Zookeeper reinforcement and cracking

This article assumes that you have already used zookeeper reinforcement, and you have at least one APK after the zookeeper reinforcement.

I will not describe the principle of token reinforcement here. I can decompile the reinforced APK and analyze it to see what content the token reinforcement has added, I would like to summarize what zookeeper reinforcement has done:

1. Create a. cache directory,/data/packagename/. Cache /"

2. Custom dexclassloader:

Dexpath:/data/packagename/. Cache/classes. Jar

Optimizeddirectory:/data/packagename/. Cache

Librarypath:/data/packagename/lib

3. By using a custom dexclassloader, you can hide the real DEX and dynamically load the DEX at runtime,

4. Dex will be converted to odex during installation and stored in the/data/Dalvik-cache directory, the odex file of the app reinforced by zookeeper in this directory is not a real odex file.

Summary: The principle is implemented by a custom dexclassloader no matter how disguised the hacker reinforcement is. This is also the basis for cracking the hacker reinforcement.

BTW: zookeeper reinforcement has done a lot of work to prevent cracking. For example, I tried to use GDB to mount the process and dump the memory. However, once the process is mounted, program

Quit.

1. Hook the opendexfilenative method in Dalvik. system. dexfile to establish the key-value pairs of dexpath and dexfileinfo (store cookies, that is, pointers to dexorjar objects)

(The opendexfilenative method is the native method. The implementation is defined in the dalvik_dalvik_system_dexfile_opendexfilenative method in the dalvik_system_dexfile.cpp file)

2. Retrieve the dexorjar Object Pointer Based on dexpath. It's only time for this object to get the odex. Let's take a look at the data structure definition:

typedef struct DexOrJar {    char*          fileName;    bool           isDex;    bool           okayToFree;    RawDexFile*    pRawDexFile;

    JarFile*       pJarFile;

    u1* pDexMemory;} DexOrJar;

It can be seen from the above struct that the memory organization is determined based on whether the extension is Dex or jar. With the pointer, we can convert it to a dexorjar object. In fact, we have obtained the memory content corresponding to the odex file. Next, we need to export the content as smali, then execute dexodex to smali, and finally get the smali file and use baksmali to restore it to the DEX file. After obtaining the DEX file, you can convert it to a Java file through dex2jar, for example, the DEX file content exported by Momo after the rod reinforcement:

After obtaining the DEX and engineering resource files, I can customize a shell to run Momo. The next article is about to write this content.

Zookeeper reinforcement and cracking