unidbg 模拟执行案例(某汽车类app)(续)

上一篇文章讲了解密响应数据, 这一篇来看看如何加密请求数据。

打开jadx 搜索关键词， 有一处非常之可疑.

直接frida hook

    hookClass.addCheckCode.overload('java.lang.String', 'int').implementation = function (p1, p2) {
            console.log('222p1 ===> ' + p1);
            console.log('222p2 ===> ' + p2);
            console.log('222result ' + this.addCheckCode(p1, p2));

            return this.addCheckCode(p1, p2);
        }

hook结果如下 

跟我们抓包得数据对应上了。 java层继续跟踪， 是个native函数

继续使用unidbg

public String llbencode(){


        // args list
        List<Object> list = new ArrayList<>(10);
        // arg1 env
        list.add(vm.getJNIEnv());
        // arg2 jobject/jclazz 一般用不到，直接填0
        list.add(0);

//        String p1 = "{\"statisticsParams\":[{\"advertiseId\":\"2230\",\"statisticsDate\":1639813823383,\"statisticsType\":1}]}";
//        p1 = "123";
        String p1 = "pageNo=2&pageSize=20";
        String p3 = "1638526032490";
        list.add(vm.addLocalObject(new StringObject(vm, p1)));
        list.add(2);
        list.add(vm.addLocalObject(new StringObject(vm, p3)));
        // 参数准备完成
        // call function

        Number number = module.callFunction(emulator, 0x13A18 + 1, list.toArray())[0];
        System.out.println("测试这里");
        System.out.println(number);
        System.out.println(number.intValue());

        String result = vm.getObject(number.intValue()).getValue().toString();
        return result;
    }

运行后，结果如下

 

补环境 ， 代码如下

@Override
    public DvmObject<?> callStaticObjectMethod(BaseVM vm, DvmClass dvmClass, String signature, VarArg varArg) {
        switch (signature) {

//            case "android/os/SystemProperties->get(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;":
//                return new StringObject(vm, "FA6AT0306923");
            case "android/app/ActivityThread->currentPackageName()Ljava/lang/String;":
                return new StringObject(vm, "com.xxx.llb");
//            case "android/app/ActivityThread->currentActivityThread()Landroid/app/ActivityThread;":
//                return vm.resolveClass("android/app/ActivityThread").newObject(null);

        }
        return super.callStaticObjectMethod(vm, dvmClass, signature, varArg);
    }

补完环境后，继续运行,结果如下

根据提示，继续补环境,代码如下

@Override
    public DvmObject<?> callStaticObjectMethod(BaseVM vm, DvmClass dvmClass, String signature, VarArg varArg) {
        switch (signature) {

//            case "android/os/SystemProperties->get(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;":
//                return new StringObject(vm, "FA6AT0306923");
            case "android/app/ActivityThread->currentPackageName()Ljava/lang/String;":
                return new StringObject(vm, "com.cloudy.linglingbang");
            case "android/app/ActivityThread->currentActivityThread()Landroid/app/ActivityThread;":
                return vm.resolveClass("android/app/ActivityThread").newObject(null);

        }
        return super.callStaticObjectMethod(vm, dvmClass, signature, varArg);
    }

 

运行后，结果如下

 

继续补

代码如下

@Override
    public DvmObject<?> callStaticObjectMethod(BaseVM vm, DvmClass dvmClass, String signature, VarArg varArg) {
        switch (signature) {

            case "android/os/SystemProperties->get(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;":
                return new StringObject(vm, "FA6AT0306923");
            case "android/app/ActivityThread->currentPackageName()Ljava/lang/String;":
                return new StringObject(vm, "com.cloudy.linglingbang");
            case "android/app/ActivityThread->currentActivityThread()Landroid/app/ActivityThread;":
                return vm.resolveClass("android/app/ActivityThread").newObject(null);

        }
        return super.callStaticObjectMethod(vm, dvmClass, signature, varArg);
    }

运行后， 结果如下

 

补环境代码如下

@Override
    public DvmObject<?> callObjectMethod(BaseVM vm, DvmObject<?> dvmObject, String signature, VarArg varArg) {
        switch (signature) {
            case "android/net/wifi/WifiInfo->getMacAddress()Ljava/lang/String;":
                return new StringObject(vm, "02:00:00:00:00:00");
            case "java/lang/Object->getConnectionInfo()Landroid/net/wifi/WifiInfo;":
                return vm.resolveClass("android/net/wifi/WifiInfo").newObject(null);
            case "android/app/ContextImpl->getSystemService(Ljava/lang/String;)Ljava/lang/Object;":
                return vm.resolveClass("java/lang/Object").newObject(null);
            case "android/app/ContextImpl->getPackageManager()Landroid/content/pm/PackageManager;":
                return vm.resolveClass("android/content/pm/PackageManager").newObject(null);
            case "android/app/ActivityThread->getSystemContext()Landroid/app/ContextImpl;":
                return vm.resolveClass("android/app/ContextImpl").newObject(null);

        }

        return super.callObjectMethod(vm, dvmObject, signature, varArg);
    }

补完后，继续运行，报错如下

 

一个字，补！！！代码如下

@Override
    public DvmObject<?> getStaticObjectField(BaseVM vm, DvmClass dvmClass, String signature) {
        switch (signature) {
            case "android/os/Build$VERSION->SDK:Ljava/lang/String;":
                return new StringObject(vm, "18");
            case "android/os/Build->MANUFACTURER:Ljava/lang/String;":
                return new StringObject(vm, "Google");
            case "android/os/Build->MODEL:Ljava/lang/String;":
                return new StringObject(vm, "pixel");
        }
        return super.getStaticObjectField(vm, dvmClass, signature);
    }

继续运行， 结果如下

搞定，收工！

dng