xhs shield 参数分析

断断续续其实拖了挺长时间的，本意是想通过亲手实践来学一下逆 app 的参数是一个怎样的流程，顺便了解下实战中涉及的安卓逆向的知识

定位 so

抓包分析

用 Reqable 对 xhs 进行抓包，翻了下请求，在请求头里看到了 shield 参数，一共 134 个字符

多观察几个请求头的这个参数可以发现它前 112 个字符是一样的，后面 22 个字符是变化的

hook NewStringUTF

首先需要知道这个这一串参数是从什么地方生成的，一般思路是 hook NewStringUTF

NewStringUTF 是 JNI 中的一个函数，把 native 层的 const char * 字符串转成 Java 层的 jstring,相当于 Java/Kotlin 和 C/C++ native 代码之间的桥梁

JNI 规范里的 NewStringUTF 原型是：

1
jstring NewStringUTF(JNIEnv *env, const char *bytes);

它会根据传入的 bytes 构造一个新的 java.lang.String, 并且它在 JNIEnv 函数表里的索引是 167

由此可以写出 hook NewStringUTF 的 frida 脚本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
function hook_jni_functions() {
    Java.perform(() => {
        // 获取 JNIEnv 指针
        const env = Java.vm.getEnv().handle;
        // JNIEnv 指针指向的第一项是函数表地址
        const jniTable = env.readPointer();
        // NewStringUTF 在函数表中的索引是 167 
        const newStringUTF = jniTable.add(167 * Process.pointerSize).readPointer();

        console.log("[+] NewStringUTF address: " + newStringUTF);

        Interceptor.attach(newStringUTF, {
            onEnter(args) {
                // args[0] = JNIEnv*, args[1] = char*
                try {
                    const cstr = args[1];
                    if (cstr.isNull()) return;

                    const content = cstr.readUtf8String();
                    if (!content) return;

                    if (content.indexOf("XYAAQABAAAAAEAAABTAAAAUzUWEe0xG1IbD9") === -1)
                        return;

                    const now = Date.now();
                    if (now - lastHitTime < 500) return;
                    lastHitTime = now;
                    hitCount++;

                    console.log("\n[+] Target Str hit #" + hitCount);
                    console.log("[+] content: " + content);

                    const ra = this.returnAddress;
                    console.log("[+] returnAddress: " + ra);

                    const mod = Process.findModuleByAddress(ra);
                    if (mod) {
                        console.log("[+] caller module: " + mod.name);
                        console.log("[+] caller base  : " + mod.base);
                        console.log("[+] caller off   : " + ra.sub(mod.base));
                        console.log("[+] caller path  : " + mod.path);
                    } else {
                        console.log("[+] caller module: <unknown>");
                    }
                } catch (e) {
                    console.log("[!] NewStringUTF hook error: " + e);
                }
            }
        });
    });
}

但是尝试之后直接 Process terminated 了

开始以为是 frida 检测，绕了半天也没用，后面发现不是检测的问题，而是 hook 时机太早了，延后一点再注入这个就能正常看到日志了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
[+] Target Str hit #1
[+] content: XYAAQABAAAAAEAAABTAAAAUzUWEe0xG1IbD9/c+qCLOlKGmTtFa+lG438PdeJeRK5KkdGzy+VgHp2qrrFfz8Mt2Zt+g/YxRgxOEWPcML2m2i5jhOFkq6zm/xTkni2FplIyTZTn
[+] returnAddress: 0x78aff949fc
[+] caller module: libxyass.so
[+] caller base  : 0x78aff4e000
[+] caller off   : 0x469fc
[+] caller path  : /data/app/~~aFy_2OaJJ9y0paWz5G_j2Q==/com.xingin.xhs-iJaR9BcYh84YvK07PTu_dA==/lib/arm64/libxyass.so

[+] Target Str hit #2
[+] content: XYAAQABAAAAAEAAABTAAAAUzUWEe0xG1IbD9/c+qCLOlKGmTtFa+lG438PdeJeRK5KkdGzy+VgHp2qrrFfz8Mt2Zt+g/YxRgxOEWPcML2m2i5jhOEtZZu1XoTf9PS0gVq4KKAv
[+] returnAddress: 0x78aff949fc
[+] caller module: libxyass.so
[+] caller base  : 0x78aff4e000
[+] caller off   : 0x469fc
[+] caller path  : /data/app/~~aFy_2OaJJ9y0paWz5G_j2Q==/com.xingin.xhs-iJaR9BcYh84YvK07PTu_dA==/lib/arm64/libxyass.so

[+] Target Str hit #3
[+] content: XYAAQABAAAAAEAAABTAAAAUzUWEe0xG1IbD9/c+qCLOlKGmTtFa+lG438PdeJeRK5KkdGzy+VgHp2qrrFfz8Mt2Zt+g/YxRgxOEWPcML2m2i5jhOGxNco302Ku/Xc5nAvbC6SZ
[+] returnAddress: 0x78aff949fc
[+] caller module: libxyass.so
[+] caller base  : 0x78aff4e000
[+] caller off   : 0x469fc
[+] caller path  : /data/app/~~aFy_2OaJJ9y0paWz5G_j2Q==/com.xingin.xhs-iJaR9BcYh84YvK07PTu_dA==/lib/arm64/libxyass.so

[+] Target Str hit #4
[+] content: XYAAQABAAAAAEAAABTAAAAUzUWEe0xG1IbD9/c+qCLOlKGmTtFa+lG438PdeJeRK5KkdGzy+VgHp2qrrFfz8Mt2Zt+g/YxRgxOEWPcML2m2i5jhOFiavxD7u26SgoZo/k/le/z
[+] returnAddress: 0x78aff949fc
[+] caller module: libxyass.so
[+] caller base  : 0x78aff4e000
[+] caller off   : 0x469fc
[+] caller path  : /data/app/~~aFy_2OaJJ9y0paWz5G_j2Q==/com.xingin.xhs-iJaR9BcYh84YvK07PTu_dA==/lib/arm64/libxyass.so

[+] Target Str hit #5
[+] content: XYAAQABAAAAAEAAABTAAAAUzUWEe0xG1IbD9/c+qCLOlKGmTtFa+lG438PdeJeRK5KkdGzy+VgHp2qrrFfz8Mt2Zt+g/YxRgxOEWPcML2m2i5jhOEuDtXyZ9NvlXwptYNmwHDV
[+] returnAddress: 0x78aff949fc
[+] caller module: libxyass.so
[+] caller base  : 0x78aff4e000
[+] caller off   : 0x469fc
[+] caller path  : /data/app/~~aFy_2OaJJ9y0paWz5G_j2Q==/com.xingin.xhs-iJaR9BcYh84YvK07PTu_dA==/lib/arm64/libxyass.so

[+] Target Str hit #6
[+] content: XYAAQABAAAAAEAAABTAAAAUzUWEe0xG1IbD9/c+qCLOlKGmTtFa+lG438PdeJeRK5KkdGzy+VgHp2qrrFfz8Mt2Zt+g/YxRgxOEWPcML2m2i5jhOGmUsrCaoUedrnEa+TUhAhC
[+] returnAddress: 0x78aff949fc
[+] caller module: libxyass.so
[+] caller base  : 0x78aff4e000
[+] caller off   : 0x469fc
[+] caller path  : /data/app/~~aFy_2OaJJ9y0paWz5G_j2Q==/com.xingin.xhs-iJaR9BcYh84YvK07PTu_dA==/lib/arm64/libxyass.so

[+] Target Str hit #7
[+] content: XYAAQABAAAAAEAAABTAAAAUzUWEe0xG1IbD9/c+qCLOlKGmTtFa+lG438PdeJeRK5KkdGzy+VgHp2qrrFfz8Mt2Zt+g/YxRgxOEWPcML2m2i5jhOG9KYKh2Vq1JgAURXQQotdU
[+] returnAddress: 0x78aff949fc
[+] caller module: libxyass.so
[+] caller base  : 0x78aff4e000
[+] caller off   : 0x469fc
[+] caller path  : /data/app/~~aFy_2OaJJ9y0paWz5G_j2Q==/com.xingin.xhs-iJaR9BcYh84YvK07PTu_dA==/lib/arm64/libxyass.so

[+] Target Str hit #8
[+] content: XYAAQABAAAAAEAAABTAAAAUzUWEe0xG1IbD9/c+qCLOlKGmTtFa+lG438PdeJeRK5KkdGzy+VgHp2qrrFfz8Mt2Zt+g/YxRgxOEWPcML2m2i5jhOHb1YCiTRGYtE/i66qrHzAO
[+] returnAddress: 0x78aff949fc
[+] caller module: libxyass.so
[+] caller base  : 0x78aff4e000
[+] caller off   : 0x469fc
[+] caller path  : /data/app/~~aFy_2OaJJ9y0paWz5G_j2Q==/com.xingin.xhs-iJaR9BcYh84YvK07PTu_dA==/lib/arm64/libxyass.so

[+] Target Str hit #9
[+] content: XYAAQABAAAAAEAAABTAAAAUzUWEe0xG1IbD9/c+qCLOlKGmTtFa+lG438PdeJeRK5KkdGzy+VgHp2qrrFfz8Mt2Zt+g/YxRgxOEWPcML2m2i5jhOHb1YCiTRGYtE/i66qrHzAO
[+] returnAddress: 0x78aff949fc
[+] caller module: libxyass.so
[+] caller base  : 0x78aff4e000
[+] caller off   : 0x469fc
[+] caller path  : /data/app/~~aFy_2OaJJ9y0paWz5G_j2Q==/com.xingin.xhs-iJaR9BcYh84YvK07PTu_dA==/lib/arm64/libxyass.so

[+] Target Str hit #10
[+] content: XYAAQABAAAAAEAAABTAAAAUzUWEe0xG1IbD9/c+qCLOlKGmTtFa+lG438PdeJeRK5KkdGzy+VgHp2qrrFfz8Mt2Zt+g/YxRgxOEWPcML2m2i5jhOGn+kxsjOcY2iCZgIDuNctb
[+] returnAddress: 0x78aff949fc
[+] caller module: libxyass.so
[+] caller base  : 0x78aff4e000
[+] caller off   : 0x469fc
[+] caller path  : /data/app/~~aFy_2OaJJ9y0paWz5G_j2Q==/com.xingin.xhs-iJaR9BcYh84YvK07PTu_dA==/lib/arm64/libxyass.so

[+] Target Str hit #11
[+] content: XYAAQABAAAAAEAAABTAAAAUzUWEe0xG1IbD9/c+qCLOlKGmTtFa+lG438PdeJeRK5KkdGzy+VgHp2qrrFfz8Mt2Zt+g/YxRgxOEWPcML2m2i5jhOGn+kxsjOcY2iCZgIDuNctb
[+] returnAddress: 0x78aff949fc
[+] caller module: libxyass.so
[+] caller base  : 0x78aff4e000
[+] caller off   : 0x469fc
[+] caller path  : /data/app/~~aFy_2OaJJ9y0paWz5G_j2Q==/com.xingin.xhs-iJaR9BcYh84YvK07PTu_dA==/lib/arm64/libxyass.so

[+] Target Str hit #12
[+] content: XYAAQABAAAAAEAAABTAAAAUzUWEe0xG1IbD9/c+qCLOlKGmTtFa+lG438PdeJeRK5KkdGzy+VgHp2qrrFfz8Mt2Zt+g/YxRgxOEWPcML2m2i5jhOEhApRW3JkvcQFYaC+dFfKb
[+] returnAddress: 0x78aff949fc
[+] caller module: libxyass.so
[+] caller base  : 0x78aff4e000
[+] caller off   : 0x469fc
[+] caller path  : /data/app/~~aFy_2OaJJ9y0paWz5G_j2Q==/com.xingin.xhs-iJaR9BcYh84YvK07PTu_dA==/lib/arm64/libxyass.so

[+] Target Str hit #13
[+] content: XYAAQABAAAAAEAAABTAAAAUzUWEe0xG1IbD9/c+qCLOlKGmTtFa+lG438PdeJeRK5KkdGzy+VgHp2qrrFfz8Mt2Zt+g/YxRgxOEWPcML2m2i5jhOE8e3sQfWG9kLLln9Ysi4br
[+] returnAddress: 0x78aff949fc
[+] caller module: libxyass.so
[+] caller base  : 0x78aff4e000
[+] caller off   : 0x469fc
[+] caller path  : /data/app/~~aFy_2OaJJ9y0paWz5G_j2Q==/com.xingin.xhs-iJaR9BcYh84YvK07PTu_dA==/lib/arm64/libxyass.so

由此可以定位到要分析的参数在 libxyass.so 中

样本的是从 Google Play 下载的，因为谷歌推行了 Android App Bundle(.abb)，按设备下发 apk，lib 在 apks 解压后的 split_config.arm64_v8a.apk 中

分析 so

sub_46DB0

根据 call off 的地址在 libxyass.so 中定位

caller off 拿到的是 return address，也就是 NewStringUTF 调完之后，要返回到的下一条指令地址，想要拿到调用地址的偏移需要减去 4 字节指令长度，所以调用地址的偏移是 0x469f8

而往前看最近的函数 sub_46DB0 可能就是构造这个参数的函数了

先是判断一个参数(怀疑是版本) 是否小于 6，根据结果选择 sub_47338 或者 sub_46fe8 这两个分支

hook 下 sub_46DB0 函数的参数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
function hook_sub_46DB0(){
    const targetName = "libxyass.so";
    const dlopen_ptr = Module.getGlobalExportByName("android_dlopen_ext");
    if(dlopen_ptr){
        Interceptor.attach(dlopen_ptr,{
            onEnter:function(args){
                const path = args[0]?.readUtf8String();
                if (path && path.indexOf(targetName) !== -1) {
                    this.isTarget = true;
                }
            },
            onLeave:function(retval){
                if (this.isTarget) {
                    const mod = Process.findModuleByName(targetName);
                    if(mod){
                        const modBase = mod.base;
                        const table = modBase.add(0x976d8);
                        const ptr_func = table.readPointer();
                        const real_addr = ptr_func.sub(0x3fb24a64); // 静态计算
                        console.log("[+] Calculate Func Addr: " + real_addr);
                        Interceptor.attach(modBase.add(0x46DB0),{
                            onEnter:function(this:any,args){
                               const a1 = args[0];
                               const a2 = args[1];
                               const a3_ptr = args[2];
                            //    const a3_var = a3_ptr.readS32();
                               const x8 = this.context.x8;
                               const x2 = this.context.x2;
                               console.log("\n[+] Hook sub_46DB0 args");
                               console.log(`[*] a1: ${a1}`);
                               console.log(hexdump(a1, {
                                                length: 64,
                                                ansi: true
                                            }))
                               console.log(`[*] a2: ${a2}`);
                               console.log(hexdump(a2, {
                                                length: 64,
                                                ansi: true
                                            }))
                               console.log(`[*] a3_ptr: ${a3_ptr}`);
                               console.log(hexdump(a3_ptr,{
                                                length: 64,
                                                ansi:true
                               }))
                               console.log(`[*] x8: ${x8}`);
                               console.log(hexdump(x8, {
                                                length: 64,
                                                ansi: true
                                            }))
                                console.log(`[*] x2: ${x2}`);
                                 console.log(hexdump(x2, {
                                                length: 64,
                                                ansi: true
                                            }))
                            }
                        })
                    }

            }
        }
        })
    }

}

从 arg3 指向的地址处看到第一个字节是 0x4，4 < 6, 所以走的是 sub_47338 分支

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
00046db0    size_t sub_46db0(int64_t arg1, int64_t arg2, int32_t* arg3, char* arg4 @ x8)

00046dc4        uint64_t x22 = _ReadMSR(SystemReg: tpidr_el0)
00046dc8        int64_t x9 = *(x22 + 0x28)
00046de0        int64_t x8
00046de0        
00046de0        if (*arg3 s< 6)
00046df4            x8 = 0x3fb6bd9c  // sub_47338
00046de0        else
00046de8            x8 = 0x3fb6ba4c  // sub_46fe8
00046de8        
00046e0c        (x8 - 0x3fb24a64)(arg1, arg2, arg3)
00046e1c        char var_80
00046e1c        sub_1e310(&var_80, &data_9b510)
00046e24        int32_t x21 = data_9b630
00046e28        uint64_t x20_1 = zx.q(*arg3)
00046e38        char var_98
00046e38        sub_1e310(&var_98, &data_9b4f8)
00046e3c        char var_50
00046e3c        uint64_t x8_1 = zx.q(var_50)
00046e54        int32_t temp0 = x8_1.d & 1
00046e58        int64_t var_40
00046e58        int64_t x5
00046e58        
00046e58        x5 = temp0 == 0 ? &var_50 | 1 : var_40
00046e58        
00046e5c        uint32_t x6
00046e5c        uint32_t var_48
00046e5c        
00046e5c        x6 = temp0 == 0 ? (x8_1 u>> 1).d : var_48
00046e78        char var_68
00046e78        BN_CODE_start_0x4b8c8_size_0x38738(1, &var_80, x21, x20_1.d, &var_98, x5, x6, 
00046e78            &var_68)
00046e80        int64_t var_88
00046e80        
00046e80        if ((zx.d(var_98) & 1) != 0)
00046e88            sub_1e0f4(var_88)
00046e90        int64_t var_70
00046e90        
00046e90        if ((zx.d(var_80) & 1) != 0)
00046e98            sub_1e0f4(var_70)
00046e98        
00046eb8        if ((zx.d(data_9b600) & 1) == 0 && sub_1ee3c(&data_9b600, x20_1) != 0)
00046f30            int16_t* x0_8 = sub_1e0ec(3)
00046f44            x0_8[1].b = 0xd6
00046f48            *x0_8 = 0x33f7
00046f4c            sub_446ac(x0_8, 3)
00046f64            data_9b608 = x0_8
00046f68            sub_1ef98(&data_9b600)
00046f68        
00046ed4        size_t result = sub_1e724(data_9b608, &var_68, arg4)
00046edc        int64_t var_58
00046edc        
00046edc        if ((zx.d(var_68) & 1) != 0)
00046ee4            result = sub_1e0f4(var_58)
00046ee4        
00046eec        if ((zx.d(var_50) & 1) != 0)
00046ef4            result = sub_1e0f4(var_40)
00046ef4        
00046f04        if (*(x22 + 0x28) == x9)
00046f18            return result
00046f18        
00046f70        __stack_chk_fail()
00046f70        noreturn

sub_4b8c8(RC4 + Base64)

