一个被众多逆向人员凌辱的app --＞ 某du牛

一 前言

app版本：4.54
抓包工具：Charles
反汇编工具：JEB、JADX
inject：frida
查壳：360加固

二 抓包

2.1 Headers

POST: /api/user/login HTTP/1.1
Content-Type: application/json; charset=utf-8
User-Agent: Dalvik/2.1.0 (Linux; U; Android 8.1.0; Pixel 2 XL Build/OPM4.171019.021.R1)
Host: api.dodovip.com
Accept-Encoding: gzip
Content-Length: 262
Connection: keep-alive

2.2 Text

{"Encrypt":"NIszaqFPos1vd0pFqKlB42Np5itPxaNH//FDsRnlBfgL4lcVxjXii+GOZz1l+A5V9FPOSMf47jbE\n010Kk+PbNyEDRjj1zY76jXa7VyHLkjxpqsrJYht6LX1PcVabK8oBp/fiOE4l2lC5JVjqx/JI7CJm\neUXVXkgJ6rgPne3WCJUYU+ztDNEi+mvECeOktUk0KxqBbPzuJj3LKsW5Ux080rWm4NZWHxPFbZYl\nIs2IRcs=\n"}

2.3 Response

2v+DC2gq7RuAC8PE5GZz5wH3/y9ZVcWhFwhDY9L19g9iEd075+Q7xwewvfIN0g0ec/NaaF43/S0=

多次抓包仅 Encrypt 参数变化，需要分析的就是它了。

三 脱壳

上脚本，手机端启动fs后执行即可，脱壳的dex会在/data/data/com.dodonew.online目录下： 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76

function find_hook_fun() {     var fun_Name = "";     var libart = Module.findBaseAddress('libart.so');   //查找基地址     var exports = Module.enumerateExportsSync("libart.so");     for(var i=0; i<exports.length; i++){         if(exports[i].name.indexOf("OpenMemory") !== -1){             fun_Name = exports[i].name;             console.log("导出模块名: " + exports[i].name + "\t\t偏移地址: "+ (exports[i].address - libart - 1));             break;         }else if(exports[i].name.indexOf("OpenCommon") !== -1){             fun_Name = exports[i].name;             console.log("导出模块名: " + exports[i].name + "\t\t偏移地址: "+ (exports[i].address - libart - 1));             break;         }     }     return fun_Name; } function DexFileVerifier(Verify){     var magic_03x = true;     var magic_Hex = [0x64, 0x65, 0x78, 0x0a, 0x30, 0x33, 0x35, 0x00];     for(var i = 0; i < 8; i++){         if(Memory.readU8(ptr(Verify).add(i)) !== magic_Hex[i]){             if(Memory.readU8(ptr(Verify).add(i)) === 0x37 || 0x38){                 console.log('new dex');             }else{                 magic_03x = false;                 break;             }         }     }     return magic_03x; } function dump_Dex(fun_Name, apk_Name){     if (fun_Name !== ''){         var hook_fun = Module.findExportByName("libart.so", fun_Name);         Interceptor.attach(hook_fun, {             onEnter: function (args) {                 var begin = 0;                 var dex_flag = false;                 dex_flag = DexFileVerifier(args[0]);                 if(dex_flag === true){                     begin = args[0];                 }                 if(begin === 0){                     dex_flag = DexFileVerifier(args[1]);                     if(dex_flag === true){                         begin = args[1];                     }                 }                 if(dex_flag === true){                     console.log("magic : " + Memory.readUtf8String(begin));                     var address = parseInt(begin,16) + 0x20;                     var dex_size = Memory.readInt(ptr(address));                     console.log("dex_size :" + dex_size);