Reference:NetEase Cloud Encryption: http://apk.aq.163.com NetEase Cloud Capture: http://crash.163.com
1, the structure of the creation and import, structural body pointers.take Jninativeinterface, Dexheader as an example. The functions to parse Dex are as follows:F5 after the following: File->load file->parser C header File, import Dex.h A1, right-click into the structure, select Dexheader, the effect is as follows:
2.function pointer when the number of parameters adjustment, indeterminate parameters and so on. take __android_log_print as an example and select the function. Edit->operand type-> set operand type, modify the parameters as follows: Int (__cdecl *) (int, char *, char *, char *, int *, int *), F5 after refresh, the effect is as follows:
3. Conversion of Thumb/arm modeshortcut key Alt +g, where 0x01 is thumb,0x00 is arm mode. Typically 4-byte arm mode, two bytes for thumb mode, such as:
4. The function is mistaken for chunk, which causes the caller to function multiple entries.take Java_by_ericky_crackme01_jni_eatrice As an example, you can see that there are two entrances. Come to the end of the first entrance to the BX jump instruction,should let him jump to the second entrance out, just right。All first to remove function tail, select, end, and then edit->functions->Remove function tail, effect:Then the jump instruction BL, modified to Call,edit->others->Force BL Call, Effect5, C++rtti, class name recognition. come to the Jni_onload placesub_a558 is a constructor function.You can get the function named 9ArtLoader,
6, create the function, set the function end address. F5, the effect is as follows:Solution, press p, then F5. If P has no effect, you can select and then press P.7, elf repair, memory dump the so and since the file, and then modify the dump out of the base address,file-->loadfile-->binary File. The dump command is:DD if=/proc/1935/mem of=/sdcard/alimsc4 skip=1578049536 ibs=1 count=39936008, data copy, patch. Select the data, then Edit->export 9, script, Idc,idapythonHttp://magiclantern.wikia.com/wiki/IDAPython/introhttp://drops.wooyun.org/tips/11849http://drops.wooyun.org/tips/12060
10.lsof view deleted files, cat gets deleted files from memory[Email protected]:/# lsof |busybox grep com.sxiaoao.car3d3System_se 523 System 298/data/app/com.sxiaoao.car3d3-2.apkCom.sxiao 10370 u0_a65 44/data/data/com.sxiaoao.car3d3/files/app_sdk103700_.jar (deleted)Com.sxiao 10370 u0_a65 48/data/app/com.sxiaoao.car3d3-2.apkCom.sxiao 10370 u0_a65 49/data/app/com.sxiaoao.car3d3-2.apk
10370 is process number 44 is open file FD file FD map inside/PROP/PID/FDCopy the files with the cat command.1| [Email protected]:/# cat/proc/10370/fd/44 >/data/local/tmp/test.jar
11. Arm Instruction Simulator
12.why not F5, not all-faith F5
Reverse analysis of Android hack so common ida analysis tips
