def decrypt(args, cname, mname, protos, snippet):
self.emu.call(
snippet[:-1], args=self.global_variables, cv=True, thrown=True)
# print(self.emu.vm.variables)
# 生成解密参数
try:
arguments = self.gen_arguments(args, protos)
except Exception:
print(snippet[:-2])
for item in new_lines[-20:]:
print(item)
print(self.emu.vm.variables)
print(args, protos)
return
cname = smafile.smali2java(cname)
json_item = self.get_json_item(cname, mname, arguments)
# print(json_item)
mid = json_item['id']
rtn_name = pis[1]
if mid not in self.results:
self.json_list.append(json_item)
self.decode(mid)
return mid
def __process(self):
self.json_list = {'type': 'field', 'data': []}
for sf in self.smalidir:
if self.skip(sf):
continue
json_item = {
'className': smali2java(sf.get_class()),
'fieldName': []
}
counter = 0
for f in sf.get_fields():
if 'Ljava/lang/String;' not in f.get_type():
continue
if f.get_value():
continue
if f.get_is_static():
counter += 1
# 格式:如果ID是FieldValue，则直接取对应的Field，不执行解密方法
json_item['fieldName'].append(f.get_name())
# 没静态变量，则跳过
if counter < 1:
continue
if json_item['fieldName']:
self.json_list['data'].append(json_item)
self.optimize()
def _process_mtd(self, mtd, ptn):
if DEBUG_MODE:
print('\n', '+' * 100)
print('Starting to decode ...')
print(Color.green(mtd))
body = mtd.get_body()
for item in ptn.finditer(body):
old_content = item.group() # 匹配到的内容，用来替换
# arg: 解密参数
# cname：解密类
# mname：解密方法
# rtn_name：最后返回的字符串寄存器，new String的寄存器名字
arg, cname, mname, rtn_name = item.groups()
# 转化解密参数
arguments = [self.convert_args('Ljava/lang/String;', arg)]
import smafile
cname = smafile.smali2java(cname)
json_item = self.get_json_item(cname, mname, arguments)
mid = json_item['id']
self.append_json_item(json_item, mtd, old_content, rtn_name)
if mid in self.results: # 如果同样的ID存在，那么无需解密
continue
self.decode(mid)
def _process_mtd(self, mtd, ptn):
if DEBUG_MODE:
print('\n', '+' * 100)
print('Starting to decode ...')
print(Color.green(mtd))
body = mtd.get_body()
# TODO 优化，根据每列来匹配
# 执行之前，没有返回值，赋值等操作的语句，执行，其他都不执行。
for item in ptn.finditer(body):
old_content = item.group() # 匹配到的内容，用来替换
# print(old_content)
# args: 解密参数
# cname：解密类
# mname：解密方法
# rtn_name：最后返回的字符串寄存器，new String的寄存器名字
part, args, cname, mname, rtn_name = item.groups()
snippet = part.split('\n')
tmp = []
for item in snippet:
if not item:
continue
if ':try_start' in item:
# print(old_content)
old_content = old_content.split(item)
# print(old_content)
tmp.clear()
tmp.append(item.strip())
# print(old_content)
# print(tmp)
# 模拟执行代码片段
# continue
self.emu.call(tmp, args=self.global_variables, cv=True, thrown=True)
# 转化解密参数
ans = self.argument_names(args)
v1 = self.emu.vm.variables.get(ans[0], None)
v2 = self.emu.vm.variables.get(ans[1], None)
v3 = self.emu.vm.variables.get(ans[2], None)
if v1 is None or v2 is None or v3 is None:
continue
arguments = [self.convert_args('S', v1), self.convert_args('I', v2), self.convert_args('S', v3)]
import smafile
cname = smafile.smali2java(cname)
json_item = self.get_json_item(cname, mname, arguments)
mid = json_item['id']
if mid in self.results: # 如果同样的ID存在，那么无需解密
continue
self.append_json_item(json_item, mtd, old_content, rtn_name)
self.decode(mid)
def _process_mtd(self, mtd, ptn):
if DEBUG_MODE:
print('\n', '+' * 100)
print('Starting to decode ...')
