[Remote::com.moutai.mall ] - > dis(Process.findModuleByAddress( 0x76b3827df0 ).base.add( 0x2ddc ), 10 ) 0x76b3827ddc - - dis: mov x0, x19 ; env 0x76b3827de0 - - dis: mov x1, x22 ; jstring( "4bf227b7d74e5112a02b7f286e169b7d" ) 0x76b3827de4 - - dis: mov x2, xzr ; 0 0x76b3827de8 - - dis: ldr x8, [x8, #0x548] 0x76b3827dec - - dis: blr x8 ; GetStringUTFChars 0x76b3827df0 - - dis: mov x1, x0 ; 转换后的char * 指针地址 0x76b3827df4 - - dis: add x0, sp, #0x428 ; 平衡堆栈 0x76b3827df8 - - dis: mov w2, #0x400 0x76b3827dfc - - dis: bl #0x76b3828280 ; 跳转相对偏移:librand.so!0x3280 0x76b3827e00 - - dis: cbz x21, #0x76b3827e2c 3 、跟踪里librand.so! 0x3280 处的指令 [Remote::com.moutai.mall ] - > dis(Process.findModuleByAddress( 0x76b3827df0 ).base.add( 0x3280 ), 10 ) 0x76b3828280 - - dis: adrp x16, #0x76b3829000 ; 将0x76b3829000对应的页地址加载进x16 0x76b3828284 - - dis: ldr x17, [x16, #0x568] 0x76b3828288 - - dis: add x16, x16, #0x568 0x76b382828c - - dis: br x17 ; x17 = 0x769256eea0 = libc.so! 0x81EA0 = __strcat_chk 4 、x17的地址在libc.so中,继续追踪 [Remote::com.moutai.mall ] - > Process.findModuleByAddress( 0x769256eea0 ) { "base" : "0x76924ed000" , "name" : "libc.so" , "path" : "/apex/com.android.runtime/lib64/bionic/libc.so" , "size" : 6483968 } 0x769256eea0 = libc.so! 0x81EA0 = __strcat_chk 5 、hook libc.so的__strcat_chk,过滤参数搜索,得到参数和返回地址 __strcat_chk(arg_0 = 0x7ff7240b18 (android1706154085508), arg_1 = 0xb40000742e34bc50 ( 4bf227b7d74e5112a02b7f286e169b7d ), arg_2 = 0x400 ) LR: 0x76b3827e00 PC: 0x769256eea0 SP: 0x7ff72406f0 6 、回到librand.so继续跟踪代码 [Remote::com.moutai.mall ] - > dis(Process.findModuleByAddress( 0x76b3827df0 ).base.add( 0x2e00 ), 10 ) 0x76b3827e00 - - dis: cbz x21, #0x76b3827e2c ; 检查x21是否为零,为零跳转(x21 = 0x7ff72410f4) 0x76b3827e04 - - dis: ldr x8, [x19] ; x8 = [x19] = 0 0x76b3827e08 - - dis: mov x0, x19 ; x0 = x19 = 0xb4000074be22a170 0x76b3827e0c - - dis: mov x1, x21 ; x1 = x21 = 0x7ff72410f4 0x76b3827e10 - - dis: mov x2, xzr ; x2 = 0 0x76b3827e14 - - dis: ldr x8, [x8, #0x548] 0x76b3827e18 - - dis: blr x8 ; x8 = 0x73fa228a40 0x76b3827e1c - - dis: mov x1, x0 ; 转换后的char * 指针地址 0x76b3827e20 - - dis: add x0, sp, #0x428 ; 清理堆栈 0x76b3827e24 - - dis: mov w2, #0x400 对java层传入的第三个字符串做GetStringUTFChars操作 7 、继续向下跟踪代码 [Remote::com.moutai.mall ] - > dis(Process.findModuleByAddress( 0x76b3827df0 ).base.add( 0x2e24 ), 10 ) 0x76b3827e24 - - dis: mov w2, #0x400 0x76b3827e28 - - dis: bl #0x76b3828280 ; 继续拼接转换后的字符串(“android1706154085508”+“4bf227b7d74e5112a02b7f286e169b7d”+“”) 0x76b3827e2c - - dis: movi v0. 2d , #0000000000000000 ; 初始化v0寄存器的两个双精度浮点数为零 0x76b3827e30 - - dis: str q0, [sp, #0x410] ; q0是128位寄存器,使用2条str指令来保存数据 0x76b3827e34 - - dis: str q0, [sp, #0x400] 0x76b3827e38 - - dis: bl #0x76b38282a0 ; libc.so!rand生成随机数 0x76b3827e3c - - dis: mov w8, #0xc8a7 0x76b3827e40 - - dis: movk w8, #0xdd67, lsl #16 0x76b3827e44 - - dis: smull x8, w0, w8 ; w0为rand函数生成的随机数 0x76b3827e48 - - dis: lsr x8, x8, #0x20 8 、跟踪 0x76b38282a0 [Remote::com.moutai.mall ] - > dis(Process.findModuleByAddress( 0x76b3827df0 ).base.add( 0x32A0 ), 10 ) 0x76b38282a0 - - dis: adrp x16, #0x76b3829000 0x76b38282a4 - - dis: ldr x17, [x16, #0x578] 0x76b38282a8 - - dis: add x16, x16, #0x578 0x76b38282ac - - dis: br x17 ; x17 = 0x769254f450 = libc.so!rand 9 、继续回到librand.so向下跟踪 [Remote::com.moutai.mall ] - > dis(Process.findModuleByAddress( 0x76b3a68df0 ).base.add( 0x2E3C ), 249 ) 