);
    saveFile(pInBuff, *poutlen, getNextFilePath(".png").c_str());
    return ret;
}

void hook() {
    //hook decryptUF
    void *decryptUF = dlsym(handle, "_ZN7cocos2d5extra8CCCrypto9decryptUFEPhiPiS3_");
    if ( decryptUF==NULL ) {
        LOGE("[dumplua] _ZN7cocos2d5extra8CCCrypto9decryptUFEPhiPiS3_ (decryptUF) not found!");
        LOGE("[dumplua] dlsym err: %s.", dlerror());
    }else{
        LOGD("[dumplua] _ZN7cocos2d5extra8CCCrypto9decryptUFEPhiPiS3_ (decryptUF) found!");
        MSHookFunction(decryptUF, (void *)&decryptUF_mod, (void **)&decryptUF_orig);
    }
}

我這裡圖方便把所有解密的資料都DUMP為/data/data/packagename/cache目錄下副檔名為PNG的檔案了，最後通過指令碼從手機中批量提取出解密後的檔案：

#coding:utf-8
import os

for i in range(1, 10000):
    cmd = 'adb pull /data/data/com.youzu.android.snsgz/cache/' + str(i) +'.png' + ' e:\\test'
    os.system(cmd)

其實通過上面的分析就可以知道，圖片資源的解密和Lua的解密都是呼叫了相同的函式，因此解密出的檔案不全是圖片，還有寫LuaJit的指令碼檔案，用十六進位制編輯器開啟就可以看到LJ開頭的魔法數字。

全民水滸

全民水滸這個比較簡單，資源直接沒加密處理，解壓縮APK檔案就可以在assets目錄下查看了。Lua指令碼可以通過HOOK函式luaL_loadbuffer獲得，而且可以看出只是對編譯的Lua指令碼做了簡單的加密，可以直接DUMP出來，相對少年三國志稍微弱了一些。

01-05 20:04:16.569 17729-17886/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: require "UpdateScene.lua" lua: require "UpdateScene.lua"
01-05 20:04:16.574 17729-17886/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: UpdateScene.lua lua: LuaQ
01-05 20:04:16.574 17729-17886/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: Modal.lua lua: LuaQ
01-05 20:04:16.574 17729-17886/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: UIDefine.lua lua: LuaQ
01-05 20:04:16.574 17729-17886/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: MessageBox.lua lua: LuaQ
01-05 20:04:16.579 17729-17886/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: SoundManager.lua lua: LuaQ
01-05 20:04:16.579 17729-17886/? D/SUBSTRATEHOOK: [dumplua] luaL_loadbuffer name: SoundConfig.lua lua: LuaQ