print(Color.green(mtd))
body = mtd.get_body()
for item in ptn.finditer(body):
old_content = item.group() # 匹配到的内容，用来替换
print(old_content)
# args: 解密参数
# cname：解密类
# mname：解密方法
# rtn_name：最后返回的字符串寄存器，new String的寄存器名字
part, args, cname, mname, rtn_name = item.groups()
snippet = part.split('\n\n')
# TODO 自动初始化，静态变量，静态数组等等。后续用于片段计算，用到。
# TODO 模拟执行代码片段
self.emu.call(snippet,
args={'Lo/r/g/ন$Ⅱ;->ᖬ:I': 0},
cv=True,
thrown=True)
# 转化解密参数
ans = self.argument_names(args)
v1 = self.emu.vm.variables.get(ans[0], None)
v2 = self.emu.vm.variables.get(ans[1], None)
v3 = self.emu.vm.variables.get(ans[2], None)
if v1 is None or v2 is None or v3 is None:
continue
arguments = [
self.convert_args('I', v1),
self.convert_args('I', v2),
self.convert_args('I', v3)
]
import smafile
cname = smafile.smali2java(cname)
json_item = self.get_json_item(cname, mname, arguments)
mid = json_item['id']
self.append_json_item(json_item, mtd, old_content, rtn_name)
if mid in self.results: # 如果同样的ID存在，那么无需解密
self.json_list.clear()
continue
self.decode(mid)
def _process_mtd(self, mtd, ptn):
if get_value('DEBUG_MODE'):
print('\n', '+' * 100)
print('Starting to decode ...')
print(Color.green(mtd))
body = mtd.get_body()
for item in ptn.finditer(body):
old_content = item.group() # 匹配到的内容，用来替换
# base解密的字符串，base64解密
# 得到结果再次解密，
# rtn_name：最后返回的字符串寄存器，new String的寄存器名字
arg, cname, mname, rtn_name = item.groups()
# base64解密
arguments = [self.convert_args('Ljava/lang/String;', arg), 'I:2']
json_item = self.get_json_item('android.util.Base64', 'decode',
arguments)
mid = json_item['id']
self.append_json_item(json_item, mtd, old_content, rtn_name)
arg0 = None
if mid not in self.results: # 如果同样的ID存在，那么无需解密
self.decode(mid)
arg0 = self.results[mid]
old_mid = mid
# arg1 = 'fmsd1234' # 这个是一个固定值
# 解密得到的结果
# 进行第二次解密
import smafile
cname = smafile.smali2java(cname)
arguments = ['[B:' + arg0, 'java.lang.String:fmsd1234']
# print(cname, mname, arguments)
json_item = self.get_json_item(cname, mname, arguments)
mid = json_item['id']
self.append_json_item(json_item, mtd, old_content, rtn_name)
if mid in self.results:
self.json_list.clear()
continue
self.decode(mid)
x = self.results[mid]
try:
result = bytes(eval(x)).decode('utf-8')
self.results[old_mid] = result
print(result)
except Exception as e:
print(result, e)
def optimize(self):
"""
把Field的值，写回到smali中
因为Field本来就是唯一，所以，不需要ID
"""
if not self.json_list:
return
jsons = JSONEncoder().encode(self.json_list)
outputs = {}
with tempfile.NamedTemporaryFile(mode='w+', delete=False) as tfile:
tfile.write(jsons)
outputs = self.driver.decode(tfile.name)
os.unlink(tfile.name)
if not outputs:
return False
if isinstance(outputs, str):
return False
if DEBUG:
print()
for k, v in outputs.items():
print(k, v)
for sf in self.smalidir:
clz = smali2java(sf.get_class())
if clz not in outputs.keys():
continue
for item in outputs[clz].items():
self.update_field(sf, item[0], item[1])
self.make_changes = True
self.smali_files_update()
self.clear()
def _process_mtd(self, mtd, ptn):
body = mtd.get_body()
for item in ptn.finditer(body):
old_content = item.group() # 匹配到的内容，用来替换
# base解密的字符串，base64解密
# 得到结果再次解密，
# rtn_name：最后返回的字符串寄存器，new String的寄存器名字
arg, cname, mname, rtn_name = item.groups()
print(old_content)
print(item.groups())
arguments = ['java.lang.Object:' + arg]
import smafile
cname = smafile.smali2java(cname)
print(cname, mname, arguments)
json_item = self.get_json_item(cname, mname, arguments)
mid = json_item['id']
self.append_json_item(json_item, mtd, old_content, rtn_name)
if mid in self.results:
self.json_list.clear()
continue
self.decode(mid)
raise A
def _process_mtd(self, mtd):
