镖人-手游安全分析一（mac电脑环境）

镖人-手游安全分析一（mac电脑环境）

本文是第一篇，主要是要将il2cpp的符号还原。

先使用7z命令，将apk解压缩，查看一下游戏使用的引擎

admin@C02D7132MD6R 镖师 % 7z x base.apk

admin@C02D7132MD6R 镖师 % ls lib/arm64-v8a 
lib39285EFA.so			libcocklogic-1.1.3.so		libmilinkconnection.so		libspeechengine.so		libttvebase.so
libAGFX.so			libconnectionbase.so		libmonitorcollector-lib.so	libspeechsdk.so			libttvideoeditor.so
libARM_ARCH.so			libdaemon.so			libmsgsdk_utils.so		libsqlcipher.so			libttvideouploader.so
libAVProLocal.so		libeffect.so			libnative-filters.so		libsscronet.so			libunity.so
libAkSoundEngine.so		libfdk-aac.so			libnative.so			libstatic-webp.so		libutility.so
libAudio360-JNI.so		libgifimage.so			libnew_sdk.so			libsupervisor.so		libweibosdkcore.so
libAudio360.so			libgp.so			libnpth.so			libtnet-3.1.14.so		libwind.so
libEncryptor.so			libgpm.so			libnpth_dumper.so		libtolua.so			libx264.so
libEncryptorTHanos.so		libhdiffpatch.so		libnpthanos.so			libttboringssl.so		libyuv.so
libalog-lib.so			libheif.so			libnpthanos_dumper.so		libttcrypto.so
libbytenn.so			***libil2cpp.so***			libopus.so			libttffmpeg.so
libbytertc.so			libimagepipeline.so		libopusJNI.so			libttheif_dec.so
libc++_shared.so		libmain.so			libping.so			libttopenssl.so

admin@C02D7132MD6R 镖师 % ls assets/bin/Data/Managed/Metadata 
global-metadata.dat

综上，libil2cpp.so以及global-metadata.dat.

unity3d引擎没得跑了，直接使用il2cppdumper先试试能不能还原符号吧

admin@C02D7132MD6R osx-x64 % ./Il2CppDumper ~/work/safe/game/镖师/lib/arm64-v8a/libil2cpp.so ~/work/safe/game/镖师/assets/bin/Data/Managed/Metadata/global-metadata.dat 
Initializing metadata...
Metadata Version: 24.1
Initializing il2cpp file...
Applying relocations...
WARNING: find .init_proc
ERROR: This file may be protected.
Il2Cpp Version: 24.1
Searching...
CodeRegistration : 2f30bf0
MetadataRegistration : 2f30c70
System.IO.EndOfStreamException: Unable to read beyond the end of the stream.
   at System.IO.BinaryReader.InternalRead(Int32 numBytes)
   at System.IO.BinaryReader.ReadUInt64()
   at Il2CppDumper.BinaryStream.ReadUInt64() in E:\Project\Github\Il2CppDumper-master\Il2CppDumper\IO\BinaryStream.cs:line 48
   at Il2CppDumper.BinaryStream.ReadPrimitive(Type type) in E:\Project\Github\Il2CppDumper-master\Il2CppDumper\IO\BinaryStream.cs:line 125
   at Il2CppDumper.BinaryStream.ReadClass[T]() in E:\Project\Github\Il2CppDumper-master\Il2CppDumper\IO\BinaryStream.cs:line 165
   at Il2CppDumper.BinaryStream.ReadClass[T](UInt64 addr) in E:\Project\Github\Il2CppDumper-master\Il2CppDumper\IO\BinaryStream.cs:line 134
   at Il2CppDumper.Il2Cpp.MapVATR[T](UInt64 addr) in E:\Project\Github\Il2CppDumper-master\Il2CppDumper\Il2Cpp\Il2Cpp.cs:line 161
   at Il2CppDumper.Il2Cpp.Init(UInt64 codeRegistration, UInt64 metadataRegistration) in E:\Project\Github\Il2CppDumper-master\Il2CppDumper\Il2Cpp\Il2Cpp.cs:line 116
   at Il2CppDumper.Il2Cpp.AutoInit(UInt64 codeRegistration, UInt64 metadataRegistration) in E:\Project\Github\Il2CppDumper-master\Il2CppDumper\Il2Cpp\Il2Cpp.cs:line 64
   at Il2CppDumper.Elf64.PlusSearch(Int32 methodCount, Int32 typeDefinitionsCount) in E:\Project\Github\Il2CppDumper-master\Il2CppDumper\ExecutableFormats\Elf64.cs:line 121
   at Il2CppDumper.Program.Init(Byte[] il2cppBytes, Byte[] metadataBytes, Metadata& metadata, Il2Cpp& il2Cpp) in E:\Project\Github\Il2CppDumper-master\Il2CppDumper\Program.cs:line 174
ERROR: An error occurred while processing.
Press any key to exit...