Base64

可以看到这个函数有很多个参数并且最后面有个明显的 base64

算输出长度

Base64 字符表

sub_1e3c8

sub_4b8c8 中多次调用的这个函数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
0001e3c8    char* sub_1e3c8(char* arg1, int64_t arg2, size_t arg3)

0001e3dc        uint64_t x8 = zx.q(*arg1)
0001e3ec        int64_t x1
0001e3ec        uint64_t x21
0001e3ec        
0001e3ec        if ((x8.d & 1) != 0)
0001e3fc            x21 = *(arg1 + 8)
0001e404            x1 = (*arg1 & 0xfffffffffffffffe) - 1
0001e3ec        else
0001e3f0            x21 = x8 u>> 1
0001e3f4            x1 = 0x16
0001e3f4        
0001e410        if (x1 - x21 u< arg3)
0001e430            sub_1e1d4(arg1, x1, x21 + arg3 - x1, x21, x21, 0, arg3, arg2)
0001e410        else if (arg3 != 0)
0001e43c            char* x22_1
0001e43c            
0001e43c            if ((x8.d & 1) != 0)
0001e448                x22_1 = *(arg1 + 0x10)
0001e43c            else
0001e440                x22_1 = &arg1[1]
0001e440            
0001e458            memcpy(&x22_1[x21], arg2, arg3)
0001e460            int64_t x8_2 = x21 + arg3
0001e460            
0001e464            if ((zx.d(*arg1) & 1) != 0)
0001e474                *(arg1 + 8) = x8_2
0001e464            else
0001e46c                *arg1 = (x8_2.d << 1).b
0001e46c            
0001e478            x22_1[x8_2] = 0
0001e478        
0001e490        return arg1

arg1：目标字符串对象,arg2：要追加的数据地址,arg3：要追加的数据长度

先判断 arg1 当前是短模式还是长模式，取出当前长度 size 和当前容量 capacity，判断剩余容量够不够追加 arg3 字节，够的话直接把 arg2 指向的数据复制到末尾，不够的话调用 sub_1e1d4 做扩容并追加，然后更新长度字段，在新末尾补 '\0'，返回 arg1

就是 append string 的逻辑

sub_1e070

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
0001e070    int64_t sub_1e070(size_t arg1)

0001e084        size_t bytes
0001e084        
0001e084        bytes = arg1 != 0 ? arg1 : 1
0001e084        
0001e08c        while (true)
0001e08c            int64_t result = malloc(bytes)
0001e08c            
0001e090            if (result != 0)
0001e0b0                return result
0001e0b0            
0001e094            int64_t x0_1 = sub_1f2ac()
0001e094            
0001e098            if (x0_1 == 0)
0001e098                break
0001e098            
0001e09c            x0_1()
0001e09c        
0001e0b8        struct std::exception::std::bad_alloc::VTable** x0_2 = sub_1e9e0(8)
0001e0c0        sub_34dc8(x0_2)
0001e0d8        sub_1ea58(x0_2, &_typeinfo_for_std::bad_alloc, sub_34da8)
0001e0d8        noreturn

相当于 C++ 里的 operator new(size_t) / allocator 的底层分配函数

sub_1e494

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
0001e494    char* sub_1e494(char* arg1, int64_t arg2, int64_t arg3)

0001e4a8        uint64_t x8 = zx.q(*arg1)
0001e4b0        uint64_t x9
0001e4b0        
0001e4b0        if ((x8.d & 1) != 0)
0001e4bc            x9 = *(arg1 + 8)
0001e4b0        else
0001e4b4            x9 = x8 u>> 1
0001e4b4        
0001e4c4        if (x9 u< arg2)
0001e56c            sub_1e168()
0001e56c            noreturn
0001e56c        
0001e4c8        if (arg3 != 0)
0001e4d0            if (arg3 != -1)
0001e4ec                char* x20_1
0001e4ec                uint64_t x21_1
0001e4ec                
0001e4ec                if ((x8.d & 1) != 0)
0001e50c                    x21_1 = *(arg1 + 8)
0001e50c                    x20_1 = *(arg1 + 0x10)
0001e4ec                else
0001e4f0                    x21_1 = x8 u>> 1
0001e4f4                    x20_1 = &arg1[1]
0001e4f4                
0001e510                int64_t x9_2 = x21_1 - arg2
0001e518                int64_t x22_1
0001e518                
0001e518                x22_1 = x9_2 u< arg3 ? x9_2 : arg3
0001e518                
0001e520                if (x9_2 != x22_1)
0001e524                    void* x0 = &x20_1[arg2]
0001e52c                    memmove(x0, x0 + x22_1, x9_2 - x22_1)
0001e530                    x8 = zx.q(*arg1)
0001e530                
0001e534                int64_t x9_3 = x21_1 - x22_1
0001e534                
0001e538                if ((x8.d & 1) != 0)
0001e548                    *(arg1 + 8) = x9_3
0001e538                else
0001e540                    *arg1 = (x9_3.d << 1).b
0001e540                
0001e54c                x20_1[x9_3] = 0
0001e4d0            else if ((x8.d & 1) != 0)
0001e500                (*(arg1 + 0x10))[arg2] = 0
0001e504                *(arg1 + 8) = arg2
0001e4d4            else
0001e4e0                arg1[arg2 + 1] = 0
0001e4e4                *arg1 = (arg2.d << 1).b
0001e4e4        
0001e564        return arg1

从位置 arg2 开始删除最多 arg3 个字符，并维护结尾 \0

结合反编译先 hook 一下参数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
function hook_sub_4B8C8(){
    const targetName = "libxyass.so";
    const dlopen_ptr = Module.getGlobalExportByName("android_dlopen_ext");
    if(dlopen_ptr){
        Interceptor.attach(dlopen_ptr,{
            onEnter:function(args){
                const path = args[0]?.readUtf8String();
                if (path && path.indexOf(targetName) !== -1) {
                    this.isTarget = true;
                }
            },
            onLeave:function(retval){
                if (this.isTarget) {
                    const mod = Process.findModuleByName(targetName);
                    if(mod){
                        let modBase = mod.base;
                        let funcAddr = modBase.add(0x4B8C8);
                        Interceptor.attach(funcAddr,{
                            onEnter:function(args){
                                console.log("\n");
                                console.log("[*] a1 = " + args[0]?.toInt32());
                                console.log(
                                            "[*] a2 =\n" +
                                            hexdump(args[1]!, {
                                                length: 64,
                                                ansi: true
                                            })
                                        );
                                console.log("[*] a3 = " + args[2]?.toInt32());
                                console.log("[*] a4 = " + args[3]?.toInt32());                             
                                console.log(
                                    "[*] a5 =\n" +
                                    hexdump(args[4]!, {
                                        length: 64,
                                        ansi: true
                                    })
                                );
                                console.log(
                                    "[*] a6 =\n" +
                                    hexdump(args[5]!, {
                                        length: args[6]!.toUInt32(),
                                        ansi: true
                                    })
                                );
                                console.log("[*] a7 = " + args[6]!.toInt32());

                                   
                            }
                        })
                    }

            }
        }
        })
    }

}

function getStdStringInfo(ptr: NativePointer) {
    if (ptr.isNull() || ptr.toUInt32() < 0x1000) {
        return { size: 0, data: ptr };
    }

    try {
        const firstByte = ptr.readU8();
        let size: number; 
        let dataPtr: NativePointer;

        if ((firstByte & 1) === 0) {
            // 短模式 
            size = firstByte >> 1;
            dataPtr = ptr.add(1);
        } else {
            // 长模式 
            size = ptr.add(8).readU64().toNumber();
            dataPtr = ptr.add(16).readPointer();
        }

        if (size > 100000) return { size: 0, data: ptr };

        return { size: size, data: dataPtr };
    } catch (e) {
        return { size: 0, data: ptr };
    }
}

部分日志如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
[*] a1 = 1
[*] a2 =
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
76ec8ba700  0e 39 31 39 33 38 30 33 00 00 00 00 00 00 00 00  .9193803........
76ec8ba710  50 1e eb ed 79 00 00 00 10 a7 8b ec 76 00 00 00  P...y.......v...
76ec8ba720  e0 a6 8b ec 76 00 00 00 d8 ff ff ff 80 ff ff ff  ....v...........
76ec8ba730  20 f1 7a d0 39 5d af 75 77 b9 fe 9d 1a 64 6e 63   .z.9].uw....dnc
[*] a3 = -319115519
[*] a4 = 4
[*] a5 =
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
76ec8ba6e8  31 00 00 00 00 00 00 00 24 00 00 00 00 00 00 00  1.......$.......
76ec8ba6f8  50 90 ed ed 79 00 00 00 0e 39 31 39 33 38 30 33  P...y....9193803
76ec8ba708  00 00 00 00 00 00 00 00 50 1e eb ed 79 00 00 00  ........P...y...
76ec8ba718  10 a7 8b ec 76 00 00 00 e0 a6 8b ec 76 00 00 00  ....v.......v...
[*] a6 =
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
76ec8ba731  f1 7a d0 39 5d af 75 77 b9 fe 9d 1a 64 6e 63 5c  .z.9].uw....dnc\
[*] a7 = 16


[*] a1 = 1
[*] a2 =
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
76aa228550  0e 39 31 39 33 38 30 33 00 00 00 00 00 00 00 00  .9193803........
76aa228560  50 1e eb ed 79 00 00 00 60 85 22 aa 76 00 00 00  P...y...`.".v...
76aa228570  30 85 22 aa 76 00 00 00 d8 ff ff ff 80 ff ff ff  0.".v...........
76aa228580  20 f6 e1 5f 18 eb 36 e5 9c 36 13 3e e9 22 be eb   .._..6..6.>."..
[*] a3 = -319115519
[*] a4 = 4
[*] a5 =
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
76aa228538  31 00 00 00 00 00 00 00 24 00 00 00 00 00 00 00  1.......$.......
76aa228548  90 59 f4 ed 79 00 00 00 0e 39 31 39 33 38 30 33  .Y..y....9193803
76aa228558  00 00 00 00 00 00 00 00 50 1e eb ed 79 00 00 00  ........P...y...
76aa228568  60 85 22 aa 76 00 00 00 30 85 22 aa 76 00 00 00  `.".v...0.".v...
[*] a6 =
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
76aa228581  f6 e1 5f 18 eb 36 e5 9c 36 13 3e e9 22 be eb 1d  .._..6..6.>."...
[*] a7 = 16


[*] a1 = 1
[*] a2 =
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
77ac5305c0  0e 39 31 39 33 38 30 33 00 00 00 00 00 00 00 00  .9193803........
77ac5305d0  50 1e eb ed 79 00 00 00 d0 05 53 ac 77 00 00 00  P...y.....S.w...
77ac5305e0  a0 05 53 ac 77 00 00 00 d8 ff ff ff 80 ff ff ff  ..S.w...........
77ac5305f0  20 17 ff 6a 49 ac 2c 90 dd 49 5e 5d 59 2b 8e 16   ..jI.,..I^]Y+..
[*] a3 = -319115519
[*] a4 = 4
[*] a5 =
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
77ac5305a8  31 00 00 00 00 00 00 00 24 00 00 00 00 00 00 00  1.......$.......
77ac5305b8  90 59 f4 ed 79 00 00 00 0e 39 31 39 33 38 30 33  .Y..y....9193803
77ac5305c8  00 00 00 00 00 00 00 00 50 1e eb ed 79 00 00 00  ........P...y...
77ac5305d8  d0 05 53 ac 77 00 00 00 a0 05 53 ac 77 00 00 00  ..S.w.....S.w...
[*] a6 =
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
77ac5305f1  17 ff 6a 49 ac 2c 90 dd 49 5e 5d 59 2b 8e 16 a6  ..jI.,..I^]Y+...
[*] a7 = 16

9193803 是版本号，a7 恒为 16,推测为 a6 的长度，a6 的 16 字节没什么规律，应该是经过某个加密后的数据

结合 ai 分析修缮了下 hook 脚本，把返回值顺便也 hook 出来

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
function hook_sub_4B8C8_v2() {
    const targetName = "libxyass.so";
    const mod = Process.findModuleByName(targetName);

    if (mod) {
        attach_to_func(mod.base);
    } else {
        const dlopen_ptr = Module.getGlobalExportByName("android_dlopen_ext");
        if (dlopen_ptr) {
            Interceptor.attach(dlopen_ptr, {
                onEnter: function (args) {
                    this.path = args[0]?.readUtf8String();
                },
                onLeave: function (retval) {
                    if (this.path && this.path.indexOf(targetName) !== -1) {
                        const m = Process.findModuleByName(targetName);
                        if (m) attach_to_func(m.base);
                    }
                }
            });
        }
    }
}
interface StdStringInfo {
    size: number;
    data: NativePointer;
    content: string | null;
}

function attach_to_func(modBase: NativePointer) {
    const funcAddr = modBase.add(0x4B8C8);
    console.log("[+] Hooking sub_4B8C8 at: " + funcAddr);

    Interceptor.attach(funcAddr, {
        onEnter: function (args) {

            const a1 = args[0].toInt32();
            const a3 = args[2].toInt32();
            const a4 = args[3].toInt32();
            const a7 = args[6].toInt32(); 

            // 解析 std::string 
            const str2 = getStdString(args[1]);
            const str5 = getStdString(args[4]);

            // this.arg8_ptr = this.context.x8; 
            this.arg8_ptr = (this.context as any).x8;
            if (this.arg8_ptr.toUInt32() < 0x1000) {
                this.arg8_ptr = args[7]; 
            }

            console.log("\n" + "=".repeat(40));
            console.log("[*] Call sub_4B8C8 ");
            console.log(`[+] arg1 (ID): ${a1} (Hex: 0x${a1.toString(16).padStart(8, '0')})`);
            console.log(`[+] arg3 (Serial): ${a3}`);
            console.log(`[+] arg4 (Type): ${a4} -> 转换为 Header 中的: ${a4 != 0 ? 2 : 1}`);
            
            console.log(`[+] arg2 (String 1):`);
            console.log(`    - Len: ${str2.size}`);
            console.log(`    - Content: ${str2.content}`);
            if (str2.size > 0) {
                console.log(hexdump(str2.data, { length: str2.size, ansi: true }));
            }

            console.log(`[+] arg5 (String 2):`);
            console.log(`    - Len: ${str5.size}`);
            console.log(`    - Content: ${str5.content}`);
            if (str5.size > 0) {
                console.log(hexdump(str5.data, { length: str5.size, ansi: true }));
            }

            console.log(`[+] arg6 (Raw Data):`);
            console.log(`    - Len (arg7): ${a7}`);
            if (a7 > 0 && !args[5].isNull()) {
                console.log(hexdump(args[5], { length: a7, ansi: true }));
            }
            console.log("=".repeat(40));
        },
        onLeave: function (retval) {
            const result = getStdString(this.arg8_ptr);
            console.log("\n[!] sub_4B8C8 Return:");
            if (result.size > 0) {
                console.log(`[*] Result Content: ${result.content}`);
            } else {
                console.log("[*] Result is empty");
            }
        }
    });
}
function getStdStringInfo(ptr: NativePointer) {
    if (ptr.isNull() || ptr.toUInt32() < 0x1000) {
        return { size: 0, data: ptr };
    }

    try {
        const firstByte = ptr.readU8();
        let size: number; 
        let dataPtr: NativePointer;

        if ((firstByte & 1) === 0) {
            // 短模式 
            size = firstByte >> 1;
            dataPtr = ptr.add(1);
        } else {
            // 长模式 
            size = ptr.add(8).readU64().toNumber();
            dataPtr = ptr.add(16).readPointer();
        }

        if (size > 100000) return { size: 0, data: ptr };

        return { size: size, data: dataPtr };
    } catch (e) {
        return { size: 0, data: ptr };
    }
}

function getStdString(ptr: NativePointer): StdStringInfo {
    if (ptr.isNull() || ptr.toUInt32() < 0x1000) {
        return { size: 0, data: ptr, content: null };
    }

    try {
        const firstByte = ptr.readU8();
        let size: number;
        let dataPtr: NativePointer;

        if ((firstByte & 1) === 0) {
            // 短模式 (SSO)
            size = firstByte >> 1;
            dataPtr = ptr.add(1);
        } else {
            // 长模式
            size = ptr.add(8).readU64().toNumber();
            dataPtr = ptr.add(16).readPointer();
        }

        let content: string | null = null;
        if (size > 0) {
            try {
                content = dataPtr.readUtf8String(size);
            } catch (e) {
                content = "[Binary/Non-UTF8 Data]";
            }
        } else {
            content = "";
        }

        return { size, data: dataPtr, content: content };
    } catch (e) {
        return { size: 0, data: ptr, content: "[Error Reading]" };
    }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
[*] Call sub_4B8C8 
[+] arg1 (ID): 1 (Hex: 0x00000001)
[+] arg3 (Serial): -319115519
[+] arg4 (Type): 4
[+] arg2 (String 1):
    - Len: 7
    - Content: 9193803
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
6ef29976c1  39 31 39 33 38 30 33                             9193803
[+] arg5 (String 2):
    - Len: 36
    - Content: 8de3ec7b-baa0-375f-bd3f-006dd6b65325
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
71ae32d090  38 64 65 33 65 63 37 62 2d 62 61 61 30 2d 33 37  8de3ec7b-baa0-37
71ae32d0a0  35 66 2d 62 64 33 66 2d 30 30 36 64 64 36 62 36  5f-bd3f-006dd6b6
71ae32d0b0  35 33 32 35                                      5325
[+] arg6 (Raw Data):
    - Len (arg7): 16
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
6ef29976f1  f1 7a d0 39 5d af 75 77 b9 fe 9d 1a 64 6e 63 5c  .z.9].uw....dnc\
========================================

[!] sub_4B8C8 Return:
[*] Result Content: AAQABAAAAAEAAABTAAAAUzUWEe0xG1IbD9/c+qCLOlKGmTtFa+lG438PdeJeRK5KkdGzy+VgHp2qrrFfz8Mt2Zt+g/YxRgxOEWPcML2m2i5jhOFkq6zm/xTkni2FplIyTZTn

RC4

中间部分很像 RC4

初始化 256 字节状态表

之后是 KSA ，key 为 std::abort();

