免责声明:由于传播、利用本公众号SSP安全研究所提供的信息而造成的任何直接或者间接的后果及损失,均由使用者本人负责,公众号SSP安全研究及作者不为此承担任何责任,一旦造成后果请自行承担!如有侵权烦请告知,我们会立即删除并致歉。谢谢!
Frida调试 APP
下载安装MUMU模拟器
安装包可后台回复 mumu 获取下载链接
将模拟器硬盘切换成 可写系统盘
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/7-1720142167.png)
开启root权限
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/3-1720142169.png)
开机后打开ADB调试
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/2-1720142171.png)
打开后会启动一个终端 代表已经打开 之后关闭即可
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/8-1720142175.png)
使用adb命令可以查看到 当前设备
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/0-1720142178.png)
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/3-1720142180.png)
之后转换证书格式 并导入到模拟器的system证书文件夹下
#burpsuite
openssl x509 -inform DER-in burp.der-out burp.pem
hash=$(openssl x509 -inform PEM-subject_hash_old -in burp.pem| head -n 1)
# 将 pem 证书改成 hash + .0 的格式
new_hash="${hash}.0"
mv burp.pem"$new_hash"
# 将证书直接放到系统证书文件夹下
adb push "$new_hash"/system/etc/security/cacerts/
#yakit
hash=$(openssl x509 -inform PEM-subject_hash_old -in yakit.pem| head -n 1)
# 将 pem 证书改成 hash + .0 的格式
new_hash="${hash}.0"
mv yakit.pem"$new_hash"
# 将证书直接放到系统证书文件夹下
adb push "$new_hash"/system/etc/security/cacerts/
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/2-1720142183.png)
使用burp进行抓包测试
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/5-1720142186.png)
burp能抓到https包
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/0-1720142188.png)
接下来安装面具
HuskyDG/magisk-files (github.com)
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/7-1720142191.png)
将apk拖到模拟器中进行安装
之后打开app进行安装
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/0-1720142194.png)
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/2-1720142195.png)
安装完成后进行重启
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/5-1720142198.png)
开机后再打开面具 会报错
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/3-1720142201.png)
重启后需要再次打开adb
使用 root 权限删除之前冲突的 su 相关文件
adb connect 127.0.0.1:16385
adb shell
su
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/0-1720142204.png)
mv /system/xbin/su /system/xbin/su.bak
mv /system/app/SuperUser/ /system/app/SuperUser-Bak/
之后面具正常
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/8-1720142207.png)
frida测试
mac安装frida环境
pip3 install frida
pip3 install frida-tools
pip install Pyro4
Untitled Database
下载frida-server-16.3.3-android-arm64
上传到模拟器中
adb push frida-server-16.3.3-android-arm64 /data/local/tmp/
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/1-1720142210.png)
启动frida
adb shell
su
cd /data/local/tmp/
chmod +x frida-server-16.3.3-android-arm64
./frida-server-16.3.3-android-arm64
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/1-1720142213.png)
另起一个终端 查看模拟器进程
frida-ps -U
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/9-1720142217.png)
安装常用app
-
• termux
-
• Drony
-
• ProxyDroid
frida实战测试
对某颜色APP进行抓包 发现数据都是被加密了
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/0-1720142220.png)
使用frida进行调试 打印出调用栈信息
frida -U -f "cn.mciaa.yshxcp" -l hook-js/hook-js/打印调用栈/HashMap_Hook.js
根据调用栈信息找到加密函数
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/1-1720142221.png)
使用jadx-gui进行反编译 找到Java文件 ApiEncryptUtil.java
可以看到是AES加密函数 和 解密函数
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/10-1720142223.png)
编写hook脚本
调用解密函数a
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/7-1720142224.png)
Java.perform(function(){
var targetClass =Java.use('c.h.a.l.r');
targetClass.a.implementation=function(str){
console.log("Original argument: "+ str);
var result =this.a(str);
console.log('Original result: '+ result);
return result;
}
});
之后载入hook脚本 发现数据已经解密
frida -U -f "cn.mciaa.yshxcp" -l decode.js
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/5-1720142225.png)
但是这样看非常费劲 且不能对数据包进行测试
下面使用BurpSuite插件Brida对数据包进行加解密
配置好Brida
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/6-1720142227.png)
点击 Load JS file加载hook的js脚本
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/7-1720142227.png)
按照Brida脚本编写规则进行编写hook函数
decode:function(str){
var ret;
Java.perform(function(){
var clazz =Java.use("c.h.a.l.r");
ret = clazz.a(str);
});
return ret;
},
encode:function(str){
var ret;
Java.perform(function(){
var clazz =Java.use("c.h.a.l.r");
ret = clazz.b(str);
});
return ret;
},
对编写的函数进行测试
先点击Spawn application
之后把加密数据放进去点击Run export 即可看到解密后的数据
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/2-1720142228.png)
加密函数测试正常
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/5-1720142229.png)
加入右键
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/9-1720142229.png)
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/1-1720142230.png)
![MuMu模拟器Frida 逆向某颜色APP实战 MuMu模拟器Frida 逆向某颜色APP实战](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2024/07/10-1720142231.png)
这样测试就方便多了
往期精彩
原文始发于微信公众号(SSP安全研究):MuMu模拟器Frida 逆向某颜色APP实战