# if DEBUG_MODE:
# print('\n', '+' * 100)
# print('Starting to decode ...')
# print(Color.green(mtd))
# 如果存在数组
array_data_content = []
arr_res = self.arr_data_ptn.search(mtd.get_body())
if arr_res:
array_data_content = re.split(r'\n\s', arr_res.group())
lines = re.split(r'\n\s*', mtd.get_body())
old_body = lines.copy() # 存放原始方法体
new_body = [] # 存放解密后的方法体
snippet = [] # 存放smali代码，用于模拟执行
args = {} # 存放方法参数，用于smaliemu执行
index = -1 # 用于计数
xget_opcodes = {'iget', 'iget-object', 'sget', 'sget-object'}
block_args = {'first': {}} # 保存所有分支的执行结果
last_block_key = 'first' # 上一个分支-关键字
this_block_key = 'first' # 当前分支，默认第一分支
keys = ['first'] # 默认执行第一分支
for line in lines:
index += 1
if not line:
continue
new_body.append(line) # 解密结果，直接放后面即可
# if DEBUG_MODE:
# print(Color.blue(line))
parts = line.split()
opcode = parts[0]
# smali 代码分块执行
# 命中下述关键字，则表示当前分支结束
# 并根据上一个分支的情况，判断之前的分支是否可用
if 'if-' in opcode:
# if DEBUG_MODE:
# print('>' * 10, opcode)
# print('this_block_key', this_block_key)
# print('last_block_key', last_block_key)
# print('block_args', block_args)
# 存在两种情况
# 1. 当前代码片段(if语句之前的代码)，还没执行；全部执行一次
# 2. 当前代码片段，已经执行了一部分，因为解密；从执行后的地方开始执行
pre_args = {}
if this_block_key in last_block_key:
for key in reversed(keys):
if this_block_key not in key:
pre_args = block_args[key].copy()
break
else:
pre_args = block_args[last_block_key].copy()
if this_block_key in block_args:
pre_args.update(block_args[this_block_key])
snippet.extend(array_data_content)
self.emu.call(snippet, args=pre_args, cv=True, thrown=False)
block_args[this_block_key] = self.emu.vm.variables
snippet.clear()
last_block_key = this_block_key
this_block_key = 'if' + parts[-1] # 表示接下来跑的代码块是这个语句的
keys.append(this_block_key)
# if DEBUG_MODE:
# print('block_args - 运行后', block_args)
continue
elif 'goto' in opcode:
# 跳转语句，直接跳过
continue
elif opcode.startswith(':cond_')\
or opcode.startswith(':try_start')\
or opcode.startswith('.catch_'):
# if DEBUG_MODE:
# print('>' * 10, opcode)
# print('this_block_key', this_block_key)
# print('last_block_key', last_block_key)
# print('block_args', block_args)
# 存在两种情况
# 1. 当前代码片段，还没执行；全部执行一次
# 2. 当前代码片段，已经执行了一部分，因为解密；从执行后的地方开始执行
pre_args = block_args[last_block_key].copy()
if this_block_key in block_args:
pre_args.update(block_args[this_block_key])
snippet.extend(array_data_content)
self.emu.call(snippet, args=pre_args, cv=True, thrown=False)
block_args[this_block_key] = self.emu.vm.variables
snippet.clear()
last_block_key = this_block_key
this_block_key = opcode # 表示接下来跑的代码块是这个语句的
keys.append(this_block_key)
# if DEBUG_MODE:
# print('block_args - 运行后', block_args)
continue
elif opcode.startswith(':try_start'):
pass
elif '.catch_' in opcode:
# 前面代码当成一块处理
continue
snippet.append(line)
is_static = True
if opcode == 'invoke-static':
result = self.process_invoke_static_statement(line)
if result:
cname, mname, ptypes, rtype, rnames = result
else:
continue
# elif opcode == 'invoke-virtual':
# TODO 实例方法，目前只考虑无参实例化。
# result = self.process_invoke_static_statement(line)
# if result:
# cname, mname, ptypes, rtype, rnames = result
# print(result)
# # 判断类的构造函数是否为<init>()V
# clz = self.smalidir.get_method(
# java2smali(cname), '<init>()V')
# if not clz:
# continue
# is_static = False
# else:
# continue
elif opcode in xget_opcodes:
self.process_xget_statement(line)
continue
elif 'Ljava/lang/String;-><init>([B)V' in line:
if 'move-result-object' in snippet[0]:
snippet = snippet[1:]
self.emu.call(snippet, args=args, cv=True, thrown=False)
