Android逆向之旅—脱壳：Frida脱壳实战.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "0d0a47ee",
   "metadata": {},
   "source": [
    "# Frida脱壳实战\n",
    "[android内核集成Frida,Android安全指南 之 Frida脱壳实战](https://blog.csdn.net/weixin_29887351/article/details/117732908)  \n",
    "[基于Frida的脱壳工具frida-unpack](https://github.com/dstmath/frida-unpack)  \n",
    "\n",
    "\n",
    "\n",
    "\n",
    "## 一、Frida技术原理\n",
    "　　Android脱壳的目的是从内存中dump下解密的应用dex文件，为了实现这个目的我们需要知道dex文件在内存中dex地址与dex文件大小。Android系统的libart.so库文件中提供了一个导出的OpenMemory函数用来加载dex文件。  \n",
    "![OpenMemory函数](./images/Frida脱壳实战-OpenMemory.png)   \n",
    "　　这个函数的第一个参数指向了内存中的dex文件，如果我们可以Hook 这个函数，就可以得到dex文件加载进内存时的起始地址，再根据dex文件格式计算得到文件头保存的dex文件的长度fileSize。   \n",
    "　　根据dex文件格式，从起始位置开始第32个字节是该dex文件的大小，知道dex起始位置和整个文件的大小，只是要把这段内存dump出来即可。实用与安卓6、7、8、9。\n",
    "\n",
    "## 二、获取函数签名\n",
    "### 2.1、方法一\n",
    "　　在编写Frida脚本之前我们需要在libart.so文件中找到OpenMemory的函数签名，这个签名根据android版本或者架构的不同会有些许差异，下面介绍如何从运行待脱壳应用的设备中提取libart.so文件：\n",
    "```shell\n",
    "$ adb pull /system/lib/libart.so /本地目录\n",
    "$ adb pull /system/lib64/libart.so /本地目录\n",
    "```\n",
    "　　获取libart.so文件后有两个方法可以获得函数签名，第一种是利用IDA pro 分析so文件，搜索OpenMemory函数：\n",
    "![IDA获取函数签名](./images/Frida脱壳实战-获取函数签名.png)\n",
    "### 2.2、方法二\n",
    "　　在linux系统下使用nm命令直接查看libart.so文件的函数签名：\n",
    "```shell\n",
    "$\n",
    "$ nm libart.so | grep OpenMemory\n",
    "```\n",
    "![linux获取函数签名](./images/Frida脱壳实战-Linux获取函数签名.png)\n",
    "\n",
    "## 三、编写脚本\n",
    "\n",
    "　　Frida可以执行js脚本也可以执行python脚本：\n",
    "### 3.1、JS脚本\n",
    "```js\n",
    "'use strict';\n",
    "/**\n",
    " * 此脚本在以下环境测试通过\n",
    " * android os: 7.1.2 32bit  (64位可能要改OpenMemory的签名)\n",
    " * legu: libshella-2.8.so\n",
    " * 360:libjiagu.so\n",
    " */\n",
    "Interceptor.attach(Module.findExportByName(\"libart.so\", \"_ZN3art7DexFile10OpenMemoryEPKhjRKNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEEjPNS_6MemMapEPKNS_10OatDexFileEPS9_\"), {\n",
    "    onEnter: function (args) {\n",
    "      \n",
    "        //dex起始位置\n",
    "        var begin = args[1]\n",
    "        //打印magic\n",
    "        console.log(\"magic : \" + Memory.readUtf8String(begin))\n",
    "        //dex fileSize 地址： \n",
    "        var address = parseInt(begin,16) + 0x20    //因为dex文件的第三十二个字节处存放的dex文件的大小\n",
    "        //dex 大小\n",
    "        var dex_size = Memory.readInt(ptr(address))   //ptr(address)转换的原因是frida只接受NativePointer类型指针\n",
    "\n",
    "        console.log(\"dex_size :\" + dex_size)\n",
    "        //dump dex 到/data/data/pkg/目录下\n",
    "        var file = new File(\"/data/data/xxx.xxx.xxx/\" + dex_size + \".dex\", \"wb\")\n",
    "        file.write(Memory.readByteArray(begin, dex_size))\n",
    "        file.flush()\n",
    "        file.close()\n",
    "    },\n",
    "    onLeave: function (retval) {\n",
    "        if (retval.toInt32() > 0) {\n",
    "            /* do something */\n",
    "        }\n",
    "    }\n",
    "});\n",
    "```\n",
    "### 3.2、Python脚本\n",
    "```python\n",
    "#-*- coding:utf-8 -*-\n",
    "# coding=utf-8\n",
    "import frida\n",
    "import sys\n",
    "\n",
    "def on_message(message, data):\n",
    "    base = message['payload']['base']\n",
    "    size = int(message['payload']['size'])\n",
    "    print(hex(base),size)\n",
    "    # print session\n",
    "    # dex_bytes = session.read_bytes(base, size)\n",
    "    # f = open(\"1.dex\",\"wb\")\n",
    "    # f.write(dex_bytes)\n",
    "    # f.close()\n",
    "\n",
    "# 9.0 arm 需要拦截　_ZN3art13DexFileLoader10OpenCommonEPKhjS2_jRKNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEEjPKNS_10OatDexFileEbbPS9_NS3_10unique_ptrINS_16DexFileContainerENS3_14default_deleteISH_EEEEPNS0_12VerifyResultE\n",
