tujia民宿X-TJH及请求数据unidbg实现

tujia民宿X-TJH及请求数据unidbg实现

环境

app 8.45.0

Java层

image-20220115175957610

jadx搜索x-tjh

image-20220114094819029

com.tujia.libs.engine.model.TJRequest.g

image-20220114094910472

com.tujia.gundam.Gundam.a

com.tujia.gundam.Gundam.encrypt

image-20220114095059033

最终X-TJH是调用encrypt函数，请求数据是调用BodyEncrypt函数，这两个函数都是在libtujia_encrypt.so中。

hook看看输入

android hooking watch class_method com.tujia.gun dam.Gundam.encrypt --dump-args --dump-return
android hooking watch class_method com.tujia.gun dam.Gundam.bodyEncrypt --dump-args --dump-return

固定参数

为了方便之后的逆向，frida固定输入，然后看看加密结果。

function call_encrypt() {
    var Gundam = Java.use("com.tujia.gundam.Gundam");
    var body = "{\"code\":\"hello everhu\"}";
    var ret = Gundam.encrypt(
        "key=nodeApiConfig",
        "Mozilla/5.0",
        "LON=null;LAT=null;",
        body,
        body.length,
        1642084337
        );
    console.log(ret);
}

image-20220115173630928

function call_bodyEncrypt() {
    var Gundam = Java.use("com.tujia.gundam.Gundam");
    var salt = "everever";
    var body = "{\"code\":\"hello everhu\"}";
    var ret = Gundam.bodyEncrypt(
        "3",
        1642126567,
        salt,
        salt.length,
        body,
        body.length
    );
    console.log(ret);
}

image-20220115173653851

unidbg实现

public class TuJia extends AbstractJni {
    private final AndroidEmulator emulator;
    private final VM vm;
    private final Module module;

    public static String pkgName = "com.tujia.hotel";
    public static String apkPath = "unidbg-android/src/test/java/com/tujia/tujia8450.apk";
    public static String soPath = "";

    public TuJia() {
        emulator = AndroidEmulatorBuilder.for32Bit().setProcessName(pkgName).build();
        Memory memory = emulator.getMemory();
        memory.setLibraryResolver(new AndroidResolver(23));
        vm = emulator.createDalvikVM(new File(apkPath));
        vm.setJni(this);
        vm.setVerbose(true);
        DalvikModule dm = vm.loadLibrary("tujia_encrypt", true);
        module = dm.getModule();
        dm.callJNI_OnLoad(emulator);
    }

    public static void main(String[] args) {
        TuJia test = new TuJia();
    }
}

image-20220114102849839

@Override
public DvmObject callStaticObjectMethod(BaseVM vm, DvmClass dvmClass, String signature, VarArg varArg) {
    switch (signature) {
        case "com/tujia/hotel/TuJiaApplication->getInstance()Lcom/tujia/hotel/TuJiaApplication;": {
            return vm.resolveClass("com/tujia/hotel/TuJiaApplication").newObject(null);
        }
    }
    return super.callStaticObjectMethod(vm, dvmClass, signature, varArg);
}

image-20220114103058398

@Override
public DvmObject callObjectMethod(BaseVM vm, DvmObject dvmObject, String signature, VarArg varArg) {
    switch (signature) {
        case "com/tujia/hotel/TuJiaApplication->getPackageName()Ljava/lang/String;": {
            return new StringObject(vm, pkgName);
        }
    }
    return super.callObjectMethod(vm, dvmObject, signature, varArg);
}

image-20220114103250647

case "com/tujia/hotel/TuJiaApplication->getPackageManager()Landroid/content/pm/PackageManager;": {
    return vm.resolveClass("android/content/pm/PackageManager").newObject(null);
}

image-20220114103435638

case "java/security/MessageDigest->getInstance(Ljava/lang/String;)Ljava/security/MessageDigest;": {
    try {
        MessageDigest digest = MessageDigest.getInstance(varArg.getObjectArg(0).getValue().toString());
        return vm.resolveClass("java/security/MessageDigest").newObject(digest);
    } catch (NoSuchAlgorithmException e) {
        e.printStackTrace();
    }
}

image-20220114103802311

case "java/security/MessageDigest->digest([B)[B": {
    MessageDigest digest = (MessageDigest) dvmObject.getValue();
    byte[] data = digest.digest((byte[]) varArg.getObjectArg(0).getValue());
    return new ByteArray(vm, data);
}

image-20220114104057496

JNI_OnLoad补完了，开始调用。

public void call_encrypt() {
    List