def decrypt(args, cname, mname, protos, snippet): self.emu.call( snippet[:-1], args=self.global_variables, cv=True, thrown=True) # print(self.emu.vm.variables) # 生成解密参数 try: arguments = self.gen_arguments(args, protos) except Exception: print(snippet[:-2]) for item in new_lines[-20:]: print(item) print(self.emu.vm.variables) print(args, protos) return cname = smafile.smali2java(cname) json_item = self.get_json_item(cname, mname, arguments) # print(json_item) mid = json_item['id'] rtn_name = pis[1] if mid not in self.results: self.json_list.append(json_item) self.decode(mid) return mid
def __process(self): self.json_list = {'type': 'field', 'data': []} for sf in self.smalidir: if self.skip(sf): continue json_item = { 'className': smali2java(sf.get_class()), 'fieldName': [] } counter = 0 for f in sf.get_fields(): if 'Ljava/lang/String;' not in f.get_type(): continue if f.get_value(): continue if f.get_is_static(): counter += 1 # 格式:如果ID是FieldValue,则直接取对应的Field,不执行解密方法 json_item['fieldName'].append(f.get_name()) # 没静态变量,则跳过 if counter < 1: continue if json_item['fieldName']: self.json_list['data'].append(json_item) self.optimize()
def _process_mtd(self, mtd, ptn): if DEBUG_MODE: print('\n', '+' * 100) print('Starting to decode ...') print(Color.green(mtd)) body = mtd.get_body() for item in ptn.finditer(body): old_content = item.group() # 匹配到的内容,用来替换 # arg: 解密参数 # cname:解密类 # mname:解密方法 # rtn_name:最后返回的字符串寄存器,new String的寄存器名字 arg, cname, mname, rtn_name = item.groups() # 转化解密参数 arguments = [self.convert_args('Ljava/lang/String;', arg)] import smafile cname = smafile.smali2java(cname) json_item = self.get_json_item(cname, mname, arguments) mid = json_item['id'] self.append_json_item(json_item, mtd, old_content, rtn_name) if mid in self.results: # 如果同样的ID存在,那么无需解密 continue self.decode(mid)
def _process_mtd(self, mtd, ptn): if DEBUG_MODE: print('\n', '+' * 100) print('Starting to decode ...') print(Color.green(mtd)) body = mtd.get_body() # TODO 优化,根据每列来匹配 # 执行之前,没有返回值,赋值等操作的语句,执行,其他都不执行。 for item in ptn.finditer(body): old_content = item.group() # 匹配到的内容,用来替换 # print(old_content) # args: 解密参数 # cname:解密类 # mname:解密方法 # rtn_name:最后返回的字符串寄存器,new String的寄存器名字 part, args, cname, mname, rtn_name = item.groups() snippet = part.split('\n') tmp = [] for item in snippet: if not item: continue if ':try_start' in item: # print(old_content) old_content = old_content.split(item) # print(old_content) tmp.clear() tmp.append(item.strip()) # print(old_content) # print(tmp) # 模拟执行代码片段 # continue self.emu.call(tmp, args=self.global_variables, cv=True, thrown=True) # 转化解密参数 ans = self.argument_names(args) v1 = self.emu.vm.variables.get(ans[0], None) v2 = self.emu.vm.variables.get(ans[1], None) v3 = self.emu.vm.variables.get(ans[2], None) if v1 is None or v2 is None or v3 is None: continue arguments = [self.convert_args('S', v1), self.convert_args('I', v2), self.convert_args('S', v3)] import smafile cname = smafile.smali2java(cname) json_item = self.get_json_item(cname, mname, arguments) mid = json_item['id'] if mid in self.results: # 如果同样的ID存在,那么无需解密 continue self.append_json_item(json_item, mtd, old_content, rtn_name) self.decode(mid)
