AppNinja 开发手记5: gdb cycript用法 - aes加密key
学习心得: 动静hook结合,提高分析效率。cycript使用还需要深入。
Written by AppNinja 开发手记
ps aux
gdb -p pid
Reading symbols for shared libraries + done
0x3a4f3a58 in mach_msg_trap ()
1. 目标函数下断点
(gdb) break +[AESCrypt encrypt:password:]
Breakpoint 1 at 0xce95e
2.执行命中断点:
(gdb) po $r0
AESCrypt
(gdb) po $r1
0xd4628 does not appear to point to a valid object.
(gdb) x/s $r1
0xd4628: "encrypt:password:"
(gdb) po $r2
aefefefadfaefrefe3023232424242424242444a
(gdb) po $r3
keypassword
isEqualToString:
__text:00008958 ; id __cdecl +[AESCrypt encrypt:password:](struct AESCrypt *self, SEL, id, id)
Breakpoint 1 at 0xce95e
cycript
1. 教程
http://www.iphonedevwiki.net/index.php/Cycript_Tricks
http://www.cycript.org/manual/#7061c058-5485-4c00-be7e-b67accc55796
http://www.tuicool.com/articles/Ibayy2
http://danqingdani.blog.163.com/blog/static/18609419520135193830786/
http://iphonedevwiki.net/index.php/Cycript
http://www.securitylearn.net/2013/09/12/penetration-testing-of-iphone-applications-part-6/
2. 例子
function tryPrintIvars(a){ var x={}; for(i in *a){ try{ x[i] = (*a)[i]; } catch(e){} } return x; }
function printMethods(className) {
var count = new new Type("I");
var methods = class_copyMethodList(objc_getClass(className), count);
var methodsArray = [];
for(var i = 0; i < *count; i++) {
var method = methods[i];
methodsArray.push({selector:method_getName(method), implementation:method_getImplementation(method)});
}
free(methods);
free(count);
return methodsArray;
}
NSLog_ = dlsym(RTLD_DEFAULT, "NSLog")
NSLog = function() { var types = 'v', args = [], count = arguments.length; for (var i = 0; i != count; ++i) { types += '@'; args.push(arguments[i]); } new Functor(NSLog_, types).apply(null, args); }
NSLog("w ivars: %@", tryPrintIvars(w))
cy# printMethods("NSData")
cy# printMethods("NSString")
cy# @import com.saurik.substrate.MS
cy# var oldm = {};
cy# MS.hookMessage(NSObject, @selector(description), function() {return oldm->call(this) + " (of doom)"; NSLog("ok");}, oldm)
cy# [new NSObject init]
#"<NSObject: 0x100203d10> (of doom)"
cy# @import com.saurik.substrate.MS
cy# fopen = dlsym(RTLD_DEFAULT, "fopen")
cy# fopen = @encode(void *(char *, char *))(fopen)
cy# var oldf = {}
cy# var log = []
# MS.hookFunction(fopen, function(path, mode) {
var file = (*oldf)(path, mode);
log.push([path, mode, file]);
return file;
}, oldf)
fopen("/bin/xx", "r");
cy# log
[["/etc/passwd","r",0x7fff72c14280]]
3. 测试 hook function
cy# @import com.saurik.substrate.MS
cy# var oldf = {}
cy# var log = []
cy# MS.hookFunction(fopen, function(path, mode) {
cy> if (path == "/etc/passwd")
cy> path = "/var/passwd-fake";
cy> var file = (*oldf)(path, mode);
cy> log.push([path, mode, file]);
cy> return file;
cy> }, oldf)
hook strlen app 马上闪退,为什么?
@import com.saurik.substrate.MS
strlen = dlsym(RTLD_DEFAULT, "strlen")
strlen = @encode(int (const char *))(strlen)
var oldstrlen = {}
var log = []
MS.hookFunction(strlen, function(path) {
var file = (*oldstrlen)(path);
log.push([path]);
return file;
}, oldstrlen)
4. 测试 hook Message
写法不对,暂时放着。
AESCrypt encrypt:password:
@import com.saurik.substrate.MS
var oldencrypt = {};
var log = []
MS.hookMessage(AESCrypt, @selector(encrypt:password:), function(data, key) {
log.push([data, key]);
return oldencrypt->call(this, data, key);
}, oldencrypt)
AppNinja 开发手记5: gdb&cycript用法 - aes加密key
最新推荐文章于 2024-01-31 23:15:43 发布