这个 key 通过 frida hook 也能验证

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
function verify_rc4_key() {
    const targetSo = "libxyass.so";
    const mod = Process.findModuleByName(targetSo);
    if (!mod) {
        console.log("[-] Module not found");
        return;
    }

    const modBase = mod.base;

    const keyOffset = 0x1442E;  // 0xFFFFFFFFA0B51A0E = -0x5F4AE5F2，-0x5F4AE5F2 + 0x5F4C2A20 = 0x1442E
    const targetAddr = modBase.add(keyOffset);

    console.log(`\n[+] Module Base: ${modBase}`);
    console.log(`[+] Target Key Address: ${targetAddr}`);

    try {
        Memory.protect(targetAddr, 64, 'rwx'); 

        const keyContent = targetAddr.readUtf8String();
        const keyHex = targetAddr.readByteArray(13); // 密钥长度为 13

        console.log("[*] Confirmed Key String: " + keyContent);
        console.log("[*] Confirmed Key Hex: ");
        console.log(hexdump(keyHex as ArrayBuffer, { ansi: true }));

    } catch (e) {
        console.log("[-] Error reading key memory: " + e);
        try {
            console.log(hexdump(targetAddr.sub(16), { length: 64, ansi: true }));
        } catch(e2) {}
    }
}

hook 结果

1
2
3
4
5
6
[+] Module Base: 0x778ead6000
[+] Target Key Address: 0x778eaea42e
[*] Confirmed Key String: std::abort();
[*] Confirmed Key Hex: 
           0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
00000000  73 74 64 3a 3a 61 62 6f 72 74 28 29 3b           std::abort();

后面的循环则是 PRGA + XOR 输出，在循环里面更新索引，从状态表取值，swap，再取一个字节与明文异或

hook append 函数（sub_1e3c8）

这个 hook 确实是挺重要的一个 hook，很多推测和验证都是根据这个 hook 拿到的数据来分析的

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
function hook_1E3C8(){
    const targetName = "libxyass.so";
    const dlopen_ptr = Module.getGlobalExportByName("android_dlopen_ext");
    if(dlopen_ptr){
        Interceptor.attach(dlopen_ptr,{
            onEnter:function(args){
                const path = args[0]?.readUtf8String();
                if (path && path.indexOf(targetName) !== -1) {
                    this.isTarget = true;
                }
            },
            onLeave:function(retval){
                if (this.isTarget) {
                    const mod = Process.findModuleByName(targetName);
                    if(mod){
                        let modBase = mod.base;
                        let funcAddr = modBase.add(0x1E3C8);
                        Interceptor.attach(funcAddr, {
                            onEnter(args) {
                                // console.log("\n[+] === sub_1E3C8 ===");
                                this.strPtr = args[0];
                                this.src = args[1];
                                this.len = args[2]?.toInt32();

                                let before = getStdStringInfo(this.strPtr);
                                console.log("[*] SIZE before append: " + before.size);
                                if(before.size>0){
                                    console.log("[*] CONTENT before append:\n" + hexdump(before.data,{
                                        length:before.size,
                                    }))
                                }
                                console.log("[*] appending length: " + this.len);
                                if (this.len > 0 && !this.src.isNull()) {
                                    console.log("[*] Data to Append:\n" + hexdump(this.src, {
                                        length: this.len }));
                                }
                            },
                            onLeave(retval) {
                                let after = getStdStringInfo(this.strPtr);
                                console.log("[*] SIZE after append: "+ after.size);
                                if(after.size>0){
                                    console.log("[*] CONTENT after append:\n" + hexdump(after.data,{
                                        length:after.size,
                                    }
                                ))
                                }

                            }

                        });
                    }

            }
        }
        })
    }

}

这是其中一轮的日志

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
[+] === sub_1E3C8 ===
[*] SIZE before append: 24
[*] CONTENT before append:
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7a9dec8a90  00 00 00 01 ec fa af 01 00 00 00 02 00 00 00 07  ................
7a9dec8aa0  00 00 00 24 00 00 00 10                          ...$....
[*] appending length: 7
[*] Data to Append:
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
76fbf88701  39 31 39 33 38 30 33                             9193803
[*] SIZE after append: 31
[*] CONTENT after append:
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7a9dec8a90  00 00 00 01 ec fa af 01 00 00 00 02 00 00 00 07  ................
7a9dec8aa0  00 00 00 24 00 00 00 10 39 31 39 33 38 30 33     ...$....9193803

[+] Data Flow into sub_1E3C8 (Call 2)
[*] Length: 36
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
79edecb610  38 64 65 33 65 63 37 62 2d 62 61 61 30 2d 33 37  8de3ec7b-baa0-37
79edecb620  35 66 2d 62 64 33 66 2d 30 30 36 64 64 36 62 36  5f-bd3f-006dd6b6
79edecb630  35 33 32 35                                      5325

[+] === sub_1E3C8 ===
[*] SIZE before append: 31
[*] CONTENT before append:
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7a9dec8a90  00 00 00 01 ec fa af 01 00 00 00 02 00 00 00 07  ................
7a9dec8aa0  00 00 00 24 00 00 00 10 39 31 39 33 38 30 33     ...$....9193803
[*] appending length: 36
[*] Data to Append:
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
79edecb610  38 64 65 33 65 63 37 62 2d 62 61 61 30 2d 33 37  8de3ec7b-baa0-37
79edecb620  35 66 2d 62 64 33 66 2d 30 30 36 64 64 36 62 36  5f-bd3f-006dd6b6
79edecb630  35 33 32 35                                      5325
[*] SIZE after append: 67
[*] CONTENT after append:
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
790de3a430  00 00 00 01 ec fa af 01 00 00 00 02 00 00 00 07  ................
790de3a440  00 00 00 24 00 00 00 10 39 31 39 33 38 30 33 38  ...$....91938038
790de3a450  64 65 33 65 63 37 62 2d 62 61 61 30 2d 33 37 35  de3ec7b-baa0-375
790de3a460  66 2d 62 64 33 66 2d 30 30 36 64 64 36 62 36 35  f-bd3f-006dd6b65
790de3a470  33 32 35                                         325

[+] Data Flow into sub_1E3C8 (Call 3)
[*] Length: 16
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
76fbf881e9  f1 7a d0 39 5d af 75 77 b9 fe 9d 1a 64 6e 63 5c  .z.9].uw....dnc\

[+] === sub_1E3C8 ===
[*] SIZE before append: 67
[*] CONTENT before append:
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
790de3a430  00 00 00 01 ec fa af 01 00 00 00 02 00 00 00 07  ................
790de3a440  00 00 00 24 00 00 00 10 39 31 39 33 38 30 33 38  ...$....91938038
790de3a450  64 65 33 65 63 37 62 2d 62 61 61 30 2d 33 37 35  de3ec7b-baa0-375
790de3a460  66 2d 62 64 33 66 2d 30 30 36 64 64 36 62 36 35  f-bd3f-006dd6b65
790de3a470  33 32 35                                         325
[*] appending length: 16
[*] Data to Append:
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
76fbf881e9  f1 7a d0 39 5d af 75 77 b9 fe 9d 1a 64 6e 63 5c  .z.9].uw....dnc\
[*] SIZE after append: 83
[*] CONTENT after append:
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
796df98aa0  00 00 00 01 ec fa af 01 00 00 00 02 00 00 00 07  ................
796df98ab0  00 00 00 24 00 00 00 10 39 31 39 33 38 30 33 38  ...$....91938038
796df98ac0  64 65 33 65 63 37 62 2d 62 61 61 30 2d 33 37 35  de3ec7b-baa0-375
796df98ad0  66 2d 62 64 33 66 2d 30 30 36 64 64 36 62 36 35  f-bd3f-006dd6b65
796df98ae0  33 32 35 f1 7a d0 39 5d af 75 77 b9 fe 9d 1a 64  325.z.9].uw....d
796df98af0  6e 63 5c                                         nc\

=== RC4 Start ===
[*] Length: 83
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
76fbf88241  00 00 00 00 00 00 00 53 00 00 00 00 00 00 00 a0  .......S........
76fbf88251  8a f9 6d 79 00 00 00 80 00 00 00 33 98 27 cd 00  ..my.......3.'..
76fbf88261  00 00 00 00 00 00 00 7c 00 00 00 2e 00 00 00 0e  .......|........
76fbf88271  00 00 00 3d 00 00 00 09 00 00 00 32 00 00 00 e3  ...=.......2....

[!!!] CRITICAL: Final Binary Packet before Base64
[*] Length: 83
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7abde540b0  35 16 11 ed 31 1b 52 1b 0f df dc fa a0 8b 3a 52  5...1.R.......:R
7abde540c0  86 99 3b 45 6b e9 46 e3 7f 0f 75 e2 5e 44 ae 4a  ..;Ek.F...u.^D.J
7abde540d0  91 d1 b3 cb e5 60 1e 9d aa ae b1 5f cf c3 2d d9  .....`....._..-.
7abde540e0  9b 7e 83 f6 31 46 0c 4e 11 63 dc 30 bd a6 da 2e  .~..1F.N.c.0....
7abde540f0  63 84 e1 64 ab ac e6 ff 14 e4 9e 2d 85 a6 52 32  c..d.......-..R2
7abde54100  4d 94 e7                                         M..

[+] Data Flow into sub_1E3C8 (Call 4)
[*] Length: 83
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7abde540b0  35 16 11 ed 31 1b 52 1b 0f df dc fa a0 8b 3a 52  5...1.R.......:R
7abde540c0  86 99 3b 45 6b e9 46 e3 7f 0f 75 e2 5e 44 ae 4a  ..;Ek.F...u.^D.J
7abde540d0  91 d1 b3 cb e5 60 1e 9d aa ae b1 5f cf c3 2d d9  .....`....._..-.
7abde540e0  9b 7e 83 f6 31 46 0c 4e 11 63 dc 30 bd a6 da 2e  .~..1F.N.c.0....
7abde540f0  63 84 e1 64 ab ac e6 ff 14 e4 9e 2d 85 a6 52 32  c..d.......-..R2
7abde54100  4d 94 e7                                         M..

[+] === sub_1E3C8 ===
[*] SIZE before append: 16
[*] CONTENT before append:
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
76fbf881e9  00 04 00 04 00 00 00 01 00 00 00 53 00 00 00 53  ...........S...S
[*] appending length: 83
[*] Data to Append:
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7abde540b0  35 16 11 ed 31 1b 52 1b 0f df dc fa a0 8b 3a 52  5...1.R.......:R
7abde540c0  86 99 3b 45 6b e9 46 e3 7f 0f 75 e2 5e 44 ae 4a  ..;Ek.F...u.^D.J
7abde540d0  91 d1 b3 cb e5 60 1e 9d aa ae b1 5f cf c3 2d d9  .....`....._..-.
7abde540e0  9b 7e 83 f6 31 46 0c 4e 11 63 dc 30 bd a6 da 2e  .~..1F.N.c.0....
7abde540f0  63 84 e1 64 ab ac e6 ff 14 e4 9e 2d 85 a6 52 32  c..d.......-..R2
7abde54100  4d 94 e7                                         M..
[*] SIZE after append: 99
[*] CONTENT after append:
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7a8df3d1e0  00 04 00 04 00 00 00 01 00 00 00 53 00 00 00 53  ...........S...S
7a8df3d1f0  35 16 11 ed 31 1b 52 1b 0f df dc fa a0 8b 3a 52  5...1.R.......:R
7a8df3d200  86 99 3b 45 6b e9 46 e3 7f 0f 75 e2 5e 44 ae 4a  ..;Ek.F...u.^D.J
7a8df3d210  91 d1 b3 cb e5 60 1e 9d aa ae b1 5f cf c3 2d d9  .....`....._..-.
7a8df3d220  9b 7e 83 f6 31 46 0c 4e 11 63 dc 30 bd a6 da 2e  .~..1F.N.c.0....
7a8df3d230  63 84 e1 64 ab ac e6 ff 14 e4 9e 2d 85 a6 52 32  c..d.......-..R2
7a8df3d240  4d 94 e7                                         M..
=== Base64 output ===
AAQABAAAAAEAAABTAAAAUzUWEe0xG1IbD9/c+qCLOlKGmTtFa+lG438PdeJeRK5KkdGzy+VgHp2qrrFfz8Mt2Zt+g/YxRgxOEWPcML2m2i5jhOFkq6zm/xTkni2FplIyTZTn

根据这个结果可以看出，它先加载了 24 字节的数据，接着是版本号 9193803，然后是一个 UUID 8de3ec7b-baa0-375f-bd3f-006dd6b65325，最后是 16 字节的加密数据，到这里一共有 83 字节的数据，经过了 RC4 加密，加密后又追加了 16 字节的数据，最后对 99 字节的数据进行了 Base64 编码

并且可以验证这个 RC4 是标准的

观察多轮结果可以发现 RC4 结束后 append 的那 16 字节数据是固定的 00 04 00 04 00 00 00 01 00 00 00 53 00 00 00 53,变化的是进入 RC4 加密前的 16 字节

而对于最开始加载的 24 字节的 Header 其实是与参数相对应的

00 00 00 01 是 arg1 的大端表示

ec fa af 01 是 arg3 的大端表示

00 00 00 02

arg4 != 0 所以转换为 Header 中的 2

00 00 00 07 是 arg2 的长度（即版本号字符串 9193803 的长度）

00 00 00 24 是 arg5 的长度(即 UUID 字符串的长度)

00 00 00 10 是 arg6 的长度

sub_47338

分析这条链路的时候，有很多 br 间接跳转和混淆

把 Sections 中的 .data 由默认的可写改为只读，这样能解决一部分简单的间接跳转，bn 可以自动分析出来跳转地址

另外的间接跳转则要根据不同情况进行分析

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
int sub_47338(ctx_obj, arg2, arg3, ..., out_buf) {
    save_stack_cookie();

    session = sub_3f738(ctx_obj, arg2, data_9b610, ...);
    workbuf = ctx_obj->alloc_block(0x1000);
    state   = sub_84228();

    ok = sub_843b4_init(state, arg3[0], &arg3[1], 0x40);
    zero(var_7c, 0x14);

    if (!ok) {
        cleanup_state(state);
        format_default_output(out_buf, *arg3, var_78);
        out_buf[0x11] = 0;
        return;
    }

    mode, tag = sub_3f7d4(ctx_obj, session, data_9b618, ...);

    while (mode != -1) {
        block = ctx_obj->get_next_block(workbuf, 0);
        hexbuf = alloc(0x2010);
        bytes_to_hex_string(block, 0x1000, hexbuf, tag);

        sub_850d8(state, block, mode);              // 原始块处理
        result = ctx_obj->process_block(workbuf, block, 0); // 虚表 +0x600

        if (tag & 1)
            result = sub_1e0f4(hexbuf);            // hex 文本处理

        mode, tag = sub_3f7d4(ctx_obj, session, data_9b618, result...);
    }

    ctx_obj->release_block(workbuf);
    sub_85200(state, &var_78, &var_7c);            // 导出最终 16 字节结果
    cleanup_state(state);

    out_buf[0] = 0x20;
    memcpy(out_buf + 1, &var_78, 16);
    out_buf[0x11] = 0;
}

sub_850d8

虚函数调用，frida hook 或者 trace 的方式可以获取到 vtable 和函数偏移,得到的 0x85194 处调用的 function_offset 是 0x868d8,所以是 sub_868d8(x0, arg2, arg3)

同时这个函数也是一个小型的控制流平坦化，分发器通过 x9_2 的值来决定下一步执行的基本块

sub_868a8

0x868d8 跳转过去实际是在 sub_868a8 这个函数里面

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
000868a8    int64_t sub_868a8(void* arg1, int64_t arg2, size_t arg3)

000868bc        if (arg3 != 0)
000868c0            void* x21_1 = *(arg1 + 0x10)
000868c4            size_t x19_1 = arg3
000868cc            int64_t x20_1 = arg2
000868d0            int32_t x9_1 = *(x21_1 + 0x10)
000868d0            int32_t x10_1 = *(x21_1 + 0x14)
000868d4            uint64_t x8_1 = zx.q(*(x21_1 + 0x58))
000868dc            int32_t x10_2
000868dc            
000868dc            x10_2 = x9_1 + (x19_1.d << 3) u< x9_1 ? x10_1 + 1 : x10_1
000868dc            
000868e4            *(x21_1 + 0x10) = x9_1 + (x19_1.d << 3) // 字节数转 bit 数
000868e4            *(x21_1 + 0x14) = x10_2 + (arg3 u>> 0x1d).d // 更新总输入长度
000868e4            // 经典摘要算法里维护 message length 的方式

000868e8            if (x8_1.d == 0) // buf_used == 0，说明当前缓冲区是空的，直接去后面按整块处理
000868e8                goto label_8695c
000868e8            
                    // 如果缓冲区里已有数据，先尝试把它补满到 64 字节
000868f0            void* x22_1 = x21_1 + 0x18 // x22_1 = buffer 起始地址
000868fc            void* x0 = x22_1 + x8_1 // x0 = buffer 当前写入位置
000868fc            
00086900            if (((x8_1 + x19_1) | x19_1) u>= 0x40)
00086930                memcpy(x0, x20_1, 0x40 - x8_1)
00086940                int64_t x19_2
00086940                int64_t x20_2
00086940                int64_t x23_2
00086940                x19_2, x20_2, x21_1, x23_2 = sub_86e44(x21_1, x22_1, 1)
00086944                x20_1 = x20_2 + x23_2
00086948                x19_1 = x19_2 - x23_2
00086958                __builtin_memset(dest: x22_1, ch: 0, count: 0x44)
0008695c            label_8695c:
0008695c                uint64_t x2_2 = x19_1 u>> 6 // blocks = len / 64
0008695c                
00086960                if (x2_2 != 0)
0008696c                    int64_t x19_3
0008696c                    int64_t x20_3
0008696c                    x19_3, x20_3, x21_1 = sub_86e44(x21_1, x20_1, x2_2)
00086974                    x20_1 = x20_3 + (x19_3 & 0xffffffffffffffc0)
00086978                    x19_1 = x19_3 & 0x3f // remain = len % 64
00086978                
0008697c                if (x19_1 != 0)
0008698c                    *(x21_1 + 0x58) = x19_1.d
00086990                    memcpy(x21_1 + 0x18, x20_1, x19_1)
00086900            else
0008690c                memcpy(x0, x20_1, x19_1)
00086918                *(x21_1 + 0x58) += x19_1.d
00086918        
000869a8        return 1

很像是一个 hash update 的函数 Update(ctx, data, len)

