某二次元 App 签名算法解析 (一)

console.log("\t method_name:", methods.add(i * Process.pointerSize * 3).readPointer().readCString(), "method_sign:", methods.add(i * Process.pointerSize * 3 + Process.pointerSize).readPointer().readCString(), "method_fnPtr:", fn_ptr, "method offset:", fn_ptr.sub(find_module.base));}}, onLeave(retval){

}})}

}

挂上我心爱的 frida，跑起来……

这种函数命名可读性这么好，望文生义就知道不是做 sign

[RegisterNatives] method_count: 0x6module name libimagepipeline.somodule base 0x7c29c000method_name: nativeAllocate method_sign: (I)J method_fnPtr: 0x7c29cc6d method offset: 0xc6dmethod_name: nativeFree method_sign: (J)V method_fnPtr: 0x7c29ccb5 method offset: 0xcb5method_name: nativeCopyToByteArray method_sign: (J[BII)V method_fnPtr: 0x7c29ccbb method offset: 0xcbbmethod_name: nativeCopyFromByteArray method_sign: (J[BII)V method_fnPtr: 0x7c29ccd7 method offset: 0xcd7method_name: nativeMemcpy method_sign: (JJI)V method_fnPtr: 0x7c29ccf3 method offset: 0xcf3method_name: nativeReadByte method_sign: (J)B method_fnPtr: 0x7c29ccff method offset: 0xcff

这个 libbili.so 大兄弟看上去不像好人，都 9020 年了，函数命名个 a、b、s 之类，这么明目张胆的写 bug，在我司是要被李老板拉出去打 PP 的。

[RegisterNatives] method_count: 0x7module name libbili.somodule base 0x88e2b000method_name: a method_sign: (Ljava/lang/String;)Ljava/lang/String; method_fnPtr: 0x88e2cc35 method offset: 0x1c35method_name: ao method_sign: (Ljava/lang/String;II)Ljava/lang/String; method_fnPtr: 0x88e2cc3b method offset: 0x1c3bmethod_name: b method_sign: (Ljava/lang/String;)Ljavax/crypto/spec/IvParameterSpec; method_fnPtr: 0x88e2cc49 method offset: 0x1c49method_name: s method_sign: (Ljava/util/SortedMap;)Lcom/bilibili/nativelibrary/SignedQuery; method_fnPtr: 0x88e2cc4f method offset: 0x1c4fmethod_name: so method_sign: (Ljava/util/SortedMap;II)Lcom/bilibili/nativelibrary/SignedQuery; method_fnPtr: 0x88e2cc55 method offset: 0x1c55method_name: getCpuCount m

《Android学习笔记总结+最新移动架构视频+大厂安卓面试真题+项目实战源码讲义》
浏览器打开：qq.cn.hn/FTe 免费领取

ethod_sign: ()I method_fnPtr: 0x88e2cc63 method offset: 0x1c63method_name: getCpuId method_sign: ()I method_fnPtr: 0x88e2cc67 method offset: 0x1c67

既然不是好人，那就问询一下，Hook 之:

var biliNative = Java.use("com.bilibili.nativelibrary.LibBili");

biliNative.a.implementation = function(a){var result = this.a(a);console.log("biliNative a(" + a + ") = " + result);return result;}

biliNative.ao.implementation = function(a,b,c){var result = this.ao(a,b,c);console.log("biliNative ao(" + a + "," + b + "," + c + ") = " + result);return result;}

biliNative.b.overload('java.lang.String').implementation = function(a){var result = this.b(a);console.log("biliNative b(" + a + ") = " + result);return result;}

biliNative.s.implementation = function(map){var result = this.s(map);console.log("biliNative s(" + map + ") = " + result);return result;}

biliNative.so.implementation = function(a,b,c){var result = this.so(a,b,c);console.log("biliNative so(" + a + "," + b + "," + c + ") = " + result);return result;}

现形了，收工。

慢着！李老板出场了，为什么老板总在下班的时候出现？上班的时候他们干什么去了？(?╯︵╰?)

奋飞呀，签名是出来的，但是入参呢？你总不能告诉我入参是个 Object 吧？

搞 SortedMap 入参

入参从之前打印的结果可以看出来，是个 Ljava/util/SortedMap;, 那就 so easy 了，把它打印出来即可。

半小时后…… 找了一圈 google 只告诉了我一个 HashMap 的打印方法，不管了，先打出来

biliNative.s.implementation = function(HashMap){var result = this.s(HashMap);

var keys = HashMap.keySet();var key_set = keys.iterator();while (key_set.hasNext()) {var key = key_set.next().toString();var value = HashMap.get(key).toString();console.log(key + ": " + value);}

console.log("biliNative s(" + HashMap + ") = " + result);return result;}

继续跑，Duang.....

{'type': 'error', 'description': "TypeError: undefined not callable (property 'get' of [object Object])", 'stack': "TypeError: undefined not callable (property 'get' of [object Object])\n at [anon] (../../../frida-gum/bindings/gumjs/duktape.c:67616)\n at /script1.js:111\n at je (frida/node_modules/frida-java-bridge/lib/class-factory.js:633)\n at frida/node_modules/frida-java-bridge/lib/class-factory.js:616", 'fileName': '/script1.js', 'lineNumber': 111, 'columnNumber': 1}

貌似是说 SortedMap 没有 get()这个方法 ????

先查查 java 文档，分析下 SortedMap 的成员函数，其实奋飞也是个优秀的 java 程序员。

• java.util.SortedMap.comparator() //接收比较器，用于 Map 排序

• java.util.SortedMap.entrySet() //后去 Map 中的 entrySet 集合

• java.util.SortedMap.firstKey() //第一个 key

• java.util.SortedMap.headMap(K k) //在 k 之前的键值对

• java.util.SortedMap.keySet() //获取 key 的 set 集合

• java.util.SortedMap.lastKey() //最后的 key

• java.util.SortedMap.subMap(K k1, K k2) //k1，k2 之间的键值对

• java.util.SortedMap.tailMap(K) //集合最后的键值对

• java.util.SortedMap.values() //集合所有的 values

好吧，那就简单了，我们先把 key 遍历出来，然后在把 values() 打印出来。

哪位同学有更好的办法，请给奋飞留言.Orz

TIP: 网友：飞雪的日子，提供了一个更帅的方式 console.log(map.entrySet().toArray());

biliNative.s.implementation = function(map){var result = this.s(map);

var keyStr = ""var keys = map.keySet();var key_set = keys.iterator();while (key_set.hasNext()) {var key = key_set.next().toString();keyStr += ","+key}

console.log(keyStr)console.log(map.values().toArray());

console.log("biliNative s(" + map + ") = " + result);