0x76b3a68e3c - - dis: mov w8, #0xc8a7 0x76b3a68e40 - - dis: movk w8, #0xdd67, lsl #16 ; w8 = 0xdd67c8a7 0x76b3a68e44 - - dis: smull x8, w0, w8 ; x8 = 0x68c1bb6c * 0xdd67c8a7 = 0xf1d7fb6e5541a374 0x76b3a68e48 - - dis: lsr x8, x8, #0x20 ; x8 = 0xF1D7FB6E 0x76b3a68e4c - - dis: add w8, w8, w0 ; w8 = 0x5A99B6DA 0x76b3a68e50 - - dis: asr w9, w8, #5 ; w9 = 0x2D4CDB6 0x76b3a68e54 - - dis: add w8, w9, w8, lsr #31 ; w8 = 0x2D4CDB6 0x76b3a68e58 - - dis: mov w9, #0x25 ; w9 = 0x25 0x76b3a68e5c - - dis: msub w8, w8, w9, w0 ; w8 = 30 0x76b3a68e60 - - dis: adrp x9, #0x76b3a6a000 ; librand.so!0x4000 0x76b3a68e64 - - dis: ldr x9, [x9, #0x528] ; x9 = 0x70d85d65e0 ; 01234567890a 到z的字符串 0x76b3a68e68 - - dis: strb wzr, [sp, #0x401] ; [sp, #0x401] = 0 0x76b3a68e6c - - dis: adrp x1, #0x76b3a66000 0x76b3a68e70 - - dis: add x1, x1, #0xcf2 ; x1 = param1:类路径字符串 0x76b3a68e74 - - dis: ldrb w8, [x9, w8, sxtw] ; w8 = [x9 + w8] = [ 0x76b3a6b5e0 + 0x14 ] = 0x65 = 'A' (w8进行有符号扩展) ; 此处是查表获取随机字符 0x76b3a68e78 - - dis: mov x0, x19 ; x0 = x19 = 0xb4000074be22a170 = param0 = env 0x76b3a68e7c - - dis: strb w8, [sp, #0x400] ; 保存随机字符 0x76b3a68e80 - - dis: ldr x8, [x19] 0x76b3a68e84 - - dis: ldr x8, [x8, #0x30] 0x76b3a68e88 - - dis: blr x8 ; x8 = 0x73fa1d08c8 = libart.so!FindClass(_JNIEnv * , char const * ) 0x76b3a68e8c - - dis: ldr x8, [x19] ; x8 = 0x73fa40ca60 0x76b3a68e90 - - dis: mov x23, x0 ; x23 = x0 = 0xf9 0x76b3a68e94 - - dis: adrp x2, #0x76b3a66000 0x76b3a68e98 - - dis: adrp x3, #0x76b3a66000 0x76b3a68e9c - - dis: ldr x8, [x8, #0x388] ; x8 = 0x73fa1e2a60 0x76b3a68ea0 - - dis: add x2, x2, #0xb80 ; 参数2:方法名 0x76b3a68ea4 - - dis: add x3, x3, #0xc0c ; 参数3:函数签名 0x76b3a68ea8 - - dis: mov x0, x19 ; 参数 0 :env 0x76b3a68eac - - dis: mov x1, x23 ; 参数 1 :jclass 0x76b3a68eb0 - - dis: blr x8 ; libart.so!GetStaticMethodID(_JNIEnv * , _jclass * , char const * , char const * ) 0x76b3a68eb4 - - dis: ldr x8, [x19] 0x76b3a68eb8 - - dis: mov x2, x0 ; jmethodID 0x76b3a68ebc - - dis: mov x0, x19 ; env 0x76b3a68ec0 - - dis: mov x1, x23 ; jclass 0x76b3a68ec4 - - dis: ldr x8, [x8, #0x390] 0x76b3a68ec8 - - dis: blr x8 ; x8 = 0x73fa181d18 = libart.so!CallStaticObjectMethod(_JNIEnv * , _jclass * , _jmethodID * , ...) 0x76b3a68ecc - - dis: mov x21, x0 ; x0 = "1.5.6" 0x76b3a68ed0 - - dis: cbz x0, #0x76b3a68efc 0x76b3a68ed4 - - dis: ldr x8, [x19] 0x76b3a68ed8 - - dis: mov x0, x19 ; env 0x76b3a68edc - - dis: mov x1, x21 ; x1 = 0x105 = jobject = jstring 0x76b3a68ee0 - - dis: mov x2, xzr ; 0 0x76b3a68ee4 - - dis: ldr x8, [x8, #0x548] 0x76b3a68ee8 - - dis: blr x8 ; x8 = 0x73fa228a40 - 0x73f9c00000 = 0x628A40 = libart.so!GetStringUTFChars( int , void * ) 0x76b3a68eec - - dis: mov x1, x0 ; x1 = "1.5.6" 0x76b3a68ef0 - - dis: add x0, sp, #0x428 ; x0 = "android17062349282564bf227b7d74e5112a02b7f286e169b7d" 0x76b3a68ef4 - - dis: mov w2, #0x400 0x76b3a68ef8 - - dis: bl #0x76b3a69280 ; __strcat_chk 接字符串(以下代码由于没有进行拼接字符串操作,直接跳转到 0x76b3a68fbc ,故而忽略直接跳过) 0x76b3a68efc - - dis: ldr x8, [x19] 0x76b3a68f00 - - dis: adrp x2, #0x76b3a66000 0x76b3a68f04 - - dis: adrp x3, #0x76b3a66000 0x76b3a68f08 - - dis: add x2, x2, #0xc8a 0x76b3a68f0c - - dis: ldr x8, [x8, #0x388] 0x76b3a68f10 - - dis: add x3, x3, #0xc0c 0x76b3a68f14 - - dis: mov x0, x19 0x76b3a68f18 - - dis: mov x1, x23 0x76b3a68f1c - - dis: blr x8 0x76b3a68f20 - - dis: ldr x8, [x19] 0x76b3a68f24 - - dis: mov x2, x0 