if not self.emu.vm.result:
continue
# 如果有结果，则替换
vx, _ = SmaliLine.parse(line)
new_line = 'const-string {}, "{}"'.format(
vx, self.emu.vm.result)
del new_body[-1]
new_body.append(new_line)
self.make_changes = True
mtd.set_modified(True)
snippet.clear()
continue
else:
continue
# 模拟执行，获取解密参数
del snippet[-1]
snippet.extend(array_data_content)
try:
snippet = self.process_if_statement(snippet)
# if DEBUG_MODE:
# print(Color.red('开始处理解密参数 {}'.format(line)))
# for l in snippet:
# print(Color.red(l))
# print('args', args)
# print(block_args)
# print(keys)
# print(this_block_key)
# print('-' * 80)
pre_args = block_args[last_block_key].copy()
args.update(pre_args)
if this_block_key in block_args:
args.update(block_args[this_block_key])
args.update(self.fields)
self.emu.call(snippet, args=args, cv=True, thrown=False)
registers = self.emu.vm.variables
block_args[this_block_key] = registers
# if DEBUG_MODE:
# print(snippet)
# print('args:', args)
# print('smali执行后，寄存器内容', registers)
if registers:
for k, v in registers.items():
if v is None:
continue
args[k] = v
registers = args
except TIMEOUT_EXCEPTION:
snippet.clear()
continue
print(Color.red('->'))
obj_flag = False
if len(ptypes) == 1 and ptypes[0][0] == 'L' and ptypes != [
'Ljava/lang/String;'
]:
# 单独处理参数为对象的情况
obj_flag = True
snippet.clear() # 已经执行过的代码，不再执行
if not registers and not obj_flag:
continue
print(Color.red('->>'))
# 从寄存器中获取对应的参数
# 参数获取 "arguments": ["I:198", "I:115", "I:26"]}
arguments = []
# args = {} # the parameter of smali method
if not obj_flag:
ridx = -1
for item in ptypes:
ridx += 1
rname = rnames[ridx]
if rname not in registers:
break
value = registers[rnames[ridx]]
argument = self.convert_args(item, value)
if argument is None:
break
arguments.append(argument)
else:
arguments.append('Object:' + smali2java(ptypes[0]))
# if DEBUG_MODE:
# print(Color.red('->>'))
# print('参数类型', ptypes)
# print('参数值', arguments)
if len(arguments) != len(ptypes):
print(Color.red('->> 参数对不上'))
continue
json_item = self.get_json_item(cname, mname, arguments)
print(json_item)
# print('生成json item')
# {id}_{rtn_name} 让这个唯一化，便于替换
old_content = '# %s' % json_item['id']
# 如果 move_result_obj 操作存在的话，解密后一起替换
find = self.move_result_obj_ptn.search(lines[index + 1])
print(Color.red('->> not fount'))
# 必须要找到返回值操作，用于更新寄存器
if not find:
print('找不到返回寄存器')
continue
print(Color.red('->>>'))
rtn_name = find.groups()[0]
# 为了避免 '# abc_v10' 替换成 '# abc_v1'
old_content = old_content + '_' + rtn_name + 'X'
self.append_json_item(json_item, mtd, old_content, rtn_name)
result = self.get_result(rtype)
# if DEBUG_MODE:
# print("解密结果", result)
self.json_list.clear()
if result:
new_body = new_body[:-1]
else:
continue
if not args:
args = {}
if rtype == 'Ljava/lang/String;':
result = list(result.values())[0][0]
# 更新寄存器
args[rtn_name] = result
# 更新代码
new_line = 'const-string {}, "{}"'.format(rtn_name, result)
new_body.append(new_line)
self.make_changes = True
mtd.set_modified(True)
elif rtype.startswith('['):
args[rtn_name] = result
# 把结果保存到当前分支
else:
print("返回值并非字符串，也不是B/C数组")
if args:
block_args[this_block_key].update(args)
# 把结果保存到当前分支
# if DEBUG_MODE:
# print(block_args)
# print('*' * 100)
# print('last_block_key', last_block_key)
# print('this_block_key', this_block_key)
#
# pre_args = block_args[last_block_key].copy()
# if this_block_key in block_args:
# pre_args.update(block_args[this_block_key])
# block_args[this_block_key] =
mtd.set_body('\n'.join(new_body))