def _process_mtd(self, mtd, ptn): if DEBUG_MODE: print('\n', '+' * 100) print('Starting to decode ...') print(Color.green(mtd)) body = mtd.get_body() for item in ptn.finditer(body): old_content = item.group() # 匹配到的内容,用来替换 print(old_content) # args: 解密参数 # cname:解密类 # mname:解密方法 # rtn_name:最后返回的字符串寄存器,new String的寄存器名字 part, args, cname, mname, rtn_name = item.groups() snippet = part.split('\n\n') # TODO 自动初始化,静态变量,静态数组等等。后续用于片段计算,用到。 # TODO 模拟执行代码片段 self.emu.call(snippet, args={'Lo/r/g/ন$Ⅱ;->ᖬ:I': 0}, cv=True, thrown=True) # 转化解密参数 ans = self.argument_names(args) v1 = self.emu.vm.variables.get(ans[0], None) v2 = self.emu.vm.variables.get(ans[1], None) v3 = self.emu.vm.variables.get(ans[2], None) if v1 is None or v2 is None or v3 is None: continue arguments = [ self.convert_args('I', v1), self.convert_args('I', v2), self.convert_args('I', v3) ] import smafile cname = smafile.smali2java(cname) json_item = self.get_json_item(cname, mname, arguments) mid = json_item['id'] self.append_json_item(json_item, mtd, old_content, rtn_name) if mid in self.results: # 如果同样的ID存在,那么无需解密 self.json_list.clear() continue self.decode(mid)
def _process_mtd(self, mtd, ptn): if get_value('DEBUG_MODE'): print('\n', '+' * 100) print('Starting to decode ...') print(Color.green(mtd)) body = mtd.get_body() for item in ptn.finditer(body): old_content = item.group() # 匹配到的内容,用来替换 # base解密的字符串,base64解密 # 得到结果再次解密, # rtn_name:最后返回的字符串寄存器,new String的寄存器名字 arg, cname, mname, rtn_name = item.groups() # base64解密 arguments = [self.convert_args('Ljava/lang/String;', arg), 'I:2'] json_item = self.get_json_item('android.util.Base64', 'decode', arguments) mid = json_item['id'] self.append_json_item(json_item, mtd, old_content, rtn_name) arg0 = None if mid not in self.results: # 如果同样的ID存在,那么无需解密 self.decode(mid) arg0 = self.results[mid] old_mid = mid # arg1 = 'fmsd1234' # 这个是一个固定值 # 解密得到的结果 # 进行第二次解密 import smafile cname = smafile.smali2java(cname) arguments = ['[B:' + arg0, 'java.lang.String:fmsd1234'] # print(cname, mname, arguments) json_item = self.get_json_item(cname, mname, arguments) mid = json_item['id'] self.append_json_item(json_item, mtd, old_content, rtn_name) if mid in self.results: self.json_list.clear() continue self.decode(mid) x = self.results[mid] try: result = bytes(eval(x)).decode('utf-8') self.results[old_mid] = result print(result) except Exception as e: print(result, e)
def optimize(self): """ 把Field的值,写回到smali中 因为Field本来就是唯一,所以,不需要ID """ if not self.json_list: return jsons = JSONEncoder().encode(self.json_list) outputs = {} with tempfile.NamedTemporaryFile(mode='w+', delete=False) as tfile: tfile.write(jsons) outputs = self.driver.decode(tfile.name) os.unlink(tfile.name) if not outputs: return False if isinstance(outputs, str): return False if DEBUG: print() for k, v in outputs.items(): print(k, v) for sf in self.smalidir: clz = smali2java(sf.get_class()) if clz not in outputs.keys(): continue for item in outputs[clz].items(): self.update_field(sf, item[0], item[1]) self.make_changes = True self.smali_files_update() self.clear()
def _process_mtd(self, mtd, ptn): body = mtd.get_body() for item in ptn.finditer(body): old_content = item.group() # 匹配到的内容,用来替换 # base解密的字符串,base64解密 # 得到结果再次解密, # rtn_name:最后返回的字符串寄存器,new String的寄存器名字 arg, cname, mname, rtn_name = item.groups() print(old_content) print(item.groups()) arguments = ['java.lang.Object:' + arg] import smafile cname = smafile.smali2java(cname) print(cname, mname, arguments) json_item = self.get_json_item(cname, mname, arguments) mid = json_item['id'] self.append_json_item(json_item, mtd, old_content, rtn_name) if mid in self.results: self.json_list.clear() continue self.decode(mid) raise A