0x76b3a68f28 - - dis: mov x0, x19 0x76b3a68f2c - - dis: mov x1, x23 0x76b3a68f30 - - dis: ldr x8, [x8, #0x390] 0x76b3a68f34 - - dis: blr x8 0x76b3a68f38 - - dis: mov x22, x0 0x76b3a68f3c - - dis: cbz x0, #0x76b3a68f68 0x76b3a68f40 - - dis: ldr x8, [x19] 0x76b3a68f44 - - dis: mov x0, x19 0x76b3a68f48 - - dis: mov x1, x22 0x76b3a68f4c - - dis: mov x2, xzr 0x76b3a68f50 - - dis: ldr x8, [x8, #0x548] 0x76b3a68f54 - - dis: blr x8 0x76b3a68f58 - - dis: adrp x1, #0x76b3a66000 0x76b3a68f5c - - dis: add x1, x1, #0xc90 0x76b3a68f60 - - dis: bl #0x76b3a692d0 0x76b3a68f64 - - dis: cbz w0, #0x76b3a68fbc 直接跳转到 0x76b3a68fbc 0x76b3a68f68 - - dis: adrp x1, #0x76b3a66000 0x76b3a68f6c - - dis: add x1, x1, #0xccb 0x76b3a68f70 - - dis: add x0, sp, #0x428 0x76b3a68f74 - - dis: mov w2, #0x400 0x76b3a68f78 - - dis: bl #0x76b3a69280 0x76b3a68f7c - - dis: add x0, sp, #0x428 0x76b3a68f80 - - dis: add x1, sp, #0x400 0x76b3a68f84 - - dis: mov w2, #1 0x76b3a68f88 - - dis: mov w3, #0x400 0x76b3a68f8c - - dis: bl #0x76b3a692e0 0x76b3a68f90 - - dis: cbz x20, #0x76b3a68fbc 0x76b3a68f94 - - dis: ldr x8, [x19] 0x76b3a68f98 - - dis: mov x0, x19 0x76b3a68f9c - - dis: mov x1, x20 0x76b3a68fa0 - - dis: mov x2, xzr 0x76b3a68fa4 - - dis: ldr x8, [x8, #0x548] 0x76b3a68fa8 - - dis: blr x8 0x76b3a68fac - - dis: mov x1, x0 0x76b3a68fb0 - - dis: add x0, sp, #0x428 0x76b3a68fb4 - - dis: mov w2, #0x400 0x76b3a68fb8 - - dis: bl #0x76b3a69280 行字符串拼接,再次忽略 0x76b3a68fbc - - dis: ldr x8, [x19] 0x76b3a68fc0 - - dis: adrp x2, #0x76b3a66000 0x76b3a68fc4 - - dis: adrp x3, #0x76b3a66000 0x76b3a68fc8 - - dis: add x2, x2, #0xd0a 0x76b3a68fcc - - dis: ldr x8, [x8, #0x388] 0x76b3a68fd0 - - dis: add x3, x3, #0xc0c 0x76b3a68fd4 - - dis: mov x0, x19 0x76b3a68fd8 - - dis: mov x1, x23 0x76b3a68fdc - - dis: blr x8 0x76b3a68fe0 - - dis: ldr x8, [x19] 0x76b3a68fe4 - - dis: mov x2, x0 0x76b3a68fe8 - - dis: mov x0, x19 0x76b3a68fec - - dis: mov x1, x23 0x76b3a68ff0 - - dis: ldr x8, [x8, #0x390] 0x76b3a68ff4 - - dis: blr x8 0x76b3a68ff8 - - dis: mov x23, x0 0x76b3a68ffc - - dis: cbz x0, #0x76b3a69050 0x76b3a69000 - - dis: ldr x8, [x19] 0x76b3a69004 - - dis: mov x0, x19 0x76b3a69008 - - dis: mov x1, x23 0x76b3a6900c - - dis: mov x2, xzr 0x76b3a69010 - - dis: ldr x8, [x8, #0x548] 0x76b3a69014 - - dis: blr x8 0x76b3a69018 - - dis: adrp x1, #0x76b3a66000 0x76b3a6901c - - dis: add x1, x1, #0xcd1 0x76b3a69020 - - dis: bl #0x76b3a692d0 0x76b3a69024 - - dis: cbz w0, #0x76b3a690a4 ; 跟踪此处跳转地址继续分析 0x76b3a69028 - - dis: ldr x8, [x19] 0x76b3a6902c - - dis: mov x0, x19 0x76b3a69030 - - dis: mov x1, x23 0x76b3a69034 - - dis: mov x2, xzr 0x76b3a69038 - - dis: ldr x8, [x8, #0x548] 0x76b3a6903c - - dis: blr x8 0x76b3a69040 - - dis: adrp x1, #0x76b3a66000 0x76b3a69044 - - dis: add x1, x1, #0xbeb 0x76b3a69048 - - dis: bl #0x76b3a692d0 0x76b3a6904c - - dis: cbz w0, #0x76b3a690a4 0x76b3a69050 - - dis: adrp x1, #0x76b3a66000 0x76b3a69054 - - dis: add x1, x1, #0xccb 0x76b3a69058 - - dis: add x0, sp, #0x428 0x76b3a6905c - - dis: mov w2, #0x400 0x76b3a69060 - - dis: bl #0x76b3a69280 0x76b3a69064 - - dis: add x0, sp, #0x428 0x76b3a69068 - - dis: add x1, sp, #0x400 0x76b3a6906c - - dis: mov w2, #1 0x76b3a69070 - - dis: mov w3, #0x400 0x76b3a69074 - - dis: bl #0x76b3a692e0 0x76b3a69078 - - dis: cbz x20, #0x76b3a690a4 0x76b3a6907c - - dis: ldr x8, [x19] 0x76b3a69080 - - dis: mov x0, x19 