    "# 7.0 arm：_ZN3art7DexFile10OpenMemoryEPKhjRKNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEEjPNS_6MemMapEPKNS_10OatDexFileEPS9_\n",
    "\n",
    "# android 10: libdexfile.so \n",
    "# #_ZN3art13DexFileLoader10OpenCommonEPKhjS2_jRKNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEEjPKNS_10OatDexFileEbbPS9_NS3_10unique_ptrINS_16DexFileContainerENS3_14default_deleteISH_EEEEPNS0_12VerifyResultE\n",
    "\n",
    "package = sys.argv[1]\n",
    "print(\"dex 导出目录为: /data/data/%s\"%(package))\n",
    "device = frida.get_usb_device()\n",
    "pid = device.spawn(package)\n",
    "session = device.attach(pid)\n",
    "src = \"\"\"\n",
    "Interceptor.attach(Module.findExportByName(\"libdexfile.so\", \"_ZN3art13DexFileLoader10OpenCommonEPKhjS2_jRKNSt3__112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEEjPKNS_10OatDexFileEbbPS9_NS3_10unique_ptrINS_16DexFileContainerENS3_14default_deleteISH_EEEEPNS0_12VerifyResultE\"), {\n",
    "    onEnter: function (args) {\n",
    "      \n",
    "        var begin = args[1]\n",
    "        \n",
    "        console.log(\"magic : \" + Memory.readUtf8String(begin))\n",
    "     \n",
    "        var address = parseInt(begin,16) + 0x20\n",
    "\n",
    "        var dex_size = Memory.readInt(ptr(address))\n",
    "\n",
    "        console.log(\"dex_size :\" + dex_size)\n",
    "      \n",
    "        var file = new File(\"/data/data/%s/\" + dex_size + \".dex\", \"wb\")\n",
    "        file.write(Memory.readByteArray(begin, dex_size))\n",
    "        file.flush()\n",
    "        file.close()\n",
    "\n",
    "        var send_data = {}\n",
    "        send_data.base = parseInt(begin,16)\n",
    "        send_data.size = dex_size\n",
    "        send(send_data)\n",
    "    },\n",
    "    onLeave: function (retval) {\n",
    "        if (retval.toInt32() > 0) {\n",
    "        }\n",
    "    }\n",
    "});\n",
    "\"\"\"%(package)\n",
    "\n",
    "script = session.create_script(src)\n",
    "\n",
    "script.on(\"message\" , on_message)\n",
    "\n",
    "script.load()\n",
    "device.resume(pid)\n",
    "sys.stdin.read()\n",
    "```\n",
    "　　代码参考 https://github.com/dstmath/frida-unpack\n",
    "\n",
    "## 四、执行脱壳脚本\n",
    "\n",
    "　　我们先将一个简单的测试程序丢到腾讯乐固上去加固，我们可以看到加固完成后的结果：\n",
    "![腾讯乐固加固](./images/Frida脱壳实战-腾讯乐固加固.png)\n",
    "　　可以看到加固过后程序的原本代码被隐藏了，被替换成乐固的壳程序代码，将加固后的应用安装到手机上，并赋予该应用读写sd卡权限。\n",
    "　　在sd卡中创建unpack目录，执行命令运行JS脚本：\n",
    "```shell\n",
    "$\n",
    "$ frida -U -f  -l  –no-pause\n",
    "```\n",
    "　　-U参数表示我们使用了USB server进行链接，-f 参数表示在设备中启动一个指定的android程序，需要配合 –no-pause参数来使进程恢复。-l参数表示需要注入的js脚本。\n",
    "　　Python脚本的运行就简单得多了：\n",
    "```shell\n",
    "$\n",
    "$ python unpack.py \n",
    "```\n",
    "![Python脱壳](./images/Frida脱壳实战-python脱壳.png)\n",
    "\n",
    "　　另外注意一个问题，如果应用运行过程中使用了64位的libart.so，脚本的这个地方需要进行一些小修改：\n",
    "```js\n",
    "// dex起始位置\n",
    "var begin = args[1]\n",
    "// 获取dex起始位置的语句需要改成：\n",
    "var begin = this.context.x0\n",
    "```\n",
    "　　不然可能会出现这样的问题：\n",
    "![64位libart.so异常](./images/Frida脱壳实战-64位libart.so异常.png)\n",
    "　　脱壳完成后从sd卡中将unpack文件夹pull到本地：\n",
    "```shell\n",
    "$\n",
    "$ adb pull /sdcard/unpack .\n",
    "```\n",
    "![Frida脱壳实战-脱壳后效果](./images/Frida脱壳实战-脱壳后效果.png) \n",
    "　　可以看到脱壳成功了。由于这一类脱壳法是将内存中的dex文件直接dump下来的，对于指令抽取等针对方法体进行处理的加固方式并没有做对应的修复工作。如果应用经过了指令抽取或者dex2c处理，这种方法拿到的dex文件就是残缺不全的，对于那些加固就需要通过对Android源码进行修改的脱壳方法比如dexhunter或者是比较新的FART脱壳机。\n"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.12"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}