Android ruggedized series-5. learn to crack before strengthening, hook (hook) JNI layer System API

<span id="Label3"></p><p><p>"all Rights reserved, Please specify the source of the reprint." Source: http://www.cnblogs.com/joey-hua/p/5138585.html "</p></p><p><p>Crackme Project JNI key code (project address at the bottom of the article), get the current Program's package name Com.example.shelldemo and Com.example.nocrack comparison, The normal operation results are this app is illegal, The cracked content here is the hook strcmp function to modify the function return value to change the program direction to achieve running SUCCESSFULLY.</p></p><p><p></p></p><p><p></p></p><p><p><span style="color: #0000ff;"><strong>1. Introduction of tools</strong></span></p></p><p><p>Eclipse + ndk<span style="font-family: 宋体;">, compiling</span> <span style="font-family: Calibri;">jni</span> <span style="font-family: 宋体;">Source code</span></p></p><p><p>CMD <span style="font-family: 宋体;">window</span></p></p><p><p></p></p><p><p><span style="color: #0000ff;"><strong>2. Preparatory work</strong></span></p></p><p><p>Phone Root.</p></p><p><p>Before compiling the <span style="font-family: Calibri;">C</span> <span style="font-family: 宋体;">file below, There is a place for you to modify yourself,</span><span style="font-family: Calibri;">mystrcmp.c</span> <span style="font-family: 宋体;"></span></p></p><p><p></p></p><p><p>Com.example.crackme-2 <span style="font-family: 宋体;">could have been</span> <span style="font-family: Calibri;">com.example.crackme-1</span> .</p></p><p><p><span style="color: #ff0000;"><strong>A. <span style="font-family: 宋体;">compiling</span> <span style="font-family: Calibri;">inject.c</span> <span style="font-family: 宋体;">and transmitting</span></strong></span></p></p><p><p>Enter in the <span style="font-family: Calibri;">android.mk</span> <span style="font-family: 宋体;">and compile the build</span> <span style="font-family: Calibri;">inject</span><span style="font-family: 宋体;">:</span></p></p><pre class="brush:css;gutter:true;"><pre class="brush:css;gutter:true;">Local_path: = $ (call my-dir) include $ (clear_vars) local_module: = inject local_src_files: = inject.c Local_ldlibs + =-l$ (sysroot)/usr/lib-llog include $ (build_executable)</pre></pre><p><p></p></p><p><p>Then open the <span style="font-family: Calibri;">cmd</span> <span style="font-family: 宋体;">Command window into the file directory and Enter:</span></p></p><p><p>ADB push inject/data/local/tmp</p></p><p><p>Push file <span style="font-family: Calibri;">inject</span> <span style="font-family: 宋体;">to the</span> <span style="font-family: Calibri;">/data/local/tmp</span> <span style="font-family: 宋体;">directory</span> of your phone</p></p><p><p></p></p><p><p><span style="color: #ff0000;"><strong>B. <span style="font-family: 宋体;">compile</span> <span style="font-family: Calibri;">mystrcmp.c</span> <span style="font-family: 宋体;">and Transfer</span></strong></span></p></p><p><p>Enter in the <span style="font-family: Calibri;">android.mk</span> <span style="font-family: 宋体;">and compile the build</span> <span style="font-family: Calibri;">libmystrcmp.so</span><span style="font-family: 宋体;">:</span></p></p><pre class="brush:css;gutter:true;"><pre class="brush:css;gutter:true;">Local_path: = $ (call my-dir) include $ (clear_vars) local_ldlibs + =-l$ (sysroot)/usr/lib-llog-legl local_ MODULE : = mystrcmp local_src_files: = mystrcmp.c include $ (build_shared_library)</pre></pre><p><p></p></p><p><p>then, in the command window, type:</p></p><p><p>ADB push libmystrcmp.so/data/local/tmp</p></p><p><p></p></p><p><p></p></p><p><p><span style="color: #0000ff;"><strong>3. Start <span style="font-family: Calibri;">Hook</span></strong></span></p></p><p><p>Start Crackme on your phone <span style="font-family: Calibri;"></span><span style="font-family: 宋体;">, then</span> <span style="font-family: Calibri;"></span> <span style="font-family: 宋体;">Open a new command window on the PC and Enter:</span></p></p><p><p>ADB shell</p></p><p><p>Su</p></p><p><p>Cd/data/local/tmp</p></p><p><p>chmod 777 *</p></p><p><p>PS | grep Com.example.crackme</p></p><p><p>./inject 3166<span style="font-family: 宋体;">(this corresponds to the PID of your process</span> <span style="font-family: Calibri;"></span><span style="font-family: 宋体;">)</span></p></p><p><p></p></p><p><p><span style="font-family: 宋体;">the</span> <span style="font-family: Calibri;">INJECT</span> tag that observes Eclipse <span style="font-family: 宋体;">'s</span> <span style="font-family: Calibri;">logcat</span> <span style="font-family: 宋体;">will find</span></p></p><p><p></p></p><p><p>Observe Com.example.crackme</p></p><p><p></p></p><p>The <p> Indicates that the injection was successful and found <span style="font-family:calibri;">strcmp </span> <span style="font-family: arial;"> function, The complete meaning is to have our </span> <span style="font-family:calibri" , ">libstrcmp.so </span> <span style=" font-family: The song body; " injected into the process < span> <span style="font-family:calibri;">com.example.crackme </span> <span style="font-family: the song body;" and put our own new write < span> <span style="font-family:calibri;">strcmp </span> <span style="font-family: arial;" the address of the function replaces system's < span> <span style="font-family:calibri;">strcmp </span> <span style="font-family: arial;"> function address, See key code: </span> </span></span></span></p></p><pre class="brush:java;gutter:true;"><pre class="brush:java;gutter:true;">Got_item = * (uint32_t *) (out_addr + i); If (got_item = = Old_strcmp) { logd ("Found strcmp in got\n"); Got_found = 1; uint32_t page_size = getpagesize (); uint32_t Entry_page_start = (out_addr + i) & (~ (page_size-1)); Mprotect ((uint32_t *) entry_page_start, page_size, prot_read | prot_write); * (uint32_t *) (out_addr + i) = new_strcmp;</pre></pre><p><p>Now that it's done, run it, first press ENTER in the command window</p></p><p><p></p></p><p><p>Then click on the button on your phone to "detect if it is crack"</p></p><p><p></p></p><p><p>At this point we call our custom strcmp<span style="font-family: 宋体;">and get the two string arguments passed in, and always return the success</span> <span style="font-family: Calibri;">0</span><span style="font-family: 宋体;">, see the key code:</span></p></p><p><p></p></p><p><p>This program has been cracked.</p></p><p><p></p></p><p><p></p></p><p><p>"<span style="color: #ff00ff;"><strong><span style="color: #ff00ff;">Crackme</span> <span style="color: #ff00ff;">Project address</span> </strong></span> "</p></p><p><p>"<span style="color: #ff00ff;"><strong>Hook Project Address</strong></span> "</p></p><p><p>Android ruggedized series-5. learn to crack before strengthening, hook (hook) JNI layer System API</p></p></span>