0x76b3a69084 - - dis: mov x1, x20 0x76b3a69088 - - dis: mov x2, xzr 0x76b3a6908c - - dis: ldr x8, [x8, #0x548] 0x76b3a69090 - - dis: blr x8 0x76b3a69094 - - dis: mov x1, x0 0x76b3a69098 - - dis: add x0, sp, #0x428 0x76b3a6909c - - dis: mov w2, #0x400 0x76b3a690a0 - - dis: bl #0x76b3a69280 0x76b3a690a4 - - dis: ldr x8, [x19] 0x76b3a690a8 - - dis: mov x0, x19 0x76b3a690ac - - dis: mov x1, x22 0x76b3a690b0 - - dis: ldr x8, [x8, #0xb8] 0x76b3a690b4 - - dis: blr x8 ; DeleteLocalRef(_JNIEnv * , _jobject * ) 0x76b3a690b8 - - dis: ldr x8, [x19] 0x76b3a690bc - - dis: mov x0, x19 0x76b3a690c0 - - dis: mov x1, x23 0x76b3a690c4 - - dis: ldr x8, [x8, #0xb8] 0x76b3a690c8 - - dis: blr x8 ; DeleteLocalRef(_JNIEnv * , _jobject * ) 0x76b3a690cc - - dis: ldr x8, [x19] 0x76b3a690d0 - - dis: mov x0, x19 0x76b3a690d4 - - dis: mov x1, x21 0x76b3a690d8 - - dis: ldr x8, [x8, #0xb8] 0x76b3a690dc - - dis: blr x8 ; DeleteLocalRef(_JNIEnv * , _jobject * ) 0x76b3a690e0 - - dis: add x0, sp, #0x428 ; x0 = "android17062349282564bf227b7d74e5112a02b7f286e169b7d1.5.6" 0x76b3a690e4 - - dis: mov w1, #0x400 0x76b3a690e8 - - dis: bl #0x76b3a692f0 ; 0x76b3a692f0 - 0x76b3a66000 = 0x32f0 = libc.so!__strlen_chk 0x76b3a690ec - - dis: cbz x0, #0x76b3a69170 ; x0 = 0x39 0x76b3a690f0 - - dis: add x0, sp, #0x428 0x76b3a690f4 - - dis: mov w1, #0x400 0x76b3a690f8 - - dis: add x20, sp, #0x428 0x76b3a690fc - - dis: bl #0x76b3a692f0 0x76b3a69100 - - dis: cmp w0, #2 0x76b3a69104 - - dis: b.lt #0x76b3a69170 ; 不跳转 0x76b3a69108 - - dis: sub w9, w0, #1 ; w9 = strlen - 1 0x76b3a6910c - - dis: mov w8, wzr ; w8 = 0 0x76b3a69110 - - dis: orr x10, x20, #1 ; x10 = 0x7ff7240cc9 0x76b3a69114 - - dis: mov w11, w9 ; x11 = w9 = 0x38 0x76b3a69118 - - dis: b #0x76b3a6912c 0x76b3a6911c - - dis: add w8, w8, #1 0x76b3a69120 - - dis: cmp w8, w9 0x76b3a69124 - - dis: sub w11, w11, #1 0x76b3a69128 - - dis: b.eq #0x76b3a69170 ; 冒泡排序 从小到大 0x76b3a6912c - - dis: cmp w9, w8 0x76b3a69130 - - dis: mov w11, w11 0x76b3a69134 - - dis: b.le #0x76b3a6911c ; strlen <= 0 时跳转 0x76b3a69138 - - dis: ldrb w12, [sp, #0x428] ; w12 = 0x2e = '.' 0x76b3a6913c - - dis: mov x13, x11 ; x13 = 38 0x76b3a69140 - - dis: mov x14, x10 ; x14 = 0x7ff7240f29 0x76b3a69144 - - dis: b #0x76b3a6915c 0x76b3a69148 - - dis: sturb w15, [x14, #-1] 0x76b3a6914c - - dis: strb w12, [x14] 0x76b3a69150 - - dis: subs x13, x13, #1 0x76b3a69154 - - dis: add x14, x14, #1 0x76b3a69158 - - dis: b.eq #0x76b3a6911c 0x76b3a6915c - - dis: ldrb w15, [x14] ; w15 = 0x6e = 'android17062349282564bf227b7d74e5112a02b7f286e169b7d1.5.6' 0x76b3a69160 - - dis: cmp w15, w12, uxtb 0x76b3a69164 - - dis: b.lo #0x76b3a69148 0x76b3a69168 - - dis: mov w12, w15 0x76b3a6916c - - dis: b #0x76b3a69150 0x76b3a69170 - - dis: add x0, sp, #0x428 ; 目标("..0001111111222222244555666667777778899aabbbbddddeeffinor") 0x76b3a69174 - - dis: add x1, sp, #0x400 ; 随机字符 0x76b3a69178 - - dis: mov w2, #1 ; 长度 0x76b3a6917c - - dis: mov w3, #0x400 0x76b3a69180 - - dis: bl #0x76b3a692e0 ; __strncat_chk 0x76b3a69184 - - dis: add x0, sp, #0x428 0x76b3a69188 - - dis: bl #0x76b3a69300 ; dis(Process.findModuleByAddress(0x76b3a692f0).base.add(0x2A74), 10) ; 进行MD5加密 0x76b3a6918c - - dis: mov x20, x0 ; x20 = x0 = 返回值 0x76b3a69190 - - dis: bl #0x76b3a692b0 ; __strlen_aarch64(unsigned __int64) 0x76b3a69194 - - dis: cmp x0, #0x1b 0x76b3a69198 - - dis: b.lo #0x76b3a691e0 