Android逆向中的字符串加密和反混淆¶

/**
 * Replace method call with calculated result.
 * Useful for custom string deobfuscation.
 *
 * Example for sample from issue https://github.com/skylot/jadx/issues/1251
 */

import jadx.core.dex.instructions.ConstStringNode
import jadx.core.dex.instructions.InvokeNode
import jadx.core.dex.instructions.args.InsnArg
import jadx.core.dex.instructions.args.InsnWrapArg
import jadx.core.dex.instructions.args.RegisterArg


val jadx = getJadxInstance()

val mthSignature = "com.xshield.aa.iIiIiiiiII(Ljava/lang/String;)Ljava/lang/String;"

jadx.replace.insns { mth, insn ->
    if (insn is InvokeNode && insn.callMth.rawFullId == mthSignature) {
        val str = getConstStr(insn.getArg(0))
        if (str != null) {
            val resultStr = decode(str)
            log.info { "Decode '$str' to '$resultStr' in $mth" }
            return@insns ConstStringNode(resultStr)
        }
    }
    null
}

fun getConstStr(arg: InsnArg): String? {
    val insn = when (arg) {
        is InsnWrapArg -> arg.wrapInsn
        is RegisterArg -> arg.assignInsn
        else -> null
    }
    if (insn is ConstStringNode) {
        return insn.string
    }
    return null
}

/**
 * Decompiled method, automatically converted to Kotlin by IntelliJ Idea
 */
fun decode(str: String): String {
    val length = str.length
    val cArr = CharArray(length)
    var i = length - 1
    while (i >= 0) {
        val i2 = i - 1
        cArr[i] = (str[i].code xor 'z'.code).toChar()
        if (i2 < 0) {
            break
        }
        i = i2 - 1
        cArr[i2] = (str[i2].code xor '\u000c'.code).toChar()
    }
    return String(cArr)
}

// That is the path relative to the jadx/bin execution directory, or it can be changed to an absolute path.
@file:DependsOn("../external_library/okhttp-4.11.0.jar")
@file:DependsOn("../external_library/okio-jvm-3.2.0.jar")
@file:DependsOn("../external_library/okio-3.2.0.jar")

import okhttp3.MediaType.Companion.toMediaType
import okhttp3.OkHttpClient
import okhttp3.Request
import okhttp3.RequestBody.Companion.toRequestBody
import okhttp3.Response

import jadx.core.dex.instructions.ConstStringNode
import jadx.core.dex.instructions.InvokeNode
import jadx.core.dex.instructions.args.InsnArg
import jadx.core.dex.instructions.args.InsnWrapArg
import jadx.core.dex.instructions.args.RegisterArg

val jadx = getJadxInstance()

val mthSignature_qzb = "kotlinx.android.extensionss.qz.b(Ljava/lang/String;)Ljava/lang/String;"

jadx.replace.insns { mth, insn ->
    if (insn is InvokeNode && insn.callMth.rawFullId == mthSignature_qzb) {
        val str = getConstStr(insn.getArg(0))
        if (str != null) {
            val resultStr = decrypt(mthSignature_qzb, str)
            log.info { "Decrypt '$str' to '$resultStr' in $mth" }
            return@insns ConstStringNode(resultStr)
        }
    }
    null
}
fun getConstStr(arg: InsnArg): String? {
    val insn = when (arg) {
        is InsnWrapArg -> arg.wrapInsn
        is RegisterArg -> arg.assignInsn
        else -> null
    }
    if (insn is ConstStringNode) {
        return insn.string
    }
    return null
}
// rpc 解密函数
fun decrypt(mthSignature: String, param: String): String?{
    val client = OkHttpClient()
    val json = """
        {
            "method": "${mthSignature}",
            "param": "${param}"
        }
    """.trimIndent()

    val requestBody = json.toRequestBody("application/json; charset=utf-8".toMediaType())

    val request = Request.Builder()
        .url("http://127.0.0.1:5000/decrypt")
        .post(requestBody)
        .build()

    val response = client.newCall(request).execute()
    return response.body?.string().toString()
}

# ...
app = Flask(__name__)
logger = Logger(log_level="INFO")

def message(message, data):
    if message['type'] == 'send':
        logger.debug(f"[*] {message['payload']}")
    else:
        logger.debug(message)

@app.route('/decrypt', methods=['POST'])#data解密
def decrypt_class():
    data = request.get_data()
    json_data = json.loads(data.decode("utf-8"))
    logger.info(json_data)
    method_sig = json_data.get("method")
    method_param = handle_params(json_data.get("param"))
    logger.debug(f"method: ${method_sig}; params: ${method_param}") 
    handle_method = globals()[methods[method_sig]]
    res = _process_string(handle_method(method_sig, method_param))
    response = make_response(res, 200)
    response.headers['Content-Type'] = 'application/json'
    return response

def _process_string(s: str) -> str:
    s = ' '.join(s.split())
    s = re.sub(r'\s+', ' ', s)
    if len(s) > 0 and s[0] == ' ':
        s = ' ' + s.lstrip()
    if len(s) > 0 and s[-1] == ' ':
        s = s.rstrip() + ' '
    return s

def handle_params(params):
    return params

#################### Method Handler ####################

def _handle_qz_b(method_name, method_param):
    res = _process_string(script.exports_sync.invokemethod01(method_param))
    logger.info(f"{method_param} => {res}")
    return res

def _handle_cg_b(method_name, method_param):
    res = _process_string(script.exports_sync.invokemethod02(method_param))
    logger.info(f"{method_param} => {res}")
    return res

#################### Flask Server ####################

config = Config.builder()
methods = config.methods_map

device = frida.get_device_manager().add_remote_device(config.remote_device)
if(config.spawn):
    session = device.spawn(config.package_name)
else:
    session = device.attach(config.app_name)

with open(os.path.join(os.path.dirname(os.path.abspath(__file__)), "scripts", config.frida_script_name)) as f:
    jsCode = f.read()

script = session.create_script(jsCode)
script.on("message",message)
script.load()

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=5000, debug=False)