根据反编译函数签名可以分析为 sub_868a8(ctx_wrapper* arg1, const uint8_t* data, size_t len)

arg1 是 外层对象, *(arg1 + 0x10) 是 hash context 结构体，arg2 是输入数据指针，arg3 是输入长度

sub_86e44

这个函数中由多个条件语句控制的间接跳转，修复好跳转后发现是嵌套了多层控制流平坦化的函数

详细分析见 BN IL 层解决多条件控制的双分支间接跳转

sub_89240

另外这个 so 里面还出现了不少这种结构的跳转，从 jump 往前分析可以看到，如果要计算最终的跳转地址，需要得到参数值，如果只是处理单个函数的这种结构的间接跳转的话，可以直接 frida hook 获取参数值获得地址，然后从地址中读值，就能计算出最后的跳转地址了，算出之后在 bn 的 mlil 层用 Set User Variable Value 的方式设置成 ConstantValue 填入计算出的固定值，bn 就能接着往下分析了

设置完之后发现又有新的跳转，并且跳转地址计算依赖于上次计算也同样涉及得到的 x24_3,那就直接给 x24_3 设置成算出的常量值

这样的话 bn 就能顺利分析下去了，并且下方出现了新的类似的跳转结构

在分析的过程中发现样本中有很多都是这样的结构，每次都改 frida 脚本和手动指定值很麻烦，于是考虑自动化实现这个过程

首先在 bn 中识别出这种跳转结构，并且收集计算跳转地址和进行 frida hook 所需要的所有数据，然后自动生成 frida 脚本，执行 hook 后，再用脚本批量赋值的方式给所有这种结构的跳转设置跳转地址

因为处理混淆的过程中先处理的这种跳转结构，再去处理的前面那种由多个条件语句控制的间接跳转，所以当时没有意识到这些结构就是被控制流平坦化打乱的一个个块

而在另一个函数中能明显的看出来

sub_886d0

这个函数和上面 sub_86e44 的混淆模式很像，虽然有三个条件，但是依旧在本质上是相同的 cond，而且最后的两个未解析出来的 jump 正是上面那些间接跳转块的结构

不同的是，这个函数有关地址的计算用到了传入的参数，这就对静态分析造成了很大的影响（其实最开始 bn 连 0x88760 处跳转的两个地址都没有算出来，图上能分析出来是手动指定过的），用解决 sub_86e44 方式就处理不了了，因为能解析出跳转地址的前提是能收集到所有计算需要的数据，而这个函数多处计算缺乏 arg 值，所以只能结合动态 hook 的结果来分析

一共进行三个步骤：bn 中识别结构准备 hook 所需数据 -> frida hook 收集 patch 数据 -> bn 中批量设置跳转地址

自动化收集数据

以 0x873f4 处的跳转为例，要求 x24_1 的值，需要 x24 的值和后面的常量，x24 的值依赖于 arg1

arg1 对应寄存器 x13,后续也直接收集对应的寄存器名字

所以第一个 bn 自动化脚本要做的事就是扫描所有函数，识别出该种结构的跳转，获取 jump 地址，jump 值 x24_1 定义处地址，收集常量 0x3abc9d8、算 x24 用到的寄存器 x13，偏移量为 0x80,同时关注从地址中读取的数据大小以及这个数据与常量的运算方式（因为可能在 mlil 层看到的是减去一个常量但实际是 add 操作加上一个负数，所以对这两种模式都作了匹配）

对 so 中所有函数进行上述操作，获得这些信息之后直接生成相应的 frida 脚本，就不用每次去手动修改 hook 代码了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
from binaryninja import *
from binaryninja.mediumlevelil import MediumLevelILOperation as Op
import json
import os

SO_NAME = "libxyass.so"
OUTPUT_JSON = r"D:\aaa\xhs\jump_patterns.json"
OUTPUT_JS   = r"D:\aaa\xhs\jump_patterns.frida.js"

MAX_DEPTH = 20

def add_op_if_exists(s, name):
    if hasattr(Op, name):
        s.add(getattr(Op, name))

WRAP_OPS = set()
for name in [
    "MLIL_ZX",
    "MLIL_SX",
    "MLIL_LOW_PART",
    "MLIL_BOOL_TO_INT",
]:
    add_op_if_exists(WRAP_OPS, name)

CONST_OPS = set()
for name in [
    "MLIL_CONST",
    "MLIL_CONST_PTR",
]:
    add_op_if_exists(CONST_OPS, name)

LOAD_OPS = set()
for name in [
    "MLIL_LOAD",
    "MLIL_LOAD_SSA",
]:
    add_op_if_exists(LOAD_OPS, name)

VAR_OPS = set()
for name in [
    "MLIL_VAR",
    "MLIL_VAR_SSA",
    "MLIL_VAR_FIELD",
    "MLIL_VAR_FIELD_SSA",
]:
    add_op_if_exists(VAR_OPS, name)

BIN_OPS = set()
for name in [
    "MLIL_ADD",
    "MLIL_SUB",
]:
    add_op_if_exists(BIN_OPS, name)


def hex0(x):
    if x is None:
        return None
    if x < 0:
        return "-0x%x" % (-x)
    return "0x%x" % x


def pv_unresolved(pv):
    if pv is None:
        return True
    s = str(pv).lower()
    t = str(getattr(pv, "type", "")).lower()
    if "undetermined" in s:
        return True
    if "unknown" in s:
        return True
    if "notset" in t:
        return True
    if "undetermined" in t:
        return True
    return False


def expr_text(expr):
    try:
        return str(expr)
    except:
        return "<expr>"


def get_const(expr):
    if expr is None:
        return None
    op = getattr(expr, "operation", None)
    if op in CONST_OPS:
        return int(expr.constant)
    return None


def get_var_from_expr(expr):
    if expr is None:
        return None

    if hasattr(expr, "var"):
        v = expr.var
        if hasattr(v, "var"):
            return v.var
        return v

    if hasattr(expr, "src"):
        s = expr.src
        if hasattr(s, "var"):
            return s.var
        if hasattr(s, "storage"):
            return s

    return None


def get_ssa_var(expr):
    if expr is None:
        return None
    if hasattr(expr, "src"):
        s = expr.src
        if hasattr(s, "var") and hasattr(s, "version"):
            return s
    if hasattr(expr, "var"):
        v = expr.var
        if hasattr(v, "var") and hasattr(v, "version"):
            return v
    return None


def get_param_infos(func):
    infos = []
    for p in func.parameter_vars:
        reg_name = None
        try:
            reg_name = func.arch.get_reg_name(p.storage)
        except:
            pass
        infos.append({
            "var": p,
            "arg_name": p.name,
            "reg": reg_name,
            "storage": getattr(p, "storage", None),
            "source_type": str(getattr(p, "source_type", "")),
        })
    return infos


def normalize_var(v):
    if v is None:
        return None

    # SSAVariable -> Variable
    if hasattr(v, "var"):
        try:
            return v.var
        except:
            pass

    return v

def match_param(func, var):
    var = normalize_var(var)
    if var is None:
        return None

    for info in get_param_infos(func):
        p = normalize_var(info["var"])
        if p is None:
            continue

        try:
            if var == p:
                return dict(info)
        except:
            pass

        if getattr(var, "name", None) == getattr(p, "name", None):
            return dict(info)

        if getattr(var, "storage", None) is not None and \
           getattr(var, "storage", None) == getattr(p, "storage", None):
            return dict(info)

    return None

def match_entry_reg(var):
    if var is None:
        return None

    # 注意：entry_x15 不要 normalize 掉
    name = getattr(var, "name", None) or str(var)

    if name.startswith("entry_x"):
        reg = name[len("entry_"):]   # entry_x15 -> x15
        return {
            "source_kind": "entry_reg",
            "arg_name": None,
            "base_reg": reg,
            "storage": getattr(var, "storage", None),
            "source_type": str(getattr(var, "source_type", "")),
        }

    return None

def parse_addr_from_arg(expr, mlil, func, depth=0):
    expr = peel_expr(expr, mlil, depth)
    if expr is None:
        return None

    op = getattr(expr, "operation", None)

    if op == Op.MLIL_ADD:
        left = peel_expr(expr.left, mlil, depth + 1)
        right = peel_expr(expr.right, mlil, depth + 1)

        c_left = get_const(left)
        c_right = get_const(right)

        if c_left is not None and c_right is None:
            base_expr = right
            off = c_left
        elif c_right is not None and c_left is None:
            base_expr = left
            off = c_right
        else:
            return None

        base_var = get_var_from_expr(base_expr)

        src_info = match_param(func, base_var)
        if src_info is None:
            src_info = match_entry_reg(base_var)
        if src_info is None:
            return None

        return {
            "arg_name": src_info.get("arg_name"),
            "base_reg": src_info.get("base_reg") or src_info.get("reg"),
            "load_off": off,
            "addr_expr": expr_text(expr),
            "source_kind": src_info.get("source_kind", "param"),
        }

    if op == Op.MLIL_SUB:
        left = peel_expr(expr.left, mlil, depth + 1)
        right = peel_expr(expr.right, mlil, depth + 1)

        c_right = get_const(right)
        if c_right is None:
            return None

        base_var = get_var_from_expr(left)

        src_info = match_param(func, base_var)
        if src_info is None:
            src_info = match_entry_reg(base_var)
        if src_info is None:
            return None

        return {
            "arg_name": src_info.get("arg_name"),
            "base_reg": src_info.get("base_reg") or src_info.get("reg"),
            "load_off": -c_right,
            "addr_expr": expr_text(expr),
            "source_kind": src_info.get("source_kind", "param"),
        }

    base_var = get_var_from_expr(expr)

    src_info = match_param(func, base_var)
    if src_info is None:
        src_info = match_entry_reg(base_var)
    if src_info is not None:
        return {
            "arg_name": src_info.get("arg_name"),
            "base_reg": src_info.get("base_reg") or src_info.get("reg"),
            "load_off": 0,
            "addr_expr": expr_text(expr),
            "source_kind": src_info.get("source_kind", "param"),
        }

    return None

def peel_expr(expr, mlil, depth=0):
    if expr is None:
        return None
    if depth > MAX_DEPTH:
        return expr

    while True:
        if expr is None:
            return None

        op = getattr(expr, "operation", None)

        if op in WRAP_OPS:
            expr = expr.src
            continue

        if op == Op.MLIL_VAR_SSA:
            ssa = get_ssa_var(expr)
            if ssa is None:
                return expr
            try:
                d = mlil.get_ssa_var_definition(ssa)
            except:
                d = None
            if d is None:
                return expr
            if getattr(d, "operation", None) == Op.MLIL_SET_VAR_SSA:
                expr = d.src
                depth += 1
                if depth > MAX_DEPTH:
                    return expr
                continue
            return expr

        return expr



def parse_load_from_arg(expr, mlil, func, depth=0):
    expr = peel_expr(expr, mlil, depth)
    if expr is None:
        return None

    op = getattr(expr, "operation", None)

    if op in LOAD_OPS:
        addr_info = parse_addr_from_arg(expr.src, mlil, func, depth + 1)
        if addr_info is None:
            return None

        size = getattr(expr, "size", None)
        return {
            "kind": "load_from_arg",
            "arg_name": addr_info["arg_name"],
            "base_reg": addr_info["base_reg"],
            "load_off": addr_info["load_off"],
            "load_size": size,
            "load_expr": expr_text(expr),
            "addr_expr": addr_info["addr_expr"],
        }

    return None


def sign_extend(value, bits):
    mask = (1 << bits) - 1
    value &= mask
    sign = 1 << (bits - 1)
    return (value ^ sign) - sign


def get_const(expr):
    if expr is None:
        return None
    op = getattr(expr, "operation", None)
    if op in CONST_OPS:
        v = int(expr.constant)
        size = getattr(expr, "size", None)
        if size:
            v = sign_extend(v, size * 8)
        return v
    return None


def parse_jump_target(expr, mlil, func, depth=0):
    expr = peel_expr(expr, mlil, depth)
    if expr is None or depth > MAX_DEPTH:
        return None

    op = getattr(expr, "operation", None)

    if op in (Op.MLIL_ADD, Op.MLIL_SUB):
        left = peel_expr(expr.left, mlil, depth + 1)
        right = peel_expr(expr.right, mlil, depth + 1)

        c_left = get_const(left)
        c_right = get_const(right)

        nonconst = None
        const_val = None

        if c_left is not None and c_right is None:
            nonconst = right
            const_val = c_left
        elif c_right is not None and c_left is None:
            nonconst = left
            const_val = c_right

        if nonconst is not None:
            load_info = parse_load_from_arg(nonconst, mlil, func, depth + 1)
            if load_info:
                # 统一成 add/sub + 正 delta
                if op == Op.MLIL_SUB:
                    arith_op = "sub"
                    delta = abs(const_val)
                else:
                    if const_val < 0:
                        arith_op = "sub"
                        delta = -const_val
                    else:
                        arith_op = "add"
                        delta = const_val

                return {
                    "pattern": "load_%s_const" % arith_op,
                    "arith_op": arith_op,
                    "delta": delta,
                    "source": load_info,
                    "final_expr": expr_text(expr),
                }

    load_info = parse_load_from_arg(expr, mlil, func, depth + 1)
    if load_info:
        return {
            "pattern": "plain_load",
            "arith_op": "none",
            "delta": 0,
            "source": load_info,
            "final_expr": expr_text(expr),
        }

    return None

def analyze_function(bv, func):
    results = []

    if func.mlil is None:
        return results
    if func.mlil.ssa_form is None:
        return results

    mlil = func.mlil.ssa_form

    for bb in mlil.basic_blocks:
        for insn in bb:
            if insn.operation != Op.MLIL_JUMP:
                continue

            dest = insn.dest
            pv = getattr(dest, "possible_values", None)
            if not pv_unresolved(pv):
                continue

            parsed = parse_jump_target(dest, mlil, func)
            if parsed is None:
                continue

            if parsed.get("arith_op") == "none":
                continue
            
            src = parsed["source"]
            rec = {
                "func_name": func.name,
                "func_start": hex0(func.start),
                "func_off": hex0(func.start - bv.start),
                "jump_addr": hex0(insn.address),
                "jump_off": hex0(insn.address - bv.start),
                "jump_expr": expr_text(dest),
                "arith_op": parsed["arith_op"],
                "delta": hex0(parsed["delta"]),
                "delta_int": parsed["delta"],
                "arg_name": src["arg_name"],
                "base_reg": src["base_reg"],
                "load_off": src["load_off"],
                "load_off_hex": hex0(src["load_off"]),
                "load_size": src["load_size"],
                "pattern": parsed["pattern"],
                "load_expr": src["load_expr"],
                "addr_expr": src["addr_expr"],
                "final_expr": parsed["final_expr"],
            }
            results.append(rec)