0x76b3a6919c - - dis: mov x0, sp ; 需要设置的缓冲区 0x76b3a691a0 - - dis: mov w2, #0x400 ; 长度 0x76b3a691a4 - - dis: mov w1, wzr ; 设置为零 0x76b3a691a8 - - dis: bl #0x76b3a692c0 ; memset 0x76b3a691ac - - dis: mov x0, sp ; 0x7fdf6e5860 0x76b3a691b0 - - dis: mov w2, #0x1a ; w2 = 0x1a = 26 0x76b3a691b4 - - dis: mov x1, x20 ; x1 = 0xb400006e6eee0dd0 0x76b3a691b8 - - dis: bl #0x76b3a69310 ; strncpy 0x76b3a691bc - - dis: mov x0, sp ; 5da9948171cae1e4a3158fef40 0x76b3a691c0 - - dis: add x1, sp, #0x400 ; 随机字符 0x76b3a691c4 - - dis: mov w2, #1 ; 长度 0x76b3a691c8 - - dis: mov w3, #0x400 0x76b3a691cc - - dis: bl #0x76b3a692e0 ; __strncat_chk 0x76b3a691d0 - - dis: ldr x8, [x19] 0x76b3a691d4 - - dis: mov x1, sp 0x76b3a691d8 - - dis: mov x0, x19 0x76b3a691dc - - dis: b #0x76b3a691ec 0x76b3a691e0 - - dis: ldr x8, [x19] 0x76b3a691e4 - - dis: mov x0, x19 0x76b3a691e8 - - dis: mov x1, x20 0x76b3a691ec - - dis: ldr x8, [x8, #0x538] 0x76b3a691f0 - - dis: blr x8 ; _ZN3art27JniNativeInterfaceFunctionsILb0EE19gJniNativeInterfaceE ; 读取JNI环境结构体指针 0x76b3a691f4 - - dis: ldr x8, [x24, #0x28] 0x76b3a691f8 - - dis: ldur x9, [x29, #-8] 0x76b3a691fc - - dis: cmp x8, x9 0x76b3a69200 - - dis: b.ne #0x76b3a69220 ; 不跳转 0x76b3a69204 - - dis: add sp, sp, #0x830 0x76b3a69208 - - dis: ldp x20, x19, [sp, #0x40] 0x76b3a6920c - - dis: ldp x22, x21, [sp, #0x30] 0x76b3a69210 - - dis: ldp x24, x23, [sp, #0x20] 0x76b3a69214 - - dis: ldr x28, [sp, #0x10] 0x76b3a69218 - - dis: ldp x29, x30, [sp], #0x50 0x76b3a6921c - - dis: ret ; 相对偏移 0x321C 10 、hook __strncat_chk,进行了两次合并操作,第二次合并后长度 27 位,疑似为最终的mt - v __strncat_chk(arg_0 = 0x7ff7240fd8 (.. 0001111111222222244555666667777778899aabbbbddddeeffinor ), arg_1 = 0x7ff7240fb0 (b), arg_2 = 0x1 , arg_3 = 0x400 ) LR: 0x76b3a69184 PC: 0x769256e8a0 SP: 0x7ff7240bb0 __strncat_chk(arg_0 = 0x7ff7240bb0 (cad78ff005c51a040c445be04e), arg_1 = 0x7ff7240fb0 (b), arg_2 = 0x1 , arg_3 = 0x400 ) LR: 0x76b3a691d0 PC: 0x769256e8a0 SP: 0x7ff7240bb0 11 、关键算法分析 [Remote::com.moutai.mall ] - > dis(Process.findModuleByAddress( 0x76a84d3df0 ).base.add( 0x2A74 ), 30 ) 0x76a84d3a74 - - dis: sub sp, sp, #0xb0 0x76a84d3a78 - - dis: stp x29, x30, [sp, #0x80] ; 存储x29,x30到sp+0x80处 0x76a84d3a7c - - dis: str x21, [sp, #0x90] ; 存储x21到sp+0x90处 0x76a84d3a80 - - dis: stp x20, x19, [sp, #0xa0] 0x76a84d3a84 - - dis: add x29, sp, #0x80 ; 清理堆栈 0x76a84d3a88 - - dis: mrs x20, tpidr_el0 ; 将当前线程的TLS基址从系统寄存器tpidr_e10存储到x20中,TLS基址通常用于访问线程局部存储区域 0x76a84d3a8c - - dis: adrp x8, #0x76a84d1000 0x76a84d3a90 - - dis: adrp x9, #0x76a84d1000 0x76a84d3a94 - - dis: ldr x10, [x20, #0x28] ; 读取TLS线程特定数据 0x76a84d3a98 - - dis: ldr q0, [x8, #0xe20] ; q0:128位SIMD寄存器 0x76a84d3a9c - - dis: ldr d1, [x9, #0xe30] ; dl:8位通用寄存器 0x76a84d3aa0 - - dis: mov x19, x0 0x76a84d3aa4 - - dis: stur x10, [x29, #-8] ; [x29 - 8] = x10 = [x20 + 0x28] = 线程数据 0x76a84d3aa8 - - dis: str q0, [sp] 0x76a84d3aac - - dis: str d1, [sp, #0x10] 0x76a84d3ab0 - - dis: bl #0x76a84d42b0 ; _strlen_aarch64(unsigned __int64) 0x76a84d3ab4 - - dis: mov x2, x0 ; x2 = 0x3a = 58 0x76a84d3ab8 - - dis: mov x0, sp ; 栈地址 0x76a84d3abc - - dis: mov x1, x19 ; 0x7ff7240b98 0x76a84d3ac0 - - dis: bl #0x76a84d4340 ; librand.so!1d94(此函数被调用3次,第一次只做内存拷贝,把x1地址的内容按x2的长度拷贝到x0,另在librand.so!0x1e7c中进行了大量运算) 0x76a84d3ac4 - - dis: ldp w8, w11, [sp] 0x76a84d3ac8 - - dis: adrp x1, #0x76a84d5000 ; #0x76a84d5000 = librand.so!0x4000(动态) 