def _process_mtd(self, mtd): # if DEBUG_MODE: # print('\n', '+' * 100) # print('Starting to decode ...') # print(Color.green(mtd)) # 如果存在数组 array_data_content = [] arr_res = self.arr_data_ptn.search(mtd.get_body()) if arr_res: array_data_content = re.split(r'\n\s', arr_res.group()) lines = re.split(r'\n\s*', mtd.get_body()) old_body = lines.copy() # 存放原始方法体 new_body = [] # 存放解密后的方法体 snippet = [] # 存放smali代码,用于模拟执行 args = {} # 存放方法参数,用于smaliemu执行 index = -1 # 用于计数 xget_opcodes = {'iget', 'iget-object', 'sget', 'sget-object'} block_args = {'first': {}} # 保存所有分支的执行结果 last_block_key = 'first' # 上一个分支-关键字 this_block_key = 'first' # 当前分支,默认第一分支 keys = ['first'] # 默认执行第一分支 for line in lines: index += 1 if not line: continue new_body.append(line) # 解密结果,直接放后面即可 # if DEBUG_MODE: # print(Color.blue(line)) parts = line.split() opcode = parts[0] # smali 代码分块执行 # 命中下述关键字,则表示当前分支结束 # 并根据上一个分支的情况,判断之前的分支是否可用 if 'if-' in opcode: # if DEBUG_MODE: # print('>' * 10, opcode) # print('this_block_key', this_block_key) # print('last_block_key', last_block_key) # print('block_args', block_args) # 存在两种情况 # 1. 当前代码片段(if语句之前的代码),还没执行;全部执行一次 # 2. 当前代码片段,已经执行了一部分,因为解密;从执行后的地方开始执行 pre_args = {} if this_block_key in last_block_key: for key in reversed(keys): if this_block_key not in key: pre_args = block_args[key].copy() break else: pre_args = block_args[last_block_key].copy() if this_block_key in block_args: pre_args.update(block_args[this_block_key]) snippet.extend(array_data_content) self.emu.call(snippet, args=pre_args, cv=True, thrown=False) block_args[this_block_key] = self.emu.vm.variables snippet.clear() last_block_key = this_block_key this_block_key = 'if' + parts[-1] # 表示接下来跑的代码块是这个语句的 keys.append(this_block_key) # if DEBUG_MODE: # print('block_args - 运行后', block_args) continue elif 'goto' in opcode: # 跳转语句,直接跳过 continue elif opcode.startswith(':cond_')\ or opcode.startswith(':try_start')\ or opcode.startswith('.catch_'): # if DEBUG_MODE: # print('>' * 10, opcode) # print('this_block_key', this_block_key) # print('last_block_key', last_block_key) # print('block_args', block_args) # 存在两种情况 # 1. 当前代码片段,还没执行;全部执行一次 # 2. 当前代码片段,已经执行了一部分,因为解密;从执行后的地方开始执行 pre_args = block_args[last_block_key].copy() if this_block_key in block_args: pre_args.update(block_args[this_block_key]) snippet.extend(array_data_content) self.emu.call(snippet, args=pre_args, cv=True, thrown=False) block_args[this_block_key] = self.emu.vm.variables snippet.clear() last_block_key = this_block_key this_block_key = opcode # 表示接下来跑的代码块是这个语句的 keys.append(this_block_key) # if DEBUG_MODE: # print('block_args - 运行后', block_args) continue elif opcode.startswith(':try_start'): pass elif '.catch_' in opcode: # 前面代码当成一块处理 continue snippet.append(line) is_static = True if opcode == 'invoke-static': result = self.process_invoke_static_statement(line) if result: cname, mname, ptypes, rtype, rnames = result else: continue # elif opcode == 'invoke-virtual': # TODO 实例方法,目前只考虑无参实例化。 # result = self.process_invoke_static_statement(line) # if result: # cname, mname, ptypes, rtype, rnames = result # print(result) # # 判断类的构造函数是否为<init>()V # clz = self.smalidir.get_method( # java2smali(cname), '<init>()V') # if not clz: # continue # is_static = False # else: # continue elif opcode in xget_opcodes: self.process_xget_statement(line) continue elif 'Ljava/lang/String;-><init>([B)V' in line: if 'move-result-object' in snippet[0]: snippet = snippet[1:] self.emu.call(snippet, args=args, cv=True, thrown=False) if not self.emu.vm.result: continue # 如果有结果,则替换 vx, _ = SmaliLine.parse(line) new_line = 'const-string {}, "{}"'.format( vx, self.emu.vm.result) del new_body[-1] new_body.append(new_line) self.make_changes = True mtd.set_modified(True) snippet.clear() continue else: continue # 模拟执行,获取解密参数 del snippet[-1] snippet.extend(array_data_content) try: snippet = self.process_if_statement(snippet) # if DEBUG_MODE: # print(Color.red('开始处理解密参数 {}'.format(line))) # for l in snippet: # print(Color.red(l)) # print('args', args) # print(block_args) # print(keys) # print(this_block_key) # print('-' * 80) pre_args = block_args[last_block_key].copy() args.update(pre_args) if this_block_key in block_args: args.update(block_args[this_block_key]) args.update(self.fields) self.emu.call(snippet, args=args, cv=True, thrown=False) registers = self.emu.vm.variables block_args[this_block_key] = registers # if DEBUG_MODE: # print(snippet) # print('args:', args) # print('smali执行后,寄存器内容', registers) if registers: for k, v in registers.items(): if v is None: continue args[k] = v registers = args except TIMEOUT_EXCEPTION: snippet.clear() continue print(Color.red('->')) obj_flag = False if len(ptypes) == 1 and ptypes[0][0] == 'L' and ptypes != [ 'Ljava/lang/String;' ]: # 单独处理参数为对象的情况 obj_flag = True snippet.clear() # 已经执行过的代码,不再执行 if not registers and not obj_flag: continue print(Color.red('->>')) # 从寄存器中获取对应的参数 # 参数获取 "arguments": ["I:198", "I:115", "I:26"]} arguments = [] # args = {} # the parameter of smali method if not obj_flag: ridx = -1 for item in ptypes: ridx += 1 rname = rnames[ridx] if rname not in registers: break value = registers[rnames[ridx]] argument = self.convert_args(item, value) if argument is None: break arguments.append(argument) else: arguments.append('Object:' + smali2java(ptypes[0])) # if DEBUG_MODE: # print(Color.red('->>')) # print('参数类型', ptypes) # print('参数值', arguments) if len(arguments) != len(ptypes): print(Color.red('->> 参数对不上')) continue json_item = self.get_json_item(cname, mname, arguments) print(json_item) # print('生成json item') # {id}_{rtn_name} 让这个唯一化,便于替换 old_content = '# %s' % json_item['id'] # 如果 move_result_obj 操作存在的话,解密后一起替换 find = self.move_result_obj_ptn.search(lines[index + 1]) print(Color.red('->> not fount')) # 必须要找到返回值操作,用于更新寄存器 if not find: print('找不到返回寄存器') continue print(Color.red('->>>')) rtn_name = find.groups()[0] # 为了避免 '# abc_v10' 替换成 '# abc_v1' old_content = old_content + '_' + rtn_name + 'X' self.append_json_item(json_item, mtd, old_content, rtn_name) result = self.get_result(rtype) # if DEBUG_MODE: # print("解密结果", result) self.json_list.clear() if result: new_body = new_body[:-1] else: continue if not args: args = {} if rtype == 'Ljava/lang/String;': result = list(result.values())[0][0] # 更新寄存器 args[rtn_name] = result # 更新代码 new_line = 'const-string {}, "{}"'.format(rtn_name, result) new_body.append(new_line) self.make_changes = True mtd.set_modified(True) elif rtype.startswith('['): args[rtn_name] = result # 把结果保存到当前分支 else: print("返回值并非字符串,也不是B/C数组") if args: block_args[this_block_key].update(args) # 把结果保存到当前分支 # if DEBUG_MODE: # print(block_args) # print('*' * 100) # print('last_block_key', last_block_key) # print('this_block_key', this_block_key) # # pre_args = block_args[last_block_key].copy() # if this_block_key in block_args: # pre_args.update(block_args[this_block_key]) # block_args[this_block_key] = mtd.set_body('\n'.join(new_body))