    return results


def emit_frida_js(records, out_path, so_name):
    js = []
    js.append("'use strict';")
    js.append("")
    js.append(f"const soName = '{so_name}';")
    js.append("const patterns = " + json.dumps(records, ensure_ascii=False, indent=2) + ";")
    js.append("")
    js.append("let installed = false;")
    js.append("const installedSet = new Set();")
    js.append("")
    js.append("function toInt(v) {")
    js.append("  if (typeof v === 'number') return v;")
    js.append("  if (v === null || v === undefined) return 0;")
    js.append("  const s = String(v).trim().toLowerCase();")
    js.append("  if (s.startsWith('-0x')) return -parseInt(s.slice(3), 16);")
    js.append("  if (s.startsWith('0x')) return parseInt(s, 16);")
    js.append("  return parseInt(s, 10);")
    js.append("}")
    js.append("")
    js.append("function hexSigned(v) {")
    js.append("  if (v === null || v === undefined) return '0x0';")
    js.append("  if (v < 0) return '-0x' + (-v).toString(16);")
    js.append("  return '0x' + v.toString(16);")
    js.append("}")
    js.append("")
    js.append("function logLocal(s) {")
    js.append("  console.log(s);")
    js.append("  try {")
    js.append("    send({ type: 'log', data: s });")
    js.append("  } catch (_) {")
    js.append("  }")
    js.append("}")
    js.append("")
    js.append("function sendJumpResult(obj) {")
    js.append("  try {")
    js.append("    send({ type: 'jump', data: obj });")
    js.append("  } catch (_) {")
    js.append("  }")
    js.append("}")
    js.append("")
    js.append("function readLoadedValue(basePtr, off, size) {")
    js.append("  const p = basePtr.add(off);")
    js.append("  if (size === 1) return ptr(p.readU8());")
    js.append("  if (size === 2) return ptr(p.readU16());")
    js.append("  if (size === 4) return ptr(p.readU32());")
    js.append("  return p.readPointer();")
    js.append("}")
    js.append("")
    js.append("function calcTarget(enc, op, delta) {")
    js.append("  if (op === 'sub') {")
    js.append("    if (delta >= 0) return enc.sub(delta);")
    js.append("    return enc.add(-delta);")
    js.append("  }")
    js.append("  if (op === 'add') {")
    js.append("    if (delta >= 0) return enc.add(delta);")
    js.append("    return enc.sub(-delta);")
    js.append("  }")
    js.append("  return enc;")
    js.append("}")
    js.append("")
    js.append("function normalizePattern(rec) {")
    js.append("  const jumpOff = toInt(rec.jump_off);")
    js.append("  const loadOff = rec.load_off !== undefined ? toInt(rec.load_off) : toInt(rec.load_off_hex);")
    js.append("  const delta = rec.delta_int !== undefined ? rec.delta_int : toInt(rec.delta);")
    js.append("  return {")
    js.append("    func_name: rec.func_name || 'unknown',")
    js.append("    jump_addr: rec.jump_addr || null,")
    js.append("    jump_off: jumpOff,")
    js.append("    jump_off_hex: rec.jump_off || hexSigned(jumpOff),")
    js.append("    base_reg: rec.base_reg,")
    js.append("    arg_name: rec.arg_name || null,")
    js.append("    load_off: loadOff,")
    js.append("    load_off_hex: rec.load_off_hex || hexSigned(loadOff),")
    js.append("    load_size: rec.load_size || 8,")
    js.append("    arith_op: rec.arith_op || 'none',")
    js.append("    delta: delta,")
    js.append("    delta_hex: rec.delta || hexSigned(delta),")
    js.append("    jump_expr: rec.jump_expr || '',")
    js.append("    load_expr: rec.load_expr || '',")
    js.append("    addr_expr: rec.addr_expr || '',")
    js.append("    final_expr: rec.final_expr || '',")
    js.append("    pattern: rec.pattern || ''")
    js.append("  };")
    js.append("}")
    js.append("")
    js.append("function installHooks() {")
    js.append("  const m = Process.findModuleByName(soName);")
    js.append("  if (!m) return false;")
    js.append("  if (installed) return true;")
    js.append("  installed = true;")
    js.append("")
    js.append("  const normalized = patterns.map(normalizePattern);")
    js.append("")
    js.append("  logLocal(`[+] installing ${normalized.length} hooks for ${soName}, base=${m.base}`);")
    js.append("")
    js.append("  for (const rec of normalized) {")
    js.append("    try {")
    js.append("      if (!rec.base_reg) {")
    js.append("        logLocal(`[!] skip ${rec.jump_off_hex}: no base_reg`);")
    js.append("        continue;")
    js.append("      }")
    js.append("")
    js.append("      const key = `${rec.jump_off_hex}:${rec.base_reg}:${rec.load_off_hex}:${rec.delta_hex}:${rec.arith_op}`;")
    js.append("      if (installedSet.has(key)) continue;")
    js.append("      installedSet.add(key);")
    js.append("")
    js.append("      const addr = m.base.add(rec.jump_off);")
    js.append("")
    js.append("      Interceptor.attach(addr, {")
    js.append("        onEnter() {")
    js.append("          try {")
    js.append("            const basePtr = this.context[rec.base_reg];")
    js.append("            if (basePtr === undefined || basePtr === null) {")
    js.append("              logLocal(`[!] missing ${rec.base_reg} @ ${rec.jump_off_hex}`);")
    js.append("              return;")
    js.append("            }")
    js.append("")
    js.append("            const enc = readLoadedValue(basePtr, rec.load_off, rec.load_size);")
    js.append("            const target = calcTarget(enc, rec.arith_op, rec.delta);")
    js.append("            const targetOff = target.sub(m.base);")
    js.append("")
    js.append("            logLocal('');")
    js.append("            logLocal('==== indirect jump hit ====');")
    js.append("            logLocal(`[+] func       = ${rec.func_name}`);")
    js.append("            logLocal(`[+] jump_off   = ${rec.jump_off_hex}`);")
    js.append("            logLocal(`[+] jump_addr  = ${addr}`);")
    js.append("            logLocal(`[+] base_reg   = ${rec.base_reg}`);")
    js.append("            logLocal(`[+] base_ptr   = ${basePtr}`);")
    js.append("            logLocal(`[+] load_off   = ${rec.load_off_hex}`);")
    js.append("            logLocal(`[+] enc        = ${enc}`);")
    js.append("            logLocal(`[+] op         = ${rec.arith_op}`);")
    js.append("            logLocal(`[+] delta      = ${rec.delta_hex}`);")
    js.append("            logLocal(`[+] target     = ${target}`);")
    js.append("            logLocal(`[+] target_off = ${targetOff}`);")
    js.append("            logLocal('===========================');")
    js.append("            logLocal('');")
    js.append("")
    js.append("            sendJumpResult({")
    js.append("              func_name: rec.func_name,")
    js.append("              jump_off: rec.jump_off_hex,")
    js.append("              jump_addr: String(addr),")
    js.append("              base_reg: rec.base_reg,")
    js.append("              base_ptr: String(basePtr),")
    js.append("              arg_name: rec.arg_name,")
    js.append("              load_off: rec.load_off_hex,")
    js.append("              load_size: rec.load_size,")
    js.append("              enc: String(enc),")
    js.append("              arith_op: rec.arith_op,")
    js.append("              delta: rec.delta_hex,")
    js.append("              target: String(target),")
    js.append("              target_off: String(targetOff),")
    js.append("              pattern: rec.pattern,")
    js.append("              jump_expr: rec.jump_expr,")
    js.append("              load_expr: rec.load_expr,")
    js.append("              addr_expr: rec.addr_expr,")
    js.append("              final_expr: rec.final_expr")
    js.append("            });")
    js.append("          } catch (e) {")
    js.append("            logLocal(`[!] hook failed @ ${rec.jump_off_hex}: ${e}`);")
    js.append("            logLocal(`    reg=${rec.base_reg} load_off=${rec.load_off_hex} delta=${rec.delta_hex} op=${rec.arith_op}`);")
    js.append("          }")
    js.append("        }")
    js.append("      });")
    js.append("    } catch (e) {")
    js.append("      logLocal(`[!] attach failed @ ${rec.jump_off_hex}: ${e}`);")
    js.append("    }")
    js.append("  }")
    js.append("")
    js.append("  return true;")
    js.append("}")
    js.append("")
    js.append("if (!installHooks()) {")
    js.append("  const android_dlopen_ext = Module.findGlobalExportByName('android_dlopen_ext');")
    js.append("  const dlopen = Module.findGlobalExportByName('dlopen');")
    js.append("")
    js.append("  function watch(sym) {")
    js.append("    if (!sym) return;")
    js.append("    Interceptor.attach(sym, {")
    js.append("      onEnter(args) {")
    js.append("        this.path = args[0].isNull() ? '' : args[0].readCString();")
    js.append("      },")
    js.append("      onLeave() {")
    js.append("        if (this.path.indexOf(soName) !== -1) {")
    js.append("          logLocal(`[+] detected load: ${this.path}`);")
    js.append("          installHooks();")
    js.append("        }")
    js.append("      }")
    js.append("    });")
    js.append("  }")
    js.append("")
    js.append("  watch(android_dlopen_ext);")
    js.append("  watch(dlopen);")
    js.append("}")
    js.append("")

    with open(out_path, "w", encoding="utf-8") as f:
        f.write("\n".join(js))


all_records = []

for func in bv.functions:
    try:
        recs = analyze_function(bv, func)
        if recs:
            all_records.extend(recs)
            print("[+] %s -> %d hit(s)" % (func.name, len(recs)))
    except Exception as e:
        print("[!] analyze %s failed: %s" % (func.name, e))

all_records.sort(key=lambda x: int(x["jump_addr"], 16))

with open(OUTPUT_JSON, "w", encoding="utf-8") as f:
    json.dump(all_records, f, ensure_ascii=False, indent=2)

emit_frida_js(all_records, OUTPUT_JS, SO_NAME)

print("")
print("[+] total patterns:", len(all_records))
print("[+] json saved to :", OUTPUT_JSON)
print("[+] js saved to   :", OUTPUT_JS)
print("")
for rec in all_records[:20]:
    print(
        "[*] %s jump@%s reg=%s off=%s delta=%s expr=%s"
        % (
            rec["func_name"],
            rec["jump_off"],
            rec["base_reg"],
            rec["load_off_hex"],
            rec["delta"],
            rec["jump_expr"],
        )
    )

可以看到 bn 成功识别出了结构匹配的跳转

frida hook

使用上一步生成的 frida 脚本进行 hook 操作，这里写了一个 python 脚本来执行 frida，因为直接在控制台打印日志太多太频繁了不方便查看，所以改成通过 send 的方式把数据发送回 python 脚本，由 python 来处理日志输出，同时可以生成两份格式的文件，一份便于自己阅读查看，一份便于后续写 bn python 脚本时读取内容来批量设置跳转地址

上面例子得到的 frida 脚本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
'use strict';

const soName = 'libxyass.so';
const patterns = [
  {
    "func_name": "sub_886d0",
    "func_start": "0x886d0",
    "func_off": "0x886d0",
    "jump_addr": "0x873f4",
    "jump_off": "0x873f4",
    "jump_expr": "x24_1#2",
    "arith_op": "add",
    "delta": "-0x3abc9d8",
    "delta_int": -61589976,
    "arg_name": "arg1",
    "base_reg": "x13",
    "load_off": 128,
    "load_off_hex": "0x80",
    "load_size": 8,
    "pattern": "load_plus_const",
    "load_expr": "[arg1#0 + 0x80].q @ mem#2",
    "addr_expr": "arg1#0 + 0x80",
    "final_expr": "x24#1 - 0x3abc9d8"
  },
  {
    "func_name": "sub_89240",
    "func_start": "0x89240",
    "func_off": "0x89240",
    "jump_addr": "0x88630",
    "jump_off": "0x88630",
    "jump_expr": "x3_50#69",
    "arith_op": "add",
    "delta": "-0x3df3530",
    "delta_int": -64959792,
    "arg_name": "arg11",
    "base_reg": "x14",
    "load_off": 144,
    "load_off_hex": "0x90",
    "load_size": 8,
    "pattern": "load_plus_const",
    "load_expr": "[arg11#0 + 0x90].q @ mem#38",
    "addr_expr": "arg11#0 + 0x90",
    "final_expr": "x26_15#21 - 0x3df3530"
  }
];

let installed = false;
const installedSet = new Set();

function toInt(v) {
  if (typeof v === 'number') return v;
  if (v === null || v === undefined) return 0;
  const s = String(v).trim().toLowerCase();
  if (s.startsWith('-0x')) return -parseInt(s.slice(3), 16);
  if (s.startsWith('0x')) return parseInt(s, 16);
  return parseInt(s, 10);
}

function hexSigned(v) {
  if (v === null || v === undefined) return '0x0';
  if (v < 0) return '-0x' + (-v).toString(16);
  return '0x' + v.toString(16);
}

function logLocal(s) {
  console.log(s);
  try {
    send({ type: 'log', data: s });
  } catch (_) {
  }
}

function sendJumpResult(obj) {
  try {
    send({ type: 'jump', data: obj });
  } catch (_) {
  }
}

function readLoadedValue(basePtr, off, size) {
  const p = basePtr.add(off);
  if (size === 1) return ptr(p.readU8());
  if (size === 2) return ptr(p.readU16());
  if (size === 4) return ptr(p.readU32());
  return p.readPointer();
}

function calcTarget(enc, op, delta) {
  if (op === 'sub') {
    if (delta >= 0) return enc.sub(delta);
    return enc.add(-delta);
  }
  if (op === 'add') {
    if (delta >= 0) return enc.add(delta);
    return enc.sub(-delta);
  }
  return enc;
}

function normalizePattern(rec) {
  const jumpOff = toInt(rec.jump_off);
  const loadOff = rec.load_off !== undefined ? toInt(rec.load_off) : toInt(rec.load_off_hex);
  const delta = rec.delta_int !== undefined ? rec.delta_int : toInt(rec.delta);
  return {
    func_name: rec.func_name || 'unknown',
    jump_addr: rec.jump_addr || null,
    jump_off: jumpOff,
    jump_off_hex: rec.jump_off || hexSigned(jumpOff),
    base_reg: rec.base_reg,
    arg_name: rec.arg_name || null,
    load_off: loadOff,
    load_off_hex: rec.load_off_hex || hexSigned(loadOff),
    load_size: rec.load_size || 8,
    arith_op: rec.arith_op || 'none',
    delta: delta,
    delta_hex: rec.delta || hexSigned(delta),
    jump_expr: rec.jump_expr || '',
    load_expr: rec.load_expr || '',
    addr_expr: rec.addr_expr || '',
    final_expr: rec.final_expr || '',
    pattern: rec.pattern || ''
  };
}

function installHooks() {
  const m = Process.findModuleByName(soName);
  if (!m) return false;
  if (installed) return true;
  installed = true;

  const normalized = patterns.map(normalizePattern);

  logLocal(`[+] installing ${normalized.length} hooks for ${soName}, base=${m.base}`);

  for (const rec of normalized) {
    try {
      if (!rec.base_reg) {
        logLocal(`[!] skip ${rec.jump_off_hex}: no base_reg`);
        continue;
      }

      const key = `${rec.jump_off_hex}:${rec.base_reg}:${rec.load_off_hex}:${rec.delta_hex}:${rec.arith_op}`;
      if (installedSet.has(key)) continue;
      installedSet.add(key);

      const addr = m.base.add(rec.jump_off);

      Interceptor.attach(addr, {
        onEnter() {
          try {
            const basePtr = this.context[rec.base_reg];
            if (basePtr === undefined || basePtr === null) {
              logLocal(`[!] missing ${rec.base_reg} @ ${rec.jump_off_hex}`);
              return;
            }

            const enc = readLoadedValue(basePtr, rec.load_off, rec.load_size);
            const target = calcTarget(enc, rec.arith_op, rec.delta);
            const targetOff = target.sub(m.base);

            logLocal('');
            logLocal('==== indirect jump hit ====');
            logLocal(`[+] func       = ${rec.func_name}`);
            logLocal(`[+] jump_off   = ${rec.jump_off_hex}`);
            logLocal(`[+] jump_addr  = ${addr}`);
            logLocal(`[+] base_reg   = ${rec.base_reg}`);
            logLocal(`[+] base_ptr   = ${basePtr}`);
            logLocal(`[+] load_off   = ${rec.load_off_hex}`);
            logLocal(`[+] enc        = ${enc}`);
            logLocal(`[+] op         = ${rec.arith_op}`);
            logLocal(`[+] delta      = ${rec.delta_hex}`);
            logLocal(`[+] target     = ${target}`);
            logLocal(`[+] target_off = ${targetOff}`);
            logLocal('===========================');
            logLocal('');

            sendJumpResult({
              func_name: rec.func_name,
              jump_off: rec.jump_off_hex,
              jump_addr: String(addr),
              base_reg: rec.base_reg,
              base_ptr: String(basePtr),
              arg_name: rec.arg_name,
              load_off: rec.load_off_hex,
              load_size: rec.load_size,
              enc: String(enc),
              arith_op: rec.arith_op,
              delta: rec.delta_hex,
              target: String(target),
              target_off: String(targetOff),
              pattern: rec.pattern,
              jump_expr: rec.jump_expr,
              load_expr: rec.load_expr,
              addr_expr: rec.addr_expr,
              final_expr: rec.final_expr
            });
          } catch (e) {
            logLocal(`[!] hook failed @ ${rec.jump_off_hex}: ${e}`);
            logLocal(`    reg=${rec.base_reg} load_off=${rec.load_off_hex} delta=${rec.delta_hex} op=${rec.arith_op}`);
          }
        }
      });
    } catch (e) {
      logLocal(`[!] attach failed @ ${rec.jump_off_hex}: ${e}`);
    }
  }

  return true;
}

if (!installHooks()) {
  const android_dlopen_ext = Module.findGlobalExportByName('android_dlopen_ext');
  const dlopen = Module.findGlobalExportByName('dlopen');

  function watch(sym) {
    if (!sym) return;
    Interceptor.attach(sym, {
      onEnter(args) {
        this.path = args[0].isNull() ? '' : args[0].readCString();
      },
      onLeave() {
        if (this.path.indexOf(soName) !== -1) {
          logLocal(`[+] detected load: ${this.path}`);
          installHooks();
        }
      }
    });
  }

  watch(android_dlopen_ext);
  watch(dlopen);
}

python 交互

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
import frida
import sys
import json
import os
import time
from pathlib import Path

PACKAGE_NAME = "com.xingin.xhs"
JS_PATH = "jump_patterns.frida.js"
TEXT_OUT = "jump_result.txt"
JSONL_OUT = "jump_result.jsonl"
USE_SPAWN = True

def write_text_line(path, text):
    with open(path, "a", encoding="utf-8", newline="\n") as f:
        f.write(text + "\n")
        f.flush()

def write_jsonl(path, obj):
    with open(path, "a", encoding="utf-8", newline="\n") as f:
        f.write(json.dumps(obj, ensure_ascii=False) + "\n")
        f.flush()

def init_output_files():
    with open(TEXT_OUT, "w", encoding="utf-8", newline="\n") as f:
        f.write("===== jump hook start =====\n")
    with open(JSONL_OUT, "w", encoding="utf-8", newline="\n") as f:
        f.write("")

def on_message(message, data):
    try:
        if message["type"] == "send":
            payload = message["payload"]

            if isinstance(payload, dict):
                msg_type = payload.get("type")

                if msg_type == "log":
                    line = str(payload.get("data", ""))
                    print(line)
                    write_text_line(TEXT_OUT, line)

                elif msg_type == "jump":
                    obj = payload.get("data", {})
                    pretty = (
                        f"[JUMP] func={obj.get('func_name')} "
                        f"jump_off={obj.get('jump_off')} "
                        f"target={obj.get('target')} "
                        f"target_off={obj.get('target_off')}"
                    )
                    print(pretty)
                    write_text_line(TEXT_OUT, pretty)
                    write_jsonl(JSONL_OUT, obj)

                else:
                    print(f"[SEND] {payload}")
                    write_text_line(TEXT_OUT, f"[SEND] {payload}")

            else:
                print(f"[SEND] {payload}")
                write_text_line(TEXT_OUT, f"[SEND] {payload}")

        elif message["type"] == "error":
            desc = message.get("description", "")
            stack = message.get("stack", "")
            out = "[FRIDA-ERROR] " + desc
            print(out)
            write_text_line(TEXT_OUT, out)
            if stack:
                print(stack)
                write_text_line(TEXT_OUT, stack)

        else:
            print(message)
            write_text_line(TEXT_OUT, str(message))
    except Exception as e:
        print(f"[HOST-ERROR] on_message failed: {e}")
        write_text_line(TEXT_OUT, f"[HOST-ERROR] on_message failed: {e}")

def load_js():
    with open(JS_PATH, "r", encoding="utf-8") as f:
        return f.read()

def main():
    if not Path(JS_PATH).exists():
        print(f"[!] JS file not found: {JS_PATH}")
        return

    init_output_files()

    print("[*] connecting usb device...")
    device = frida.get_usb_device(timeout=10)

    js_code = load_js()

    if USE_SPAWN:
        print(f"[*] spawning {PACKAGE_NAME} ...")
        pid = device.spawn([PACKAGE_NAME])
        session = device.attach(pid)
        script = session.create_script(js_code)
        script.on("message", on_message)
        script.load()
        print(f"[*] resuming pid {pid} ...")
        device.resume(pid)
    else:
        print(f"[*] attaching {PACKAGE_NAME} ...")
        session = device.attach(PACKAGE_NAME)
        script = session.create_script(js_code)
        script.on("message", on_message)
        script.load()

    print("[*] hook installed")
    print(f"[*] text output  -> {os.path.abspath(TEXT_OUT)}")
    print(f"[*] jsonl output -> {os.path.abspath(JSONL_OUT)}")
    print("[*] press Ctrl+C to stop")

    try:
        while True:
            time.sleep(1)
    except KeyboardInterrupt:
        print("\n[*] stopped")

if __name__ == "__main__":
    main()

hook 结果

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
===== jump hook start =====
[+] detected load: /data/app/~~aFy_2OaJJ9y0paWz5G_j2Q==/com.xingin.xhs-iJaR9BcYh84YvK07PTu_dA==/lib/arm64/libxyass.so
[+] installing 2 hooks for libxyass.so, base=0x7446548000

