搜狗搜索-公众号文章列表unidbg逆向

搜狗搜索-公众号文章列表unidbg逆向

Java层

image-20211213172034546

从抓包结果看，参数和返回结果都经过加密，而且参数名都是极其简单的单个字符串，不太好入手，尝试从请求的url入手，在jadx搜索v2.get

image-20211213172326842

进入看看

image-20211213172416259

疑似加密和解密的函数

image-20211213172452959

可以看到最终是调用了ScoreTools这个so里面的native函数，接下来使用frida hook看看。

function hook_encrypt() {
    var ScEncryptWall = Java.use('com.sogou.scoretools.ScEncryptWall');
    ScEncryptWall.encrypt.implementation = function (a, b, c) {
        console.log('encrypt.a:', a);
        console.log('encrypt.b:', b);
        console.log('encrypt.c:', c);

        var res = this.encrypt(a, b, c);
        console.log('encrypt.res:', res);

        return res;
    }
}

Java.perform(function () {
    hook_encrypt();
})

image-20211213173541000

so层

ida打开libSCoreTools.so,函数窗口搜索java，可以看出是静态注册的，接下来用unidbg调用encrypt函数

image-20211213174535701

unidbg逆向

package com.sogou;

import com.github.unidbg.AndroidEmulator;
import com.github.unidbg.Emulator;
import com.github.unidbg.Module;
import com.github.unidbg.hook.hookzz.*;
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import com.github.unidbg.linux.android.AndroidResolver;
import com.github.unidbg.linux.android.dvm.*;
import com.github.unidbg.memory.Memory;
import com.sun.jna.Pointer;

import java.io.File;
import java.util.ArrayList;
import java.util.List;

public class Sogou extends AbstractJni {
    private final AndroidEmulator emulator;
    private final VM vm;
    private final Module module;

    public static String pkgName = "com.sogou.activity.src";
    public static String apkPath = "unidbg-android/src/test/java/com/sogou/sogou7.9.6.6.apk";
    public static String soPath = "unidbg-android/src/test/java/com/sogou/libSCoreTools.so";

    public Sogou() {
        emulator = AndroidEmulatorBuilder.for32Bit().setProcessName(pkgName).build();
        final Memory memory = emulator.getMemory();
        memory.setLibraryResolver(new AndroidResolver(23));
        vm = emulator.createDalvikVM(new File(apkPath));
        vm.setVerbose(true);
        DalvikModule dm = vm.loadLibrary(new File(soPath), true);
        vm.setJni(this);

        dm.callJNI_OnLoad(emulator);
        module = dm.getModule();
    }

    public void call_encrypt() {
        List