本帖最后由 ttegame 于 2021-04-18 20:18 编辑
软件样品为当前最新完整版6.86.0,好像还分极速版和完整版的,极速版40多MB。
工具用ida即可。
重签名后软件闪退,用运行记录来看是so出现异常,定位libshield.so,拖入ida加载。从搜索结果来看获取签名值的地方只有1个sub_93228,双击进去然后查看伪代码。
伪代码如下:
int __fastcall sub_93228(int a1)
{
int v2; // [sp+14h] [bp-6Ch]
int v4; // [sp+28h] [bp-58h]
int v5; // [sp+2Ch] [bp-54h]
int v6; // [sp+30h] [bp-50h]
int v7; // [sp+34h] [bp-4Ch]
int v8; // [sp+38h] [bp-48h]
int v9; // [sp+3Ch] [bp-44h]
int v10; // [sp+40h] [bp-40h]
int v11; // [sp+44h] [bp-3Ch]
int v12; // [sp+48h] [bp-38h]
int v13; // [sp+4Ch] [bp-34h]
int v14; // [sp+54h] [bp-2Ch]
int v15; // [sp+58h] [bp-28h]
int v16; // [sp+5Ch] [bp-24h]
int v17; // [sp+60h] [bp-20h]
int v18; // [sp+64h] [bp-1Ch]
time_t timer; // [sp+70h] [bp-10h] BYREF
v18 = sub_F93C(*(a1 + 76));
v17 = sub_F9A0(v18, "android/app/Application");
v16 = sub_F9EC(v18, v17, "getPackageManager", "()Landroid/content/pm/PackageManager;");
v15 = sub_FA60(v18, *(a1 + 80), v16);
v14 = sub_F9A0(v18, "android/content/pm/PackageManager");
v2 = sub_F9EC(v18, v14, "getPackageInfo", "(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;");
sub_FAE0(a1);
v13 = sub_FA60(v18, v15, v2);
v12 = sub_F9A0(v18, "android/content/pm/PackageInfo");
v11 = sub_FB5C(v18, v12, "signatures", "[Landroid/content/pm/Signature;");
v10 = sub_F9A0(v18, "android/content/pm/Signature");
v9 = sub_F9EC(v18, v10, "hashCode", "()I");
v8 = sub_FBD0(v18, v13, v11);
v7 = sub_FC2C(v18, v8);
v6 = 0;
time(&timer);
while ( 1 )
{
if ( v6 >= v7 )
{
sub_FD64(v18, v17);
sub_FD64(v18, v15);
sub_FD64(v18, v13);
sub_FD64(v18, v8);
sub_FD64(v18, v10);
abort();
}
v5 = sub_FC88(v18, v8, v6);
v4 = sub_FCE4(v18, v5, v9);
if ( v4 == -1083242518 || v4 == -1075459295 || v4 == -815670264 )
break;
sub_FD64(v18, v5);
++v6;
}
return 1;
从getPackageManager到getPackageInfo,英文来看可以知道是获取安装包的信息,signatures就是获取签名值,然后转换成哈希值hashCode。然后底下的-1083242518、-1075459295、-815670264这3个数字就是正确签名哈希值。break跳出循环,abort终止程序,这个代码最后return 1,所以这里只是单纯的验证签名是否正确,如不正确就关闭程序。
修改思路的话就很简单了,nop掉它的调用即可。地址.text:000102C2 BL sub_93228,改nop填充。
然后我看了一下dex,里面有2个地方获取了签名值,robuster类获取了签名小写md5,c类获取了签名哈希值,就是so里面的-1083242518。不过这2个地方不知道影响的是哪里,应该和联网有关,最好还是改一下。
|