失败了。。。。。

先用ida直接dump出来libil2cpp.so吧

环境使用mac电脑，然后下载了mumu模拟器（https://mumu.163.com/mac/index.html）

1.模拟器对64位指令的兼容性问题，我考虑了v7安装ap k

admin@C02D7132MD6R osx-x64 % adb install -r --abi armeabi-v7a

2.将android_x86_server 推到模拟器并运行

admin@C02D7132MD6R dbgsrv % adb push android_x86_server /data/local/tmp/
admin@C02D7132MD6R ~ % adb devices
List of devices attached
emulator-5554	device

admin@C02D7132MD6R ~ % adb shell
root@x86_64:/ # su
root@x86_64:/ # cd /data/local/tmp 
root@x86_64:/data/local/tmp # ./an
android_x64_server  android_x86_server  
root@x86_64:/data/local/tmp # ./android_x86_server                             
IDA Android x86 32-bit remote debug server(ST) v1.22. Hex-Rays (c) 2004-2017
Listening on 0.0.0.0:23946 (my ip xx.xx.xx.58)...
=========================================================
[1] Accepting connection from 127.0.0.1...
[1] Closing connection from 127.0.0.1...
=========================================================

3.转发adb端口号

admin@C02D7132MD6R dbgsrv % adb forward tcp:23946 tcp:23946

4.启动游戏，并ida附加进程

哎呀…com.hermes.br.mi进程有两个，附加哪一个？

可以使用dumpsys命令查看游戏界面对应的进程信息

admin@C02D7132MD6R dbgsrv % adb shell dumpsys activity a
   * Hist #0: ActivityRecord{fe8cf9e u0 com.hermes.br.mi/com.babeltime.bractivity.BRActivity t21}
          packageName=com.hermes.br.mi processName=com.hermes.br.mi
          launchedFromUid=10035 launchedFromPackage=com.hermes.br.mi userId=0
          app=ProcessRecord{6b2aaa2 15518:com.hermes.br.mi/u0a35}
          Intent { flg=0x10000000 cmp=com.hermes.br.mi/com.babeltime.bractivity.BRActivity }
          frontOfTask=true task=TaskRecord{188352b #21 A=com.hermes.br.mi U=0 sz=1}
          taskAffinity=com.hermes.br.mi
          realActivity=com.hermes.br.mi/com.babeltime.bractivity.BRActivity
          baseDir=/data/app/com.hermes.br.mi-1/base.apk
          dataDir=/data/user/0/com.hermes.br.mi
          stateNotNeeded=false componentSpecified=true mActivityType=0

所以可以确定附加的进程pid=15518

5.开始上脚本dump内存吧！

先看map的内存地址:

root@x86_64:/ # cat /proc/15518/maps|grep il2cpp
08000000-08cad000 r-xp 00000000 08:13 5931040                            /data/app/com.hermes.br.mi-1/lib/arm/libil2cpp.so
0a710000-0a8c4000 rw-p 00cad000 08:13 5931040                            /data/app/com.hermes.br.mi-1/lib/arm/libil2cpp.so
c5ced000-c5d40000 r--s 00000000 08:13 7864349                            /storage/emulated/0/Android/data/com.hermes.br.mi/files/il2cpp/Resources/mscorlib.dll-resources.dat
ce822000-cf140000 r--s 00000000 08:13 7864330                            /storage/emulated/0/Android/data/com.hermes.br.mi/files/il2cpp/Metadata/global-metadata.dat

ida dumper脚本：

auto fp, i;
fp = fopen("~/work/safe/game/libil2cpp.dump.so", "wb");
for (i=0x08000000;i<0x0a8c4000;i++) {
    fputc(Byte(i),fp);
}

再试试还原符号能否成功：

admin@C02D7132MD6R osx-x64 % ./Il2CppDumper ~/work/safe/game/libil2cpp.dump.so ~/work/safe/game/镖师/assets/bin/Data/Managed/Metadata/global-metadata.dat 
Initializing metadata...
Metadata Version: 24.1
Initializing il2cpp file...
Detected this may be a dump file.
Input dump address or input 0 to force continue:
0x08000000
Il2Cpp Version: 24.1
Searching...
CodeRegistration : a817344
MetadataRegistration : a817384
Dumping...
Done!
Generate script...
Done!
Generate dummy dll...
Done!
Press any key to exit...

看一下dump.cs文件

admin@C02D7132MD6R osx-x64 % ls -al dump.cs 
-rw-r--r--  1 admin  staff  15507558  3 20 19:48 dump.cs
admin@C02D7132MD6R osx-x64 % vim dump.cs 

大功告成！