0x76a84d3acc - - dis: mov w9, #0x78 0x76a84d3ad0 - - dis: mov w10, #0x38 0x76a84d3ad4 - - dis: stp w8, w11, [x29, #-0x10] 0x76a84d3ad8 - - dis: ubfx w12, w8, #3, #6 ; 从w8寄存器的第3位开始,取6位值放入w12,w12 = 0x3a 0x76a84d3adc - - dis: ldr x1, [x1, #0x530] ; x1 = 0x76a84d6650 0x76a84d3ae0 - - dis: cmp w12, #0x38 0x76a84d3ae4 - - dis: csel w9, w10, w9, lo ; w9 = 0x78 0x76a84d3ae8 - - dis: sub w2, w9, w12 ; w2 = 0x3e 0x76a84d3aec - - dis: mov x0, sp 0x76a84d3af0 - - dis: bl #0x76a84d4340 ; 第二次初始化一片0x3e大小的内存 0x76a84d3af4 - - dis: mov x0, sp 0x76a84d3af8 - - dis: sub x1, x29, #0x10 0x76a84d3afc - - dis: mov w2, #8 0x76a84d3b00 - - dis: bl #0x76a84d4340 ; 第三次 0x76a84d3b04 - - dis: ldr w21, [sp, #8] ; 冒泡排序后的字符串 0x76a84d3b08 - - dis: ldur x8, [sp, #0xc] 0x76a84d3b0c - - dis: ldr w9, [sp, #0x14] 0x76a84d3b10 - - dis: mov w0, #0x21 ; 新分配内存长度 0x76a84d3b14 - - dis: stur w21, [x29, #-0x20] 0x76a84d3b18 - - dis: stur x8, [x29, #-0x1c] 0x76a84d3b1c - - dis: stur w9, [x29, #-0x14] 0x76a84d3b20 - - dis: bl #0x76a84d4350 ; malloc(scudo *a1) 0x76a84d3b24 - - dis: movi v0. 2d , #0000000000000000 0x76a84d3b28 - - dis: and w3, w21, #0xff ; w3 = 0xd 0x76a84d3b2c - - dis: mov x1, #-1 ; x1 = -1 = 0xffffffffffffffff 0x76a84d3b30 - - dis: mov x19, x0 ; x19 = x0 = 0xb400007a26c90850 0x76a84d3b34 - - dis: strb wzr, [x0, #0x20] ; 新内存len-1 = 0 0x76a84d3b38 - - dis: stp q0, q0, [x0] 0x76a84d3b3c - - dis: bl #0x76a84d3ca0 0x76a84d3b40 - - dis: ldurb w3, [x29, #-0x1f] 0x76a84d3b44 - - dis: sxtw x21, w0 0x76a84d3b48 - - dis: add x0, x19, x21 0x76a84d3b4c - - dis: mov x1, #-1 0x76a84d3b50 - - dis: bl #0x76a84d3ca0 0x76a84d3b54 - - dis: ldurb w3, [x29, #-0x1e] 0x76a84d3b58 - - dis: add x21, x21, w0, sxtw 0x76a84d3b5c - - dis: add x0, x19, x21 0x76a84d3b60 - - dis: mov x1, #-1 0x76a84d3b64 - - dis: bl #0x76a84d3ca0 0x76a84d3b68 - - dis: ldurb w3, [x29, #-0x1d] 0x76a84d3b6c - - dis: add w21, w0, w21 0x76a84d3b70 - - dis: add x0, x19, w21, sxtw 0x76a84d3b74 - - dis: mov x1, #-1 0x76a84d3b78 - - dis: bl #0x76a84d3ca0 0x76a84d3b7c - - dis: ldurb w3, [x29, #-0x1c] 0x76a84d3b80 - - dis: add w21, w0, w21 0x76a84d3b84 - - dis: add x0, x19, w21, sxtw 0x76a84d3b88 - - dis: mov x1, #-1 0x76a84d3b8c - - dis: bl #0x76a84d3ca0 0x76a84d3b90 - - dis: ldurb w3, [x29, #-0x1b] 0x76a84d3b94 - - dis: add w21, w0, w21 0x76a84d3b98 - - dis: add x0, x19, w21, sxtw 0x76a84d3b9c - - dis: mov x1, #-1 0x76a84d3ba0 - - dis: bl #0x76a84d3ca0 0x76a84d3ba4 - - dis: ldurb w3, [x29, #-0x1a] 0x76a84d3ba8 - - dis: add w21, w0, w21 0x76a84d3bac - - dis: add x0, x19, w21, sxtw 0x76a84d3bb0 - - dis: mov x1, #-1 0x76a84d3bb4 - - dis: bl #0x76a84d3ca0 0x76a84d3bb8 - - dis: ldurb w3, [x29, #-0x19] 0x76a84d3bbc - - dis: add w21, w0, w21 0x76a84d3bc0 - - dis: add x0, x19, w21, sxtw 0x76a84d3bc4 - - dis: mov x1, #-1 0x76a84d3bc8 - - dis: bl #0x76a84d3ca0 0x76a84d3bcc - - dis: ldurb w3, [x29, #-0x18] 0x76a84d3bd0 - - dis: add w21, w0, w21 0x76a84d3bd4 - - dis: add x0, x19, w21, sxtw 0x76a84d3bd8 - - dis: mov x1, #-1 0x76a84d3bdc - - dis: bl #0x76a84d3ca0 0x76a84d3be0 - - dis: ldurb w3, [x29, #-0x17] 0x76a84d3be4 - - dis: add w21, w0, w21 0x76a84d3be8 - - dis: add x0, x19, w21, sxtw 0x76a84d3bec - - dis: mov x1, #-1 0x76a84d3bf0 - - dis: bl #0x76a84d3ca0 0x76a84d3bf4 - - dis: ldurb w3, [x29, #-0x16] 0x76a84d3bf8 - - dis: add w21, w0, w21 0x76a84d3bfc - - dis: add