==== indirect jump hit ====
[+] func       = sub_89240
[+] jump_off   = 0x88630
[+] jump_addr  = 0x74465d0630
[+] base_reg   = x14
[+] base_ptr   = 0x74465e2000
[+] load_off   = 0x90
[+] enc        = 0x744a3c2928
[+] op         = add
[+] delta      = -0x3df3530
[+] target     = 0x74465cf3f8
[+] target_off = 0x873f8
===========================

[JUMP] func=sub_89240 jump_off=0x88630 target=0x74465cf3f8 target_off=0x873f8

==== indirect jump hit ====
[+] func       = sub_886d0
[+] jump_off   = 0x873f4
[+] jump_addr  = 0x74465cf3f4
[+] base_reg   = x13
[+] base_ptr   = 0x74465e2000
[+] load_off   = 0x80
[+] enc        = 0x744a08b8b8
[+] op         = add
[+] delta      = -0x3abc9d8
[+] target     = 0x74465ceee0
[+] target_off = 0x86ee0
===========================

[JUMP] func=sub_886d0 jump_off=0x873f4 target=0x74465ceee0 target_off=0x86ee0
批量设置跳转地址

hook 日志中有大量重复的内容，为了防止 patch 时重复设置值，读取 .jsonl 文件的记录后先按 (jump_off, target_off) 去重

核心 patch 用到了 set_user_var_value(var, definition_site, value) 这个 api，在 mlil 层批量设置指定的跳转地址

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
import json
from binaryninja import *
from binaryninja.mediumlevelil import MediumLevelILOperation as Op
from binaryninja import PossibleValueSet

JSONL_PATH = r"jump_result.jsonl"

def parse_int(v):
    if isinstance(v, int):
        return v
    if v is None:
        return None
    s = str(v).strip().lower()
    if s.startswith("-0x"):
        return -int(s[3:], 16)
    if s.startswith("0x"):
        return int(s, 16)
    return int(s)

def load_jsonl_dedup(path):
    recs = []
    seen = set()
    with open(path, "r", encoding="utf-8") as f:
        for line in f:
            s = line.strip()
            if not s:
                continue
            rec = json.loads(s)
            key = (rec.get("jump_off"), rec.get("target_off"))
            if key in seen:
                continue
            seen.add(key)
            recs.append(rec)
    print(f"[+] loaded {len(recs)} unique records")
    return recs

def all_mlil_ssa_insns(func):
    mlil = func.mlil.ssa_form
    for block in mlil.basic_blocks:
        for insn in block:
            yield insn

def find_jump_insn(func, jump_off):
    for insn in all_mlil_ssa_insns(func):
        if insn.address == jump_off and insn.operation in (Op.MLIL_JUMP, Op.MLIL_JUMP_TO):
            return insn
    return None

def get_ssa_var(expr):
    if expr.operation == Op.MLIL_VAR_SSA:
        return expr.src
    for op in expr.operands:
        if isinstance(op, MediumLevelILInstruction):
            v = get_ssa_var(op)
            if v:
                return v
    return None

def get_def_addr(func, ssa_var):
    try:
        ds = ssa_var.def_site
        if hasattr(ds, "address"):
            return ds.address
        return int(ds)
    except:
        for insn in all_mlil_ssa_insns(func):
            if insn.operation == Op.MLIL_SET_VAR_SSA and insn.dest == ssa_var:
                return insn.address
    return None

def patch_jump(rec, processed):
    jump_off = parse_int(rec.get("jump_off"))
    target_off = parse_int(rec.get("target_off"))
    key = (jump_off, target_off)
    if key in processed:
        return False
    processed.add(key)

    for func in bv.functions:
        insn = find_jump_insn(func, jump_off)
        if insn is None:
            insn = find_jump_insn(func, bv.start + jump_off)
        if insn is None:
            continue

        dest_expr = insn.dest
        ssa_var = get_ssa_var(dest_expr)
        if ssa_var is None:
            print(f"[!] no SSA var found at jump 0x{jump_off:x}")
            continue

        var = ssa_var.var
        def_addr = get_def_addr(func, ssa_var)
        if def_addr is None:
            print(f"[!] no def_addr for var {var} at jump 0x{jump_off:x}")
            continue

        value = PossibleValueSet.constant(target_off)
        func.set_user_var_value(var, def_addr, value, after=True)
        print(f"[+] patched: func={func.name} jump=0x{jump_off:x} var={var} def=0x{def_addr:x} target_off=0x{target_off:x}")
        return True
    return False

recs = load_jsonl_dedup(JSONL_PATH)
processed = set()
ok = 0
for rec in recs:
    if patch_jump(rec, processed):
        ok += 1

print("[+] update_analysis_and_wait() ...")
bv.update_analysis_and_wait()
print(f"[+] done: {ok}/{len(recs)} records patched")

成功设置 patch

需要注意的是，每次修好一个跳转后，bn 可能会分析出新的跳转，所以上面的操作需要多次执行，直到没有新的跳转结构被识别出来为止

后续遇到不同的跳转结构就修改识别规则，重复上面的流程

sub_89240

这个函数就是按照上面的步骤能够完全将间接跳转修好的,修好之后能看出它是被控制流平坦化了的

而且也是有多个分发器相互嵌套的

HMAC-MD5

把这条链路的间接跳转大致全部修好之后，通过反编译的内容结合 hook 分析出这是一个 HMAC-MD5 实现

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
const soName = 'libxyass.so';
const buffers = {};
function tryHook() {
  const m = Process.findModuleByName(soName);
  if (!m) return false; 
  const moduleBase = m.base;
  Interceptor.attach(ptr(moduleBase).add(0x868a8), {
    onEnter(args) {
        const ctx = args[0].toString();
        const dataPtr = args[1];
        const len = args[2].toInt32();

        this.ctx = ctx;
        this.len = len;

        if (len > 0 && !dataPtr.isNull()) {
            const chunk = dataPtr.readByteArray(len);

            if (!buffers[ctx]) {
                buffers[ctx] = [];
            }
            buffers[ctx].push(chunk);

            console.log("[MD5 update] ctx=" + ctx + " len=" + len);
            console.log(hexdump(chunk));
        }
    }
});

    Interceptor.attach(ptr(moduleBase).add(0x85200), {
    onEnter(args) {
        this.obj = args[0];
        this.outPtr = args[1];
        this.outLenPtr = args[2];
        this.ctxKey = this.obj.toString();
    },
    onLeave(retval) {
        if (retval.toInt32() !== 0 && !this.outPtr.isNull()) {
            const digest = this.outPtr.readByteArray(16);

            console.log("[MD5 final] ctx=" + this.ctxKey);
            console.log("digest:");
            console.log(hexdump(digest, { header: false, ansi: false }));

            const chunks = buffers[this.ctxKey] || [];
            console.log("update count=" + chunks.length);

            delete buffers[this.ctxKey];
        }
    }
});

  return true;
}

if (!tryHook()) {
  const android_dlopen_ext = Module.findGlobalExportByName('android_dlopen_ext');
  const dlopen = Module.findGlobalExportByName('dlopen');

  function watch(sym) {
    if (!sym) return;
    Interceptor.attach(sym, {
      onEnter(args) {
        this.path = args[0].isNull() ? '' : args[0].readCString();
      },
      onLeave() {
        if (this.path.indexOf(soName) !== -1) {
          tryHook();
        }
      }
    });
  }

  watch(android_dlopen_ext);
  watch(dlopen);
}

贴一小段 hook 结果

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
[MD5 update] ctx=0x7d8aacde90 len=64
           0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
00000000  19 da 55 e5 b3 33 ce 4d 85 ea c4 ed 14 39 aa 05  ..U..3.M.....9..
00000010  12 19 94 b4 0f 5c 88 d9 25 90 19 bf 14 a9 b7 73  .....\..%......s
00000020  11 eb ee 0f 5a f7 57 dc f4 fa 44 f2 bf 3a 24 50  ....Z.W...D..:$P
00000030  ce ab b4 d9 73 d6 9c c8 75 5c 58 38 11 27 bc 4a  ....s...u\X8.'.J
[MD5 update] ctx=0x7d8aacdb00 len=64
           0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
00000000  73 b0 3f 8f d9 59 a4 27 ef 80 ae 87 7e 53 c0 6f  s.?..Y.'....~S.o
00000010  78 73 fe de 65 36 e2 b3 4f fa 73 d5 7e c3 dd 19  xs..e6..O.s.~...
00000020  7b 81 84 65 30 9d 3d b6 9e 90 2e 98 d5 50 4e 3a  {..e0.=......PN:
00000030  a4 c1 de b3 19 bc f6 a2 1f 36 32 52 7b 4d d6 20  .........62R{M. 
[MD5 update] ctx=0x7d8aace130 len=97
           0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
00000000  2f 61 70 69 2f 68 74 74 70 64 6e 73 2f 70 72 65  /api/httpdns/pre
00000010  66 65 74 63 68 70 6c 61 74 66 6f 72 6d 3d 61 6e  fetchplatform=an
00000020  64 72 6f 69 64 26 62 75 69 6c 64 3d 39 31 39 33  droid&build=9193
00000030  38 30 33 26 64 65 76 69 63 65 49 64 3d 38 64 65  803&deviceId=8de
00000040  33 65 63 37 62 2d 62 61 61 30 2d 33 37 35 66 2d  3ec7b-baa0-375f-
00000050  62 64 33 66 2d 30 30 36 64 64 36 62 36 35 33 32  bd3f-006dd6b6532
00000060  35                                               5
[MD5 update] ctx=0x7d8aace130 len=16
           0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
00000000  77 df 88 7f 83 7d cf 67 6b 25 a3 b6 1b 59 ca 27  w....}.gk%...Y.'
[MD5 final] ctx=0x7ceaa634d0
digest:
00000000  f1 7a d0 39 5d af 75 77 b9 fe 9d 1a 64 6e 63 5c  .z.9].uw....dnc\

比对后可知 hook 得到的最后的 digest 就是在最前面的 RC4 中未知的那 16 字节

观察这个输出的前两个块，它们逐字节异或得到的全是 0x6a,而 HMAC 中的两个固定常量 ipad(0x36) 和 opad(0x5c) 相互异或的结果正好是 0x6a，加之这两个块在 hook 日志中重复出现，基本可以确定这两个块是 A = K ⊕ ipad,B = K ⊕ opad,但是问题又来了，要是按照一般的 HMAC-MD5 实现的话，也就是

1
2
inner = MD5(A || message)
final = MD5(B || inner)

但是经过验证，这样得到的结果和 hook 到的 digest 是不一致的，另外，在 final digest 前还有 16 字节的输出还没弄清来源

将中间状态也 hook 出来

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
const soName = 'libxyass.so';

let installed = false;
let watchedLoader = false;

const OFF_REAL_UPDATE = 0x868a8;
const OFF_FINAL_FUNC  = 0x85200;
const OFF_RESTORE_CTX = 0x86438;
const OFF_TRANSFORM   = 0x86e44;

const pendingByImpl = Object.create(null);

const finalThreadState = Object.create(null);

const hookedVirtualFns = new Set();

const recentUpdates = [];

function log(s) {
  console.log(s);
}

function nowMs() {
  return Date.now();
}

function ptrSafe(v) {
  try {
    return ptr(v);
  } catch (_) {
    return null;
  }
}

function safeReadPointer(p) {
  try {
    return p.readPointer();
  } catch (_) {
    return null;
  }
}

function safeReadU32(p) {
  try {
    return p.readU32();
  } catch (_) {
    return null;
  }
}

function safeReadS32(p) {
  try {
    return p.readS32();
  } catch (_) {
    return null;
  }
}

function safeReadByteArray(p, len) {
  try {
    return p.readByteArray(len);
  } catch (_) {
    return null;
  }
}

function hexOfByteArray(ab) {
  const u8 = new Uint8Array(ab);
  let out = '';
  for (let i = 0; i < u8.length; i++) {
    const x = u8[i].toString(16);
    out += (x.length === 1 ? '0' : '') + x;
  }
  return out;
}

function hexdumpShort(ptrOrBuf, len) {
  try {
    return hexdump(ptrOrBuf, {
      offset: 0,
      length: len,
      header: true,
      ansi: false
    });
  } catch (_) {
    return '<hexdump failed>';
  }
}

function ensureArray(map, key) {
  if (!map[key]) map[key] = [];
  return map[key];
}

function recordUpdate(impl, len, hex) {
  ensureArray(pendingByImpl, impl).push({
    impl,
    len,
    hex,
    ts: nowMs()
  });

  recentUpdates.push({
    impl,
    len,
    hex,
    ts: nowMs()
  });

  if (recentUpdates.length > 500) {
    recentUpdates.shift();
  }
}

function clearImplPending(impl) {
  if (impl && pendingByImpl[impl]) {
    delete pendingByImpl[impl];
  }
}

function getModuleBase() {
  const m = Process.findModuleByName(soName);
  return m ? m.base : null;
}

function resolveImplFromWrapper(wrapperPtr) {
  const wrapper = ptrSafe(wrapperPtr);
  if (!wrapper || wrapper.isNull()) return null;

  const holderPtr = safeReadPointer(wrapper.add(0x48));
  if (!holderPtr || holderPtr.isNull()) return null;

  const implPtr = safeReadPointer(holderPtr.add(Process.pointerSize));
  if (!implPtr || implPtr.isNull()) return null;

  return implPtr.toString();
}

function resolveRawCtxFromImpl(implPtrOrStr) {
  const impl = typeof implPtrOrStr === 'string' ? ptr(implPtrOrStr) : ptrSafe(implPtrOrStr);
  if (!impl || impl.isNull()) return null;

  const rawCtx = safeReadPointer(impl.add(0x10));
  if (!rawCtx || rawCtx.isNull()) return null;

  return rawCtx;
}

function readRawCtxState(rawCtxPtr) {
  const p = ptrSafe(rawCtxPtr);
  if (!p || p.isNull()) return null;

  const s0 = safeReadU32(p.add(0x00));
  const s1 = safeReadU32(p.add(0x04));
  const s2 = safeReadU32(p.add(0x08));
  const s3 = safeReadU32(p.add(0x0c));
  const bitLo = safeReadU32(p.add(0x10));
  const bitHi = safeReadU32(p.add(0x14));
  const buffered = safeReadU32(p.add(0x58)); // ctx[0x16]

  return {
    rawCtx: p.toString(),
    s0, s1, s2, s3,
    bitLo, bitHi,
    buffered
  };
}

function fmtU32(x) {
  if (x === null || x === undefined) return 'null';
  return '0x' + (x >>> 0).toString(16).padStart(8, '0');
}

function logRawCtxState(prefix, rawCtxPtr) {
  const st = readRawCtxState(rawCtxPtr);
  if (!st) {
    log(`${prefix} rawCtx=<null>`);
    return;
  }

  log(
    `${prefix} rawCtx=${st.rawCtx}` +
    ` A=${fmtU32(st.s0)}` +
    ` B=${fmtU32(st.s1)}` +
    ` C=${fmtU32(st.s2)}` +
    ` D=${fmtU32(st.s3)}` +
    ` bitLo=${fmtU32(st.bitLo)}` +
    ` bitHi=${fmtU32(st.bitHi)}` +
    ` buffered=${st.buffered}`
  );
}

function sendCase(payload) {
  try {
    send(payload);
  } catch (e) {
    log('[send failed] ' + e);
  }
}

function resolveVirtualPlus18(objPtrOrStr) {
  const obj = typeof objPtrOrStr === 'string' ? ptr(objPtrOrStr) : ptrSafe(objPtrOrStr);
  if (!obj || obj.isNull()) return null;

  const vtable = safeReadPointer(obj);
  if (!vtable || vtable.isNull()) return null;

  const fn = safeReadPointer(vtable.add(0x18));
  if (!fn || fn.isNull()) return null;

  return fn;
}


function installVirtualMethodHookIfNeeded(fnPtr) {
  const key = fnPtr.toString();
  if (hookedVirtualFns.has(key)) return;

  hookedVirtualFns.add(key);
  log(`[*] hook virtual +0x18 method @ ${key}`);

  Interceptor.attach(fnPtr, {
    onEnter(args) {
      const tid = Process.getCurrentThreadId();
      const st = finalThreadState[tid];

      this.tid = tid;
      this.obj = ptrSafe(args[0]);
      this.arg1 = ptrSafe(args[1]);
      this.arg2 = args[2];
      this.captureMode = null;
      this.inTrackedFinal = false;

      if (!st) return;
      if (!this.obj || this.obj.isNull()) return;
      if (st.impl !== this.obj.toString()) return;

      this.inTrackedFinal = true;

      let arg2Num = null;
      try {
        arg2Num = this.arg2.toUInt32();
      } catch (_) {
        arg2Num = null;
      }

      if (this.arg1 && !this.arg1.isNull() && arg2Num !== 16) {
        this.captureMode = 'maybe_final_to_tmp';
      }

      if (this.arg1 && !this.arg1.isNull() && arg2Num === 16) {
        this.captureMode = 'maybe_update_16';
      }

      if (this.inTrackedFinal) {
        const rawCtx = resolveRawCtxFromImpl(this.obj);
        logRawCtxState(`[VFUNC_ENTER ${this.captureMode}] impl=${this.obj}`, rawCtx);
      }
    },

    onLeave(retval) {
      if (!this.inTrackedFinal || !this.captureMode) return;

      const tid = this.tid;
      const st = finalThreadState[tid];
      if (!st) return;

      let ok = false;
      try {
        ok = retval.toInt32() !== 0;
      } catch (_) {
        ok = true;
      }
      if (!ok) return;

      const rawCtx = resolveRawCtxFromImpl(this.obj);
      logRawCtxState(`[VFUNC_LEAVE ${this.captureMode}] impl=${this.obj}`, rawCtx);

      if (this.captureMode === 'maybe_final_to_tmp') {
        const ab = safeReadByteArray(this.arg1, 16);
        if (!ab) return;

        const hex = hexOfByteArray(ab);
        st.suspectedInnerBuf = this.arg1.toString();
        st.suspectedInnerHex = hex;

        log(`[INNER_CANDIDATE] tid=${tid} impl=${st.impl} buf=${this.arg1} hex=${hex}`);
        log(hexdumpShort(this.arg1, 16));
      }

      if (this.captureMode === 'maybe_update_16') {
        const ab = safeReadByteArray(this.arg1, 16);
        if (!ab) return;

        const hex = hexOfByteArray(ab);
        log(`[UPDATE16_IN_FINAL] tid=${tid} impl=${st.impl} src=${this.arg1} hex=${hex}`);
        log(hexdumpShort(this.arg1, 16));
      }
    }
  });
}

function installHooks() {
  if (installed) return true;

  const base = getModuleBase();
  if (!base) return false;

  const realUpdate = base.add(OFF_REAL_UPDATE);
  const finalFunc  = base.add(OFF_FINAL_FUNC);
  const restoreCtx = base.add(OFF_RESTORE_CTX);
  const transform  = base.add(OFF_TRANSFORM);

  log(`[*] hooks installed @ ${base}`);

