unidbg3

关键字定位 

let NetCrypto = Java.use("com.izuiyou.network.NetCrypto");
NetCrypto["a"].implementation = function (str, bArr) {
    console.log('a is called' + ', ' + 'str: ' + str + ', ' + 'bArr: ' + bArr);
    let ret = this.a(str, bArr);
    console.log('a ret value is ' + ret);
    return ret;

 hook

sign一样

往上看到init函数

得到init地址

  public static void main(String[] args) {

        zuiyou test = new zuiyou();
        test.native_init();

        System.out.println(test);

    }

报错

public DvmObject<?> callStaticObjectMethodV(BaseVM vm, DvmClass dvmClass, String signature, VaList vaList) {
        switch (signature) {
            case "com/izuiyou/common/base/BaseApplication->getAppContext()Landroid/content/Context;":
                return vm.resolveClass("android/content/Context").newObject(null);
        }
        return super.callStaticObjectMethodV(vm, dvmClass, signature, vaList);
    }

加上后解决

开始执行

    @Override
    public DvmObject<?> callObjectMethodV(BaseVM vm, DvmObject<?> dvmObject, String signature, VaList vaList) {
        switch (signature) {
            case "android/content/Context->getClass()Ljava/lang/Class;":{
                return dvmObject.getObjectType();
            }
        }
        return super.callObjectMethodV(vm, dvmObject, signature, vaList);
    };

补上

objection -g cn.xiaochuankeji.tieba explore -P ~/.objection/plugins
plugin wallbreaker classdump --fullname com.izuiyou.common.base.BaseApplication

 public DvmObject<?> callObjectMethodV(BaseVM vm, DvmObject<?> dvmObject, String signature, VaList vaList) {
        switch (signature) {
            case "android/content/Context->getClass()Ljava/lang/Class;":{
                return dvmObject.getObjectType();
            }
            case "java/lang/Class->getSimpleName()Ljava/lang/String;":{
                return new StringObject(vm, "AppController");
            }
        }
        return super.callObjectMethodV(vm, dvmObject, signature, vaList);
    };

case "android/content/Context->getFilesDir()Ljava/io/File;":
            case "java/lang/String->getAbsolutePath()Ljava/lang/String;": {
                return new StringObject(vm, "/data/user/0/cn.xiaochuankeji.tieba/files");
            }

   @Override
    public boolean callStaticBooleanMethodV(BaseVM vm, DvmClass dvmClass, String signature, VaList vaList) {
        switch (signature){
            case "android/os/Debug->isDebuggerConnected()Z":{
                return false;
            }

        }
        throw new UnsupportedOperationException(signature);
    }

    @Override
    public int callStaticIntMethodV(BaseVM vm, DvmClass dvmClass, String signature, VaList vaList) {
        switch (signature){
            case "android/os/Process->myPid()I":{
                return emulator.getPid();
            }

        }
        throw new UnsupportedOperationException(signature);
    }

a is called, str: https://api.izuiyou.com/account/login, bArr: [103,7,-31,32,-34,14,76,11,57,-9,-61,-15,48,-18,30,-36,5,-57,95,-13,83,11,-97,-99,94,-18,97,53,29,91,74,125,-45,-27,105,-58,48,-16,110,83,-62,-59,-82,-103,62,-76,-80,-87,-16,-96,56,-116,-5,-3,-92,-2,-5,49,-104,-92,-52,-94,20,-48,-72,95,116,-42,99,66,59,116,-114,10,47,-6,-56,109,61,-125,-90,-59,74,-76,-118,-127,-3,-58,-9,121,23,57,42,-122,27,104,-113,10,127,83,-68,-35,111,105,-34,-54,109,-109,55,-117,7,127,-126,4,-72,9,-14,-124,63,-115,66,41,58,89,105,112,-50,119,-49,-112,-20,20,103,69,66,-21,9,49,115,-56,-27,-117,25,-30,29,8,27,126,74,-128,85,-117,110,-7,66,82,-112,-18,-21,52,14,-39,-40,78,-59,117,71,-27,84,-74,11,75,53,-123,36,-39,5,-108,45,80,-16,-41,-54,58,59,-70,40,29,117,-102,108,53,-126,120,27,-70,75,-102,125,-127,23,106,46,-120,-116,30,114,123,47,-58,-124,116,-14,-47,73,98,31,36,37,40,62,-94,-32,80,-94,40,-101,89,71,-34,-81,64,48,55,-90,57,100,-72,-18,-87,4,-102,69,-8,125,-2,-105,120,-14,-89,122,-3,25,-45,43,-63,-101,-43,-17,114,-4,-55,29,93,-107,-27,-105,57,-21,39,119,-116,48,-14,-127,92,26,78,-2,89,103,47,-44,80,-80,7,-28,-9,-97,-64,-3,110,99,-111,98,7,35,-28,-104,-10,10,68,115,-11,80,-58,114,90,112,-29,87,-45,98,26,-69,-43,-42,-111,71,46,-117,1,-41,-31,-97,49,-128,-127,33,99,-23,-122,49,-49,104,116,96,69,72,52,102,-17,-54,-1,57,84,-59,-33,29,94,-74,-105,110,-78,-89,-92,47,-89,54,122,108,-67,-68,-42,-109,-63,122,39,121,-122,41,61,-90,8,122,-88,77,-25,-101,-104,-31,29,-126,-52,-98,-21,41,122,10,90,24,-107,-92,-107,107,89,-58,-62,-65,-26,83,-118,-96,-19,-38,-6,40,78,-121,-32,-44,18,60,-60,-74,75,86,-47,109,-73,32,11,25,46,32,-85,-85,-82,-113,-30,90,-78,40,56,-19,-65,-113,-88,-50,87,-116,-26,-61,107,47,13,-38,-75,39,-104,18,-97,43,73,46,2,-85,124,38,-78,-90,119,15,56,-43,92,-94,85,-90,-75,22,50,33,-11,-66,11,-92,-99,126,29,-60,111,-26,59,-79,41,25,69,-104,67,94,-52,46,-114,10,-94,57,56,-10,116,50,8,24,-60,52,61,75,84,-18,34,101,40,61,90,56,114,1,10,-31,120,68,-124,85,-109,50,-121,123,28,86,-26,54,97,52,-103,-83,-63,76,89,86,109,123,-17,86,56]
a ret value is https://api.izuiyou.com/account/login?sign=v2-5fa749feb0a43e9b2e47bb692a2f6740