x0, x19, w21, sxtw 0x76a84d3c00 - - dis: mov x1, #-1 0x76a84d3c04 - - dis: bl #0x76a84d3ca0 0x76a84d3c08 - - dis: ldurb w3, [x29, #-0x15] 0x76a84d3c0c - - dis: add w21, w0, w21 0x76a84d3c10 - - dis: add x0, x19, w21, sxtw 0x76a84d3c14 - - dis: mov x1, #-1 0x76a84d3c18 - - dis: bl #0x76a84d3ca0 0x76a84d3c1c - - dis: ldurb w3, [x29, #-0x14] 0x76a84d3c20 - - dis: add w21, w0, w21 0x76a84d3c24 - - dis: add x0, x19, w21, sxtw 0x76a84d3c28 - - dis: mov x1, #-1 0x76a84d3c2c - - dis: bl #0x76a84d3ca0 0x76a84d3c30 - - dis: ldurb w3, [x29, #-0x13] 0x76a84d3c34 - - dis: add w21, w0, w21 0x76a84d3c38 - - dis: add x0, x19, w21, sxtw 0x76a84d3c3c - - dis: mov x1, #-1 0x76a84d3c40 - - dis: bl #0x76a84d3ca0 0x76a84d3c44 - - dis: ldurb w3, [x29, #-0x12] 0x76a84d3c48 - - dis: add w21, w0, w21 0x76a84d3c4c - - dis: add x0, x19, w21, sxtw 0x76a84d3c50 - - dis: mov x1, #-1 0x76a84d3c54 - - dis: bl #0x76a84d3ca0 0x76a84d3c58 - - dis: ldurb w3, [x29, #-0x11] 0x76a84d3c5c - - dis: add w21, w0, w21 0x76a84d3c60 - - dis: add x0, x19, w21, sxtw 0x76a84d3c64 - - dis: mov x1, #-1 0x76a84d3c68 - - dis: bl #0x76a84d3ca0 0x76a84d3c6c - - dis: add w8, w0, w21 0x76a84d3c70 - - dis: strb wzr, [x19, w8, sxtw] 0x76a84d3c74 - - dis: ldr x8, [x20, #0x28] 0x76a84d3c78 - - dis: ldur x9, [x29, #-8] 0x76a84d3c7c - - dis: cmp x8, x9 0x76a84d3c80 - - dis: b.ne #0x76a84d3c9c 0x76a84d3c84 - - dis: mov x0, x19 0x76a84d3c88 - - dis: ldp x20, x19, [sp, #0xa0] 0x76a84d3c8c - - dis: ldr x21, [sp, #0x90] 0x76a84d3c90 - - dis: ldp x29, x30, [sp, #0x80] 0x76a84d3c94 - - dis: add sp, sp, #0xb0 0x76a84d3c98 - - dis: ret 0x76a84d3c9c - - dis: bl #0x76a84d4290 0x76a84d3ca0 - - dis: sub sp, sp, #0x120 0x76a84d3ca4 - - dis: stp x29, x30, [sp, #0x100] 0x76a84d3ca8 - - dis: stp x28, x19, [sp, #0x110] 0x76a84d3cac - - dis: add x29, sp, #0x100 0x76a84d3cb0 - - dis: stp x3, x4, [x29, #-0x78] 0x76a84d3cb4 - - dis: stp x5, x6, [x29, #-0x68] 0x76a84d3cb8 - - dis: stur x7, [x29, #-0x58] 0x76a84d3cbc - - dis: stp q1, q2, [sp, #0x10] 0x76a84d3cc0 - - dis: stp q3, q4, [sp, #0x30] 0x76a84d3cc4 - - dis: str q0, [sp] 0x76a84d3cc8 - - dis: stp q5, q6, [sp, #0x50] 0x76a84d3ccc - - dis: str q7, [sp, #0x70] 0x76a84d3cd0 - - dis: mrs x19, tpidr_el0 0x76a84d3cd4 - - dis: ldr x9, [x19, #0x28] 0x76a84d3cd8 - - dis: mov x10, #-0x28 0x76a84d3cdc - - dis: mov x11, sp 0x76a84d3ce0 - - dis: sub x12, x29, #0x78 ; x12 = 0x7fc6088850 - 0x78 0x76a84d3ce4 - - dis: movk x10, #0xff80, lsl #32 0x76a84d3ce8 - - dis: stur x9, [x29, #-8] ; x9 = x29 - 8 = 0x7fc6088850 - 8 = 0x7FC6088848 0x76a84d3cec - - dis: add x9, x29, #0x20 0x76a84d3cf0 - - dis: add x11, x11, #0x80 0x76a84d3cf4 - - dis: add x12, x12, #0x28 0x76a84d3cf8 - - dis: sub x8, x29, #0x28 0x76a84d3cfc - - dis: stp x11, x10, [x29, #-0x18] 0x76a84d3d00 - - dis: stp x9, x12, [x29, #-0x28] 0x76a84d3d04 - - dis: ldp q0, q1, [x8] 0x76a84d3d08 - - dis: adrp x3, #0x76a84d1000 0x76a84d3d0c - - dis: mov x2, x1 ; size 0x76a84d3d10 - - dis: add x3, x3, #0xc21 ; format 0x76a84d3d14 - - dis: sub x4, x29, #0x50 ; 参数列表 0x76a84d3d18 - - dis: mov w1, wzr ; flag 0x76a84d3d1c - - dis: stp q0, q1, [x29, #-0x50] 0x76a84d3d20 - - dis: bl #0x76a84d4360 ; _vsprintf_chk 0x76a84d3d24 - - dis: ldr x8, [x19, #0x28] 0x76a84d3d28 - - dis: ldur x9, [x29, #-8] 0x76a84d3d2c - - dis: cmp x8, x9 0x76a84d3d30 - - dis: b.ne #0x76a84d3d44 ; 不跳转 0x76a84d3d34 - - dis: ldp x28, x19, [sp, #0x110] 0x76a84d3d38 - - dis: ldp x29, x30, [sp, #0x100] 0x76a84d3d3c - - dis: add sp, sp, #0x120 0x76a84d3d40 - - dis: ret 12 、跟踪进入librand.so! 1d94 [Remote::com.moutai.mall ] - > dis(Process.findModuleByAddress( 0x76a84d3df0 ).base.add( 0x1d94 ), 30 ) 0x76a84d2d94 - - dis: stp x29, x30, [sp, #-0x50]! 