re学习笔记（98）攻防世界 mobile进阶区 ill-intentions

推荐肉丝r0ysue课程（包含安卓逆向与js逆向）：

题目描述：Do you have have ill intentions?

打开查看MainActivity，仅仅注册了一个广播接收者

而这个广播接收者也没什么代码，仅仅是接受到不同的信息跳转到不同的Acitivity

三个Activity各有一个native函数


三个类逻辑差不多相同，只是调用的native方法不同，关系如下

DefinitelyNotThisOne：definitelyNotThis
sThisTheRealOne：perhapsThis
ThisIsTheRealOne：orThat

安装apk打开，只有MainAcitvity一个TextView，没有什么其他的东西，AndroidManifest.xml中，三个类均是未导出的状态

由于没有让用户输入，所以flag应该是某个阶段生成的，关键应该就在那三个native函数上，且根据名字只有一个是真的。

于是可以在java层hook intent.putExtra()方法来获得结果 和三个native方法得到参数
为了练习一下native hook，我hook了native层

function main() {
    function getjstring(jstr) {
        return Java.vm.getEnv().getStringUtfChars(jstr, null).readCString();
    }
    Java.perform(function () {
        var so_addr = Module.findBaseAddress("libhello-jni.so");
        var perhapsThis_addr = Module.findExportByName("libhello-jni.so", "Java_com_example_application_IsThisTheRealOne_perhapsThis");
        console.log("perhapsThis_addr", perhapsThis_addr);
        Interceptor.attach(perhapsThis_addr, {
            onEnter: function (args) {
                console.log("perhapsThis_args:[1]", getjstring(args[2]), "\n    [2]", getjstring(args[3]), "\n    [3]", getjstring(args[4]), "\n");
            },
            onLeave: function (retval) {
                console.log("perhapsThis_result:", getjstring(retval));
            },
        });

        Interceptor.attach(Module.findExportByName("libhello-jni.so", "Java_com_example_application_ThisIsTheRealOne_orThat"), {
            onEnter: function (args) {
                console.log("orThat_args:[1]", getjstring(args[2]), "\n    [2]", getjstring(args[3]), "\n    [3]", getjstring(args[4]), "\n");
            },
            onLeave: function (retval) {
                console.log("orThat_result:", getjstring(retval));
            },
        });

        Interceptor.attach(Module.findExportByName("libhello-jni.so", "Java_com_example_application_DefinitelyNotThisOne_definitelyNotThis"), {
            onEnter: function (args) {
                console.log("definitelyNotThis_args:[1]", getjstring(args[2]), "\n    [2]", getjstring(args[3]), "\n");
            },
            onLeave: function (retval) {
                console.log("definitelyNotThis_result:", getjstring(retval));
            },
        });
    });
}
setImmediate(main);

由于我没有修改apk文件，所以比较麻烦。需要开两个终端，先用objection android intent跳转到相应的activity，然后frida附加进程，在点击相应按钮获得hook输出。
或者采用重打包apk，给activity添加exported属性然后使用am命令来跳转到相应的Activity，修改入口也可以。

最终我们得到输出

orThat_args:[1] IIjsWa}iyYSmks
[2] ODBkNTNhZjRmMGZmMWYtMzhhMDIzMmMwYjcwNzlhMTUwMDczOWNlYjhjMhUWYWYeMzYiZDFkMTY?
[3] MhMhMGJhMTUhOGYWZThlZDQaYWJkYzkWZTktMTQhMjYhOTgiOTZkODgaNWRkZmFiZTciOGNlNDI?
orThat_result: KeepTryingThisIsNotTheActivityYouAreLookingForButHereHaveSomeInternetPoints!

---

perhapsThis_args:[1] TRytfrgooq|F{i-JovFBungFk\VlphgQbwvj_{HuDgaeTzuSt.@Lex^}
[2] ZGFkNGIwYzIWYjEzMTUWNjVjNTVlNjZhOGJkNhYtODIyOGEaMTMWNmQaOTVjZjkhMzRjYmUzZGE?
[3] MzQxZTZmZjAxMmIiMWUzNjUxMmRiYjIxNDUwYTUxMWItZGQzNWUtMzkyOWYyMmQeYjZmMzEaNDQ?
perhapsThis_result: Congratulation!YouFoundTheRightActivityHereYouGo-CTF{IDontHaveABadjokeSorry}

---

definitelyNotThis_args:[1] YjYwYWZjMjRkMhVhZTQhZDIwZGFkNWJhMGZmZGYiYmQaMmFkMjBiMTEhNDAtMzMzMjdlZmEWNzU?
[2] MzYwNjMeNjgxNWZkNGQeOTFhOTIhNDkiMDVhNDBkYTAyNWQtYhYxNWYwOTUxMzZiMTlmMzciMjM?
definitelyNotThis_result: Told you so!

得到最终的flag为CTF{IDontHaveABadjokeSorry}