  Interceptor.attach(transform, {
    onEnter(args) {
      this.rawCtx = ptrSafe(args[0]);
      this.blockPtr = ptrSafe(args[1]);

      logRawCtxState('[TRANSFORM_ENTER]', this.rawCtx);

      if (this.blockPtr && !this.blockPtr.isNull()) {
        log('[TRANSFORM_BLOCK]');
        log(hexdumpShort(this.blockPtr, 64));
      }
    },
    onLeave(_) {
      logRawCtxState('[TRANSFORM_LEAVE]', this.rawCtx);
    }
  });

  Interceptor.attach(realUpdate, {
    onEnter(args) {
      const implPtr = ptrSafe(args[0]);
      const dataPtr = ptrSafe(args[1]);
      const lenVal  = args[2];

      if (!implPtr || implPtr.isNull() || !dataPtr || dataPtr.isNull()) return;

      let len = 0;
      try {
        len = lenVal.toInt32();
      } catch (_) {
        return;
      }
      if (len <= 0) return;

      const ab = safeReadByteArray(dataPtr, len);
      if (!ab) return;

      const impl = implPtr.toString();
      const hex = hexOfByteArray(ab);

      recordUpdate(impl, len, hex);

      const rawCtx = resolveRawCtxFromImpl(implPtr);

      log(`[UPDATE] impl=${impl} len=${len} pendingCount=${pendingByImpl[impl].length}`);
      logRawCtxState('[UPDATE_CTX_BEFORE]', rawCtx);

      if (len <= 128) {
        log(hexdumpShort(dataPtr, len));
      }

      this.impl = impl;
      this.rawCtx = rawCtx;
      this.len = len;

      sendCase({
        type: 'md5_update',
        impl,
        len,
        hex
      });
    },
    onLeave(_) {
      if (this.rawCtx) {
        logRawCtxState('[UPDATE_CTX_AFTER]', this.rawCtx);
      }
    }
  });

  Interceptor.attach(restoreCtx, {
    onEnter(args) {
      this.dst = ptrSafe(args[0]);
      this.src = ptrSafe(args[1]);

      const dstStr = this.dst ? this.dst.toString() : 'null';
      const srcStr = this.src ? this.src.toString() : 'null';

      log(`[RESTORE_CTX] dst=${dstStr} src=${srcStr}`);
      logRawCtxState('[RESTORE_DST_BEFORE]', resolveRawCtxFromImpl(this.dst));
      logRawCtxState('[RESTORE_SRC]', resolveRawCtxFromImpl(this.src));
    },
    onLeave(retval) {
      let ok = false;
      try {
        ok = retval.toInt32() !== 0;
      } catch (_) {
        ok = true;
      }
      const dstStr = this.dst ? this.dst.toString() : 'null';
      const srcStr = this.src ? this.src.toString() : 'null';

      log(`[RESTORE_CTX_RET] ok=${ok} dst=${dstStr} src=${srcStr}`);
      logRawCtxState('[RESTORE_DST_AFTER]', resolveRawCtxFromImpl(this.dst));
    }
  });

  Interceptor.attach(finalFunc, {
    onEnter(args) {
      const tid = Process.getCurrentThreadId();

      this.wrapperPtr = ptrSafe(args[0]);
      this.outPtr = ptrSafe(args[1]);
      this.outLenPtr = ptrSafe(args[2]);

      this.wrapper = this.wrapperPtr ? this.wrapperPtr.toString() : 'null';
      this.impl = resolveImplFromWrapper(this.wrapperPtr);
      this.enterTs = nowMs();

      const pendingAtEnter = this.impl && pendingByImpl[this.impl] ? pendingByImpl[this.impl].length : 0;

      finalThreadState[tid] = {
        wrapper: this.wrapper,
        impl: this.impl,
        enterTs: this.enterTs,
        suspectedInnerBuf: null,
        suspectedInnerHex: null
      };

      if (this.impl) {
        const fn = resolveVirtualPlus18(this.impl);
        if (fn) installVirtualMethodHookIfNeeded(fn);
      }

      log(`[FINAL_ENTER] tid=${tid} wrapper=${this.wrapper} impl=${this.impl} pendingAtEnter=${pendingAtEnter}`);
      logRawCtxState('[FINAL_ENTER_CTX]', resolveRawCtxFromImpl(this.impl));
    },

    onLeave(retval) {
      const tid = Process.getCurrentThreadId();
      const st = finalThreadState[tid];

      let ok = false;
      try {
        ok = retval.toInt32() !== 0;
      } catch (_) {
        ok = true;
      }
      if (!ok) {
        log(`[FINAL_LEAVE] tid=${tid} wrapper=${this.wrapper} impl=${this.impl} ret=0`);
        delete finalThreadState[tid];
        return;
      }

      let digestHex = null;
      if (this.outPtr && !this.outPtr.isNull()) {
        const digestAb = safeReadByteArray(this.outPtr, 16);
        if (digestAb) {
          digestHex = hexOfByteArray(digestAb);
          log(`[FINAL_DIGEST] tid=${tid} wrapper=${this.wrapper} impl=${this.impl} digest=${digestHex}`);
          log(hexdumpShort(this.outPtr, 16));
        }
      }

      logRawCtxState('[FINAL_LEAVE_CTX]', resolveRawCtxFromImpl(this.impl));

      const items = (this.impl && pendingByImpl[this.impl]) ? pendingByImpl[this.impl].slice() : [];
      const fullHex = items.map(x => x.hex).join('');

      log(`[FINAL_LEAVE] tid=${tid} wrapper=${this.wrapper} impl=${this.impl} itemCount=${items.length}`);
      log(`[FINAL_ITEMS] ${JSON.stringify(items.map(x => ({ impl: x.impl, len: x.len })))}`);

      if (fullHex.length > 0) {
        log(`[FULL_INPUT_LEN] ${fullHex.length / 2}`);
        log(`[FULL_INPUT_HEX] ${fullHex}`);
      } else {
        log('[FULL_INPUT_LEN] 0');
      }

      sendCase({
        type: 'md5_case',
        wrapper: this.wrapper,
        impl: this.impl,
        digest: digestHex,
        fullHex: fullHex,
        items: items,
        innerCandidateHex: st ? st.suspectedInnerHex : null,
        innerCandidateBuf: st ? st.suspectedInnerBuf : null
      });

      if (this.impl) clearImplPending(this.impl);
      delete finalThreadState[tid];
    }
  });

  installed = true;
  return true;
}


function watchDlopen() {
  if (watchedLoader) return;
  watchedLoader = true;

  const android_dlopen_ext = Module.findGlobalExportByName('android_dlopen_ext');
  const dlopen = Module.findGlobalExportByName('dlopen');

  function watch(sym) {
    if (!sym) return;

    Interceptor.attach(sym, {
      onEnter(args) {
        this.path = '';
        try {
          this.path = args[0].isNull() ? '' : args[0].readCString();
        } catch (_) {}
      },
      onLeave() {
        if (!this.path) return;
        if (this.path.indexOf(soName) === -1) return;

        log(`[*] observed load of ${soName}: ${this.path}`);
        try {
          installHooks();
        } catch (e) {
          log('[!] installHooks after dlopen failed: ' + e);
        }
      }
    });
  }

  watch(android_dlopen_ext);
  watch(dlopen);
}


(function main() {
  try {
    if (!installHooks()) {
      log(`[*] ${soName} not loaded yet, watching dlopen...`);
      watchDlopen();
    }
  } catch (e) {
    log('[!] main failed: ' + e);
  }
})();

贴一段输出

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
[UPDATE] impl=0x7d8aad4f40 len=64 pendingCount=1
[UPDATE_CTX_BEFORE] rawCtx=0x7dbaa91c90 A=0x10325476 B=0x98badcfe C=0xefcdab89 D=0x67452301 bitLo=0x00000000 bitHi=0x00000000 buffered=0
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7a0e23c4f0  19 da 55 e5 b3 33 ce 4d 85 ea c4 ed 14 39 aa 05  ..U..3.M.....9..
7a0e23c500  12 19 94 b4 0f 5c 88 d9 25 90 19 bf 14 a9 b7 73  .....\..%......s
7a0e23c510  11 eb ee 0f 5a f7 57 dc f4 fa 44 f2 bf 3a 24 50  ....Z.W...D..:$P
7a0e23c520  ce ab b4 d9 73 d6 9c c8 75 5c 58 38 11 27 bc 4a  ....s...u\X8.'.J
message: {'type': 'send', 'payload': {'type': 'md5_update', 'impl': '0x7d8aad4f40', 'len': 64, 'hex': '19da55e5b333ce4d85eac4ed1439aa05121994b40f5c88d9259019bf14a9b77311ebee0f5af757dcf4fa44f2bf3a2450ceabb4d973d69cc8755c58381127bc4a'}} data: None
[TRANSFORM_ENTER] rawCtx=0x7dbaa91c90 A=0x10325476 B=0x98badcfe C=0xefcdab89 D=0x67452301 bitLo=0x00000200 bitHi=0x00000000 buffered=0
[TRANSFORM_BLOCK]
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7a0e23c4f0  19 da 55 e5 b3 33 ce 4d 85 ea c4 ed 14 39 aa 05  ..U..3.M.....9..
7a0e23c500  12 19 94 b4 0f 5c 88 d9 25 90 19 bf 14 a9 b7 73  .....\..%......s
7a0e23c510  11 eb ee 0f 5a f7 57 dc f4 fa 44 f2 bf 3a 24 50  ....Z.W...D..:$P
7a0e23c520  ce ab b4 d9 73 d6 9c c8 75 5c 58 38 11 27 bc 4a  ....s...u\X8.'.J
[TRANSFORM_LEAVE] rawCtx=0x7dbaa91c90 A=0x941470d7 B=0x13fc57a3 C=0xcb2d64f4 D=0x2ca29856 bitLo=0x00000200 bitHi=0x00000000 buffered=0
[UPDATE_CTX_AFTER] rawCtx=0x7dbaa91c90 A=0x941470d7 B=0x13fc57a3 C=0xcb2d64f4 D=0x2ca29856 bitLo=0x00000200 bitHi=0x00000000 buffered=0
[UPDATE] impl=0x7d8aad50f0 len=64 pendingCount=1
[UPDATE_CTX_BEFORE] rawCtx=0x7dbaa8e9d0 A=0x10325476 B=0x98badcfe C=0xefcdab89 D=0x67452301 bitLo=0x00000000 bitHi=0x00000000 buffered=0
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7a0e23c4f0  73 b0 3f 8f d9 59 a4 27 ef 80 ae 87 7e 53 c0 6f  s.?..Y.'....~S.o
7a0e23c500  78 73 fe de 65 36 e2 b3 4f fa 73 d5 7e c3 dd 19  xs..e6..O.s.~...
7a0e23c510  7b 81 84 65 30 9d 3d b6 9e 90 2e 98 d5 50 4e 3a  {..e0.=......PN:
7a0e23c520  a4 c1 de b3 19 bc f6 a2 1f 36 32 52 7b 4d d6 20  .........62R{M. 
message:[TRANSFORM_ENTER] rawCtx=0x7dbaa8e9d0 A=0x10325476 B=0x98badcfe C=0xefcdab89 D=0x67452301 bitLo=0x00000200 bitHi=0x00000000 buffered=0 
{'type': 'send', 'payload': {'type': 'md5_update', 'impl': '0x7d8aad50f0', 'len': 64, 'hex': '73b03f8fd959a427ef80ae877e53c06f7873fede6536e2b34ffa73d57ec3dd197b818465309d3db69e902e98d5504e3aa4c1deb319bcf6a21f3632527b4dd620'}} data: None
[TRANSFORM_BLOCK]
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7a0e23c4f0  73 b0 3f 8f d9 59 a4 27 ef 80 ae 87 7e 53 c0 6f  s.?..Y.'....~S.o
7a0e23c500  78 73 fe de 65 36 e2 b3 4f fa 73 d5 7e c3 dd 19  xs..e6..O.s.~...
7a0e23c510  7b 81 84 65 30 9d 3d b6 9e 90 2e 98 d5 50 4e 3a  {..e0.=......PN:
7a0e23c520  a4 c1 de b3 19 bc f6 a2 1f 36 32 52 7b 4d d6 20  .........62R{M. 
[TRANSFORM_LEAVE] rawCtx=0x7dbaa8e9d0 A=0xd17e9742 B=0xae04d549 C=0xe6394cc0 D=0x453288e6 bitLo=0x00000200 bitHi=0x00000000 buffered=0
[UPDATE_CTX_AFTER] rawCtx=0x7dbaa8e9d0 A=0xd17e9742 B=0xae04d549 C=0xe6394cc0 D=0x453288e6 bitLo=0x00000200 bitHi=0x00000000 buffered=0
[RESTORE_CTX] dst=0x7d8aad4dc0 src=0x7d8aad4f40
[RESTORE_DST_BEFORE] rawCtx=<null>
[RESTORE_SRC] rawCtx=0x7dbaa91c90 A=0x941470d7 B=0x13fc57a3 C=0xcb2d64f4 D=0x2ca29856 bitLo=0x00000200 bitHi=0x00000000 buffered=0
[RESTORE_CTX_RET] ok=true dst=0x7d8aad4dc0 src=0x7d8aad4f40
[RESTORE_DST_AFTER] rawCtx=0x7dbaa90090 A=0x941470d7 B=0x13fc57a3 C=0xcb2d64f4 D=0x2ca29856 bitLo=0x00000200 bitHi=0x00000000 buffered=0
[UPDATE] impl=0x7d8aad4dc0 len=97 pendingCount=1
[UPDATE_CTX_BEFORE] rawCtx=0x7dbaa90090 A=0x941470d7 B=0x13fc57a3 C=0xcb2d64f4 D=0x2ca29856 bitLo=0x00000200 bitHi=0x00000000 buffered=0
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7d3aa7f6b0  2f 61 70 69 2f 68 74 74 70 64 6e 73 2f 70 72 65  /api/httpdns/pre
7d3aa7f6c0  66 65 74 63 68 70 6c 61 74 66 6f 72 6d 3d 61 6e  fetchplatform=an
7d3aa7f6d0  64 72 6f 69 64 26 62 75 69 6c 64 3d 39 31 39 33  droid&build=9193
7d3aa7f6e0  38 30 33 26 64 65 76 69 63 65 49 64 3d 38 64 65  803&deviceId=8de
7d3aa7f6f0  33 65 63 37 62 2d 62 61 61 30 2d 33 37 35 66 2d  3ec7b-baa0-375f-
7d3aa7f700  62 64 33 66 2d 30 30 36 64 64 36 62 36 35 33 32  bd3f-006dd6b6532
7d3aa7f710  35                                               5
message: {'type': 'send', 'payload': {'type': 'md5_update', 'impl': '0x7d8aad4dc0', 'len': 97, 'hex': '2f6170692f68747470646e732f7072656665746368706c6174666f726d3d616e64726f6964266275696c643d393139333830332664657669636549643d38646533656337622d626161302d333735662d626433662d303036646436623635333235'}} data: None
[TRANSFORM_ENTER] rawCtx=0x7dbaa90090 A=0x941470d7 B=0x13fc57a3 C=0xcb2d64f4 D=0x2ca29856 bitLo=0x00000508 bitHi=0x00000000 buffered=0
[TRANSFORM_BLOCK]
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7d3aa7f6b0  2f 61 70 69 2f 68 74 74 70 64 6e 73 2f 70 72 65  /api/httpdns/pre
7d3aa7f6c0  66 65 74 63 68 70 6c 61 74 66 6f 72 6d 3d 61 6e  fetchplatform=an
7d3aa7f6d0  64 72 6f 69 64 26 62 75 69 6c 64 3d 39 31 39 33  droid&build=9193
7d3aa7f6e0  38 30 33 26 64 65 76 69 63 65 49 64 3d 38 64 65  803&deviceId=8de
[TRANSFORM_LEAVE] rawCtx=0x7dbaa90090 A=0x09449ef3 B=0xbdec25f4 C=0x5d2106a8 D=0x2171e099 bitLo=0x00000508 bitHi=0x00000000 buffered=0
[UPDATE_CTX_AFTER] rawCtx=0x7dbaa90090 A=0x09449ef3 B=0xbdec25f4 C=0x5d2106a8 D=0x2171e099 bitLo=0x00000508 bitHi=0x00000000 buffered=33
[*] hook virtual +0x18 method @ 0x7aa04959ac
[FINAL_ENTER] tid=21605 wrapper=0x7ceaa94070 impl=0x7d8aad4dc0 pendingAtEnter=1
[FINAL_ENTER_CTX] rawCtx=0x7dbaa90090 A=0x09449ef3 B=0xbdec25f4 C=0x5d2106a8 D=0x2171e099 bitLo=0x00000508 bitHi=0x00000000 buffered=33
[TRANSFORM_ENTER] rawCtx=0x7dbaa90090 A=0x09449ef3 B=0xbdec25f4 C=0x5d2106a8 D=0x2171e099 bitLo=0x00000508 bitHi=0x00000000 buffered=33
[TRANSFORM_BLOCK]
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7dbaa900a8  33 65 63 37 62 2d 62 61 61 30 2d 33 37 35 66 2d  3ec7b-baa0-375f-
7dbaa900b8  62 64 33 66 2d 30 30 36 64 64 36 62 36 35 33 32  bd3f-006dd6b6532
7dbaa900c8  35 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00  5...............
7dbaa900d8  00 00 00 00 00 00 00 00 08 05 00 00 00 00 00 00  ................
[TRANSFORM_LEAVE] rawCtx=0x7dbaa90090 A=0x7f88df77 B=0x67cf7d83 C=0xb6a3256b D=0x27ca591b bitLo=0x00000508 bitHi=0x00000000 buffered=33
[RESTORE_CTX] dst=0x7d8aad4dc0 src=0x7d8aad50f0
[RESTORE_DST_BEFORE] rawCtx=0x7dbaa90090 A=0x00000000 B=0x00000000 C=0x00000000 D=0x00000000 bitLo=0x00000000 bitHi=0x00000000 buffered=0
[RESTORE_SRC] rawCtx=0x7dbaa8e9d0 A=0xd17e9742 B=0xae04d549 C=0xe6394cc0 D=0x453288e6 bitLo=0x00000200 bitHi=0x00000000 buffered=0
[RESTORE_CTX_RET] ok=true dst=0x7d8aad4dc0 src=0x7d8aad50f0
[RESTORE_DST_AFTER] rawCtx=0x7dbaa90090 A=0xd17e9742 B=0xae04d549 C=0xe6394cc0 D=0x453288e6 bitLo=0x00000200 bitHi=0x00000000 buffered=0
[UPDATE] impl=0x7d8aad4dc0 len=16 pendingCount=2
[UPDATE_CTX_BEFORE] rawCtx=0x7dbaa90090 A=0xd17e9742 B=0xae04d549 C=0xe6394cc0 D=0x453288e6 bitLo=0x00000200 bitHi=0x00000000 buffered=0
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7a0e23c548  77 df 88 7f 83 7d cf 67 6b 25 a3 b6 1b 59 ca 27  w....}.gk%...Y.'
message: [UPDATE_CTX_AFTER] rawCtx=0x7dbaa90090 A=0xd17e9742 B=0xae04d549 C=0xe6394cc0 D=0x453288e6 bitLo=0x00000280 bitHi=0x00000000 buffered=16
{'type': 'send', 'payload': {'type': 'md5_update', 'impl': '0x7d8aad4dc0', 'len': 16, 'hex': '77df887f837dcf676b25a3b61b59ca27'}} [VFUNC_ENTER maybe_update_16] impl=0x7d8aad4dc0 rawCtx=0x7dbaa90090 A=0xd17e9742 B=0xae04d549 C=0xe6394cc0 D=0x453288e6 bitLo=0x00000280 bitHi=0x00000000 buffered=16
data: None
[TRANSFORM_ENTER] rawCtx=0x7dbaa90090 A=0xd17e9742 B=0xae04d549 C=0xe6394cc0 D=0x453288e6 bitLo=0x00000280 bitHi=0x00000000 buffered=16
[TRANSFORM_BLOCK]
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7dbaa900a8  77 df 88 7f 83 7d cf 67 6b 25 a3 b6 1b 59 ca 27  w....}.gk%...Y.'
7dbaa900b8  80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
7dbaa900c8  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
7dbaa900d8  00 00 00 00 00 00 00 00 80 02 00 00 00 00 00 00  ................
[TRANSFORM_LEAVE] rawCtx=0x7dbaa90090 A=0x39d07af1 B=0x7775af5d C=0x1a9dfeb9 D=0x5c636e64 bitLo=0x00000280 bitHi=0x00000000 buffered=16
[VFUNC_LEAVE maybe_update_16] impl=0x7d8aad4dc0 rawCtx=0x7dbaa90090 A=0x39d07af1 B=0x7775af5d C=0x1a9dfeb9 D=0x5c636e64 bitLo=0x00000280 bitHi=0x00000000 buffered=0
[UPDATE16_IN_FINAL] tid=21605 impl=0x7d8aad4dc0 src=0x7a0e23c628 hex=f17ad0395daf7577b9fe9d1a646e635c
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7a0e23c628  f1 7a d0 39 5d af 75 77 b9 fe 9d 1a 64 6e 63 5c  .z.9].uw....dnc\
[FINAL_DIGEST] tid=21605 wrapper=0x7ceaa94070 impl=0x7d8aad4dc0 digest=f17ad0395daf7577b9fe9d1a646e635c
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7a0e23c628  f1 7a d0 39 5d af 75 77 b9 fe 9d 1a 64 6e 63 5c  .z.9].uw....dnc\
[FINAL_LEAVE_CTX] rawCtx=0x7dbaa90090 A=0x00000000 B=0x00000000 C=0x00000000 D=0x00000000 bitLo=0x00000000 bitHi=0x00000000 buffered=0
[FINAL_LEAVE] tid=21605 wrapper=0x7ceaa94070 impl=0x7d8aad4dc0 itemCount=2
[FINAL_ITEMS] [{"impl":"0x7d8aad4dc0","len":97},{"impl":"0x7d8aad4dc0","len":16}]
[FULL_INPUT_LEN] 113
[FULL_INPUT_HEX] 2f6170692f68747470646e732f7072656665746368706c6174666f726d3d616e64726f6964266275696c643d393139333830332664657669636549643d38646533656337622d626161302d333735662d626433662d30303664643662363533323577df887f837dcf676b25a3b61b59ca27
message: {'type': 'send', 'payload': {'type': 'md5_case', 'wrapper': '0x7ceaa94070', 'impl': '0x7d8aad4dc0', 'digest': 'f17ad0395daf7577b9fe9d1a646e635c', 'fullHex': '2f6170692f68747470646e732f7072656665746368706c6174666f726d3d616e64726f6964266275696c643d393139333830332664657669636549643d38646533656337622d626161302d333735662d626433662d30303664643662363533323577df887f837dcf676b25a3b61b59ca27', 'items': [{'impl': '0x7d8aad4dc0', 'len': 97, 'hex': '2f6170692f68747470646e732f7072656665746368706c6174666f726d3d616e64726f6964266275696c643d393139333830332664657669636549643d38646533656337622d626161302d333735662d626433662d303036646436623635333235', 'ts': 1775451374304}, {'impl': '0x7d8aad4dc0', 'len': 16, 'hex': '77df887f837dcf676b25a3b61b59ca27', 'ts': 1775451374312}], 'innerCandidateHex': None, 'innerCandidateBuf': None}} data: None