0x76a84d2d98 - - dis: str x25, [sp, #0x10] 0x76a84d2d9c - - dis: stp x24, x23, [sp, #0x20] 0x76a84d2da0 - - dis: stp x22, x21, [sp, #0x30] 0x76a84d2da4 - - dis: stp x20, x19, [sp, #0x40] 0x76a84d2da8 - - dis: mov x29, sp 0x76a84d2dac - - dis: ldp w9, w8, [x0] ; 此函数被调用 3 次,第一次w8,w9均为零,第二次w9 = 0x1d0 ,w8 = 0 ,第三次w9 = 3c0 ,w8 = 0 0x76a84d2db0 - - dis: mov w10, #0x40 0x76a84d2db4 - - dis: mov w19, w2 ; 第一次:x19 = 0x3a ,第二次:x19 = 0x3e ,第三次:x19 = 0x8 0x76a84d2db8 - - dis: mov x20, x1 ; 第一次:x20 = 0x7ff7240aa8 ,第二次:x20 = 0x76a84d6650 ,第三次:x20 = 0x7ff7240640 0x76a84d2dbc - - dis: ubfx x25, x9, #3, #6 0x76a84d2dc0 - - dis: mov x21, x0 0x76a84d2dc4 - - dis: adds w9, w9, w2, lsl #3 ; x9 = 0x1d0,x9 = 0x1f0 + 0x1d0 = 0x3c0 0x76a84d2dc8 - - dis: sub w22, w10, w25 ; 第一次:x25 = 0 ,第二次:x25 = 0x3a ,第三次:x25 = 0x38 0x76a84d2dcc - - dis: str w9, [x0] 0x76a84d2dd0 - - dis: b.lo #0x76a84d2ddc 0x76a84d2dd4 - - dis: add w8, w8, #1 0x76a84d2dd8 - - dis: str w8, [x21, #4] 0x76a84d2ddc - - dis: add w8, w8, w19, lsr #29 ; w8 = 0 0x76a84d2de0 - - dis: cmp w22, w19 ; 第一次:w22 = 0x40 ,w19 = 3a ,第二次:w22 = 0x6 ,w19 = 0x3e ,第三次:w22 = 0x8 ,w19 = 0x8 0x76a84d2de4 - - dis: str w8, [x21, #4] 0x76a84d2de8 - - dis: b.ls #0x76a84d2df4 0x76a84d2dec - - dis: mov w22, wzr 0x76a84d2df0 - - dis: b #0x76a84d2e50 0x76a84d2df4 - - dis: add x24, x21, #0x18 ; x24 = 0x7ff72408d8 0x76a84d2df8 - - dis: add x0, x24, x25 ; 第一次:x0 = x24 + 0x3a ,第二次:x0 = x24 + 0x38 0x76a84d2dfc - - dis: mov x1, x20 ; 第一次:x1 = 0x76b389e650 ( 80 00 00 00 00 00 ),第二次:x1 = 0x7ff7240930 (D0 01 00 00 00 00 00 00 ) 0x76a84d2e00 - - dis: mov x2, x22 ; 第一次:x2 = 0x6 ,第二次:x2 = 0x8 0x76a84d2e04 - - dis: bl #0x76a84d4320 ; memmove 0x76a84d2e08 - - dis: add x23, x21, #8 0x76aae01e0c - - dis: mov x0, x23 ; 0x7ff7240778 0x76aae01e10 - - dis: mov x1, x24 ; 0x7ff7240788 0x76aae01e14 - - dis: bl #0x76aae03330 ; dis(Process.findModuleByAddress(0x76aae01e0c).base.add(0x1e7c), 60) 0x76aae01e18 - - dis: mov w8, #0x80 0x76aae01e1c - - dis: sub w8, w8, w25 ; 第一次:w25 = 0x3a ,第二次:w25 = 0x38 0x76aae01e20 - - dis: cmp w8, w19 ; 第一次:w19 = 0x3e ,第二次:w19 = 0x8 0x76aae01e24 - - dis: b.hi #0x76aae01e4c ; 两次都跳转 0x76aae01e28 - - dis: mov w8, #0x40 0x76aae01e2c - - dis: sub w22, w8, w25 0x76aae01e30 - - dis: add x1, x20, w22, uxtw 0x76aae01e34 - - dis: mov x0, x23 0x76aae01e38 - - dis: bl #0x76aae03330 0x76aae01e3c - - dis: add w8, w22, #0x80 0x76aae01e40 - - dis: cmp w8, w19 0x76aae01e44 - - dis: add w22, w22, #0x40 0x76aae01e48 - - dis: b.ls #0x76aae01e30 0x76aae01e4c - - dis: mov x25, xzr 0x76a84d2e50 - - dis: add x8, x21, x25 0x76a84d2e54 - - dis: add x1, x20, w22, uxtw ; 源地址 0x76a84d2e58 - - dis: add x0, x8, #0x18 ; 目标地址 0x76a84d2e5c - - dis: sub w2, w19, w22 ; 长度 0x76a84d2e60 - - dis: bl #0x76a84d4320 ; memmove 0x76a84d2e64 - - dis: ldp x20, x19, [sp, #0x40] 0x76a84d2e68 - - dis: ldp x22, x21, [sp, #0x30] 0x76a84d2e6c - - dis: ldp x24, x23, [sp, #0x20] 0x76a84d2e70 - - dis: ldr x25, [sp, #0x10] 0x76a84d2e74 - - dis: ldp x29, x30, [sp], #0x50 0x76a84d2e78 - - dis: ret |