如果有些app需要输入密码和用户名之类的,用IDA静态调试,看不到,只能通过IDA动态调试APP。
动态调试步骤:
网上教程一大堆,不在赘述
实例1:ctf_100:
如果不达到要爬的楼层,是看不到FLAG的。
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F6d23e53f-2e01-4cba-9a33-7b17049e11a4%2F2022-10-20_101614.png?table=block&id=18dcb68a-2165-4e54-9750-9cfa91853545&cache=v2)
反编译后,分析了一下,发现不用动态调试也可以,所以就直接在java层修改一下就可以了:
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F8302c179-b3e0-4468-a126-a199fbbe7e1d%2F2022-10-20_101448.png?table=block&id=99962c19-ed9e-412b-bffa-a3957ecb7cdd&cache=v2)
只要去到
if-get
这一行的判断就可以了:![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fbf2b062e-a726-4c82-b544-b147eff4e94f%2F2022-10-20_102246.png?table=block&id=6e79aefb-0909-4aa8-be38-82fc41e0a0f2&cache=v2)
效果:只要爬一层楼,点击看FLAG就可以看到FLAG了:
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F36578f00-a10c-4acd-bfa1-ab0e7177bf6d%2F2022-10-20_110124.png?table=block&id=7f15153b-2b42-4afb-ad3c-ffee53cba339&cache=v2)
案例二:crackme1:
这次需要IDA动态调试才可以看到正确的输入密码:
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F2123b3d8-443a-46dd-a7d9-cc59dd0c1978%2F2022-10-20_110508.png?table=block&id=8267e72f-37d9-45e8-a60a-bd5e8a6903b2&cache=v2)
IDA调试步骤:
IDA先静态分析一下:
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fb598bd58-a05c-4b50-beb1-6e717dd28827%2F2022-10-20_111013.png?table=block&id=5bdf1575-00cc-4032-a6c4-26bc673bd5e1&cache=v2)
分析bc为关键解密函数,
wolf_de
为解密函数,传入的应该是解密的密钥:![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fd9e06bb3-f4db-473c-b973-735f5ea160d4%2F2022-10-20_111358.png?table=block&id=dd1be660-500f-482a-8241-36db49ecb874&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F179075a1-c729-40cd-b8e4-50889ffee2bf%2F2022-10-20_115035.png?table=block&id=7c4f3026-89f4-4eea-b943-9d90f4ca98a2&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fd099dbed-78d9-4ba2-acdf-fdb9c78e82b0%2F2022-10-19_143643.png?table=block&id=f428a61c-2bf7-4c76-8292-795477a1faa8&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F19aa9923-c8ca-4988-9f3f-ec8037effce5%2F2022-10-19_134755.png?table=block&id=64cb1e5f-4937-4a12-a048-88c775b887b4&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F2f6d3b1d-b399-425c-9b91-cb327e453eca%2F2022-10-19_134755.png?table=block&id=0fcc0775-5214-4094-b871-3d34947fa405&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F5138dcbf-ed74-46de-bc9c-ddde5a5c1d7b%2F2022-10-19_135141.png?table=block&id=d6c07545-b401-4463-823c-ec47b7f67fd8&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F933a6fe5-4522-4522-9ca9-68007b7a8b2f%2F2022-10-19_135928.png?table=block&id=d6e908f0-6ed8-4384-9d7f-a0e5e9958680&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Ff8aed1e2-02f2-47a8-acd0-449bdabc6fe9%2F2022-10-19_140016.png?table=block&id=00c5cac2-8627-48bd-a2de-bbf8848e7919&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F65629382-188e-497a-8211-448051c97f23%2F2022-10-19_140116.png?table=block&id=babdf638-787e-4430-9cdd-9fbd3fe3932b&cache=v2)
其实也可以在hex view中显示R6寄存器,就可以显示出密钥了
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fc0d3e9a7-7ea6-4614-be5b-c75b8f63be8a%2F2022-10-19_141232.png?table=block&id=c12851a9-8b10-46f3-9798-ebdefa412650&cache=v2)
密码就是:
hello5.1
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fc40fdf15-98f3-4516-9054-0318a91d5c20%2F2022-10-20_112015.png?table=block&id=c382aadb-4b95-4435-b0fb-9aeaa0ccad2d&cache=v2)
案例3:自毁程序密码:
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F1d5fc053-de3e-4865-9fa7-47b392c9f1d2%2F2022-10-1952134.png?table=block&id=7e5d2e77-8354-47d4-8253-340b80ecc217&cache=v2)
IDA静态分析:
关键方法是
Java_com_yaotong_crackme_MainActivity_securityCheck
这个函数是静态注册函数,没有在jni_onload中进行静态注册:![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F24aca4f9-06ca-4629-aa15-9e4f083b795b%2F2022-10-20_112925.png?table=block&id=70df9594-63ad-4d37-9f7c-43b44c17c595&cache=v2)
Java_com_yaotong_crackme_MainActivity_securityCheck
中的字符串并不是密钥:![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fc7b401c3-a559-498f-a8e4-635c6ef77abb%2F2022-10-20_113509.png?table=block&id=d1e863f6-dbc3-45ad-99a7-97098583f53d&cache=v2)
IDA动态调试:
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fd6bd5a94-8d5f-42b0-998b-4468c2f1cfc1%2F2022-10-19_152135.png?table=block&id=c5756daf-4625-4d37-8f09-977dd210af49&cache=v2)
小技巧:
在IDA中按ctrl+s找到segment窗口,找到载入so文件中的库的起始地址,用另一个IDA打开so文件,找到对应函数的偏移地址,绝对地址=基址+偏移地址(静态分析中的函数地址),绝对地址就是IDA动态分析中的函数的地址。
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F66787a54-64c8-4a74-87e2-49ed4e8384b2%2F2022-10-20_114043.png?table=block&id=d9067d49-1e17-4918-b8ab-e0d2f6953b69&cache=v2)
运行到这里就可以看到密钥了:
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fc4df7a99-c44a-4a9e-800d-f6b0236d27d2%2F2022-10-19_160712.png?table=block&id=109eaba7-8968-4c62-be06-f04ee373bb89&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F62658753-a878-4066-9b48-7318a58d8a19%2F2022-10-19_155237.png?table=block&id=c292242f-8304-4311-b034-685e8391d781&cache=v2)
密钥是:
aiyou,bucuoo
案例4:find_tracer:
这个应用检测程序是否在被调试:
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fce7a2db7-9733-4b32-9dba-28909d231287%2F2022-10-20_115631.png?table=block&id=8b5fdd39-b09c-4dd2-90d0-fd6896b711ce&cache=v2)
反调试检测的函数:
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F73552b1c-cbde-4a58-9b4c-256ae03be58d%2F2022-10-19_162749.png?table=block&id=b5ac1343-edea-407e-9706-92278d947aab&cache=v2)