看到了 MD5 IV，以逆序存放
A=0x10325476 B=0x98badcfe C=0xefcdab89 D=0x67452301

同时也看到了 inner = md5(A + message)

1
2
3
4
[TRANSFORM_LEAVE] rawCtx=0x7dbaa90090 A=0x7f88df77 B=0x67cf7d83 C=0xb6a3256b D=0x27ca591b bitLo=0x00000508 bitHi=0x00000000 buffered=33

[UPDATE] len=16
77df887f837dcf676b25a3b61b59ca27

这里的 A B C D 拼起来 inner = 77df887f837dcf676b25a3b61b59ca27 正是最终摘要前的 16 字节

之后计算 md5(B + inner)

1
2
3
4
[TRANSFORM_LEAVE] rawCtx=0x7dbaa90090 A=0x39d07af1 B=0x7775af5d C=0x1a9dfeb9 D=0x5c636e64 bitLo=0x00000280 bitHi=0x00000000 buffered=16
[UPDATE16_IN_FINAL] tid=21605 impl=0x7d8aad4dc0 src=0x7a0e23c628 hex=f17ad0395daf7577b9fe9d1a646e635c
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7a0e23c628  f1 7a d0 39 5d af 75 77 b9 fe 9d 1a 64 6e 63 5c  .z.9].uw....dnc\

这个输出就是 final degist

不过按照标准 md5 还原的话与 hook 的结果是不一致的，应该做了魔改处理，这里就不展开了，总的链路已经梳理的差不多了，剩下的就是纯粹的算法逆向了

之后分析出来的结果这个 md5 除了上面的 IV 逆序外，旋转方向和位数也变了，第一轮右移的参数是 26,19,15,11,25,20,15,12,25,20,16,10,25,19,15,10,等价于左移 6,13,17,21,7,12,17,20,7,12,16,22,7,13,17,22,而标准的 md5 第一轮是左移 7,12,17,22 重复

另外它的 md5 k 常量表也与标准的不一样

1
2
3
0xD76AA478, 0xE8C7B756, 0x242070DB, 0xC1BDCEEE, 0xF57C0FAF,0x4787C62A, 0xA8304613, 0xFD469501,0x698098D8, 0x8B44F7AF, 0xFFFF5BB1, 0x895CD7BE, 0x6B901122, 0xFD987193, 0xA679438E, 0x49B40821,0xF61E2562, 0xC040B340, 0x265E5A51, 0xE9B6C7AA, 0xD62F105D, 0x02441453, 0xD8A1E681, 0xE7D3FBC8,
0x21E1CDE6, 0xC33707D6, 0xF4D50D87, 0x455A14ED, 0xA9E3E905,0xFCEFA3F8, 0x676F02D9, 0x8D2A4C8A,0xFFFA3942, 0x8771F681, 0x6D9D6122, 0xFDE5380C, 0xA4BEEA44, 0x4BDECFA9, 0xF6BB4B60, 0xBEBFBC70,0x289B7EC6, 0xEAA127FA, 0xD4EF3085, 0x04881D05, 0xD9D4D039, 0xE6DB99E5, 0x1FA27CF8, 0xC4AC5665,
0xF4292244, 0x432AFF97, 0xAB9423A7, 0xFC93A039, 0x655B59C3,0x8F0CCC92, 0xFFEFF47D, 0x85845DD1,0x6FA87E4F, 0xFE2CE6E0, 0xA3014314, 0x4E0811A1, 0xF7537E82, 0xBD3AF235, 0x2AD7D2BB, 0xEB86D391

魔改 AES

除此之外，上面 HMAC 中的 A B 块的数据异或前也是经过了加密的，因为 A B 块本身是通过一个 key 分别异或 0x36 和 0x5c 得到的，而这个 key 就是通过一个魔改 AES 得到的，其实就是白盒 AES

先用 deviceId 派生 AES-128 的 key，步骤如下：

1
2
3
4
5
raw = device_id.encode()[:16]
w0 = be32(raw[0:4])  ^ 0xF1892131
w1 = be32(raw[4:8])  ^ 0xFF001123
w2 = be32(raw[8:12]) ^ 0xF1001356
w3 = be32(raw[12:16])^ 0xF1234890

然后进行密钥拓展，用了 TBox_1 ~ TBox_4 来模拟 AES 的字节替换、循环左移和轮密钥加的操作

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
RCON = [
    0x12310000, 0x02000100, 0x04020000, 0x08020200, 0x10102000,
    0x30020400, 0x40002000, 0x80002000, 0x1B002000, 0x36200200
]

for round_index in range(10):
    base = round_index * 4

    old_w0 = ctx[base + 0]
    old_w1 = ctx[base + 1]
    old_w2 = ctx[base + 2]
    old_w3 = ctx[base + 3]

    # 从 old_w3 取 4 个字节，按 RotWord 后的顺序做查表替换
    # 本质上等价于 temp = SubWord(RotWord(old_w3))
    b0 = (old_w3 >> 24) & 0xFF
    b1 = (old_w3 >> 16) & 0xFF
    b2 = (old_w3 >> 8) & 0xFF
    b3 = old_w3 & 0xFF

    temp = 0
    temp ^= (TBox_3[b1] & 0xFF000000)
    temp ^= (TBox_4[b2] & 0x00FF0000)
    temp ^= (TBox_1[b3] & 0x0000FF00)
    temp ^= TBox_2[b0 * 4]

    # 再异或轮常量，相当于 ^ Rcon
    temp ^= RCON[round_index]

    # 生成下一轮 4 个 word
    new_w0 = old_w0 ^ temp
    new_w1 = old_w1 ^ new_w0
    new_w2 = old_w2 ^ new_w1
    new_w3 = old_w3 ^ new_w2

    ctx[base + 4] = new_w0
    ctx[base + 5] = new_w1
    ctx[base + 6] = new_w2
    ctx[base + 7] = new_w3

本质上就是在做

1
2
3
4
5
temp = SubWord(RotWord(prev_word)) ^ Rcon[i]
new_w0 = old_w0 ^ temp
new_w1 = old_w1 ^ new_w0
new_w2 = old_w2 ^ new_w1
new_w3 = old_w3 ^ new_w2

最后把加密轮密钥变成解密轮密钥，先反转轮密钥顺序，再用 TBox_2 + TBox_5~8 预处理成解密轮密钥

在 .rodata 可以找到 8 个 T 盒，每个都是 1024 字节

0x18198 处 TBox_1：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
0xC66363A5, 0xF87C7C84, 0xEE777799, 0xF67B7B8D, 0xFFF2F20D, 0xD66B6BBD, 0xDE6F6FB1, 0x91C5C554,
0x60303050, 0x02010103, 0xCE6767A9, 0x562B2B7D, 0xE7FEFE19, 0xB5D7D762, 0x4DABABE6, 0xEC76769A,
0x8FCACA45, 0x1F82829D, 0x89C9C940, 0xFA7D7D87, 0xEFFAFA15, 0xB25959EB, 0x8E4747C9, 0xFBF0F00B,
0x41ADADEC, 0xB3D4D467, 0x5FA2A2FD, 0x45AFAFEA, 0x239C9CBF, 0x53A4A4F7, 0xE4727296, 0x9BC0C05B,
0x75B7B7C2, 0xE1FDFD1C, 0x3D9393AE, 0x4C26266A, 0x6C36365A, 0x7E3F3F41, 0xF5F7F702, 0x83CCCC4F,
0x6834345C, 0x51A5A5F4, 0xD1E5E534, 0xF9F1F108, 0xE2717193, 0xABD8D873, 0x62313153, 0x2A15153F,
0x0804040C, 0x95C7C752, 0x46232365, 0x9DC3C35E, 0x30181828, 0x379696A1, 0x0A05050F, 0x2F9A9AB5,
0x0E070709, 0x24121236, 0x1B80809B, 0xDFE2E23D, 0xCDEBEB26, 0x4E272769, 0x7FB2B2CD, 0xEA75759F,
0x1209091B, 0x1D83839E, 0x582C2C74, 0x341A1A2E, 0x361B1B2D, 0xDC6E6EB2, 0xB45A5AEE, 0x5BA0A0FB,
0xA45252F6, 0x763B3B4D, 0xB7D6D661, 0x7DB3B3CE, 0x5229297B, 0xDDE3E33E, 0x5E2F2F71, 0x13848497,
0xA65353F5, 0xB9D1D168, 0x00000000, 0xC1EDED2C, 0x40202060, 0xE3FCFC1F, 0x79B1B1C8, 0xB65B5BED,
0xD46A6ABE, 0x8DCBCB46, 0x67BEBED9, 0x7239394B, 0x944A4ADE, 0x984C4CD4, 0xB05858E8, 0x85CFCF4A,
0xBBD0D06B, 0xC5EFEF2A, 0x4FAAAAE5, 0xEDFBFB16, 0x864343C5, 0x9A4D4DD7, 0x66333355, 0x11858594,
0x8A4545CF, 0xE9F9F910, 0x04020206, 0xFE7F7F81, 0xA05050F0, 0x783C3C44, 0x259F9FBA, 0x4BA8A8E3,
0xA25151F3, 0x5DA3A3FE, 0x804040C0, 0x058F8F8A, 0x3F9292AD, 0x219D9DBC, 0x70383848, 0xF1F5F504,
0x63BCBCDF, 0x77B6B6C1, 0xAFDADA75, 0x42212163, 0x20101030, 0xE5FFFF1A, 0xFDF3F30E, 0xBFD2D26D,
0x81CDCD4C, 0x180C0C14, 0x26131335, 0xC3ECEC2F, 0xBE5F5FE1, 0x359797A2, 0x884444CC, 0x2E171739,
0x93C4C457, 0x55A7A7F2, 0xFC7E7E82, 0x7A3D3D47, 0xC86464AC, 0xBA5D5DE7, 0x3219192B, 0xE6737395,
0xC06060A0, 0x19818198, 0x9E4F4FD1, 0xA3DCDC7F, 0x44222266, 0x542A2A7E, 0x3B9090AB, 0x0B888883,
0x8C4646CA, 0xC7EEEE29, 0x6BB8B8D3, 0x2814143C, 0xA7DEDE79, 0xBC5E5EE2, 0x160B0B1D, 0xADDBDB76,
0xDBE0E03B, 0x64323256, 0x743A3A4E, 0x140A0A1E, 0x924949DB, 0x0C06060A, 0x4824246C, 0xB85C5CE4,
0x9FC2C25D, 0xBDD3D36E, 0x43ACACEF, 0xC46262A6, 0x399191A8, 0x319595A4, 0xD3E4E437, 0xF279798B,
0xD5E7E732, 0x8BC8C843, 0x6E373759, 0xDA6D6DB7, 0x018D8D8C, 0xB1D5D564, 0x9C4E4ED2, 0x49A9A9E0,
0xD86C6CB4, 0xAC5656FA, 0xF3F4F407, 0xCFEAEA25, 0xCA6565AF, 0xF47A7A8E, 0x47AEAEE9, 0x10080818,
0x6FBABAD5, 0xF0787888, 0x4A25256F, 0x5C2E2E72, 0x381C1C24, 0x57A6A6F1, 0x73B4B4C7, 0x97C6C651,
0xCBE8E823, 0xA1DDDD7C, 0xE874749C, 0x3E1F1F21, 0x964B4BDD, 0x61BDBDDC, 0x0D8B8B86, 0x0F8A8A85,
0xE0707090, 0x7C3E3E42, 0x71B5B5C4, 0xCC6666AA, 0x904848D8, 0x06030305, 0xF7F6F601, 0x1C0E0E12,
0xC26161A3, 0x6A35355F, 0xAE5757F9, 0x69B9B9D0, 0x17868691, 0x99C1C158, 0x3A1D1D27, 0x279E9EB9,
0xD9E1E138, 0xEBF8F813, 0x2B9898B3, 0x22111133, 0xD26969BB, 0xA9D9D970, 0x078E8E89, 0x339494A7,
0x2D9B9BB6, 0x3C1E1E22, 0x15878792, 0xC9E9E920, 0x87CECE49, 0xAA5555FF, 0x50282878, 0xA5DFDF7A,
0x038C8C8F, 0x59A1A1F8, 0x09898980, 0x1A0D0D17, 0x65BFBFDA, 0xD7E6E631, 0x844242C6, 0xD06868B8,
0x824141C3, 0x299999B0, 0x5A2D2D77, 0x1E0F0F11, 0x7BB0B0CB, 0xA85454FC, 0x6DBBBBD6, 0x2C16163A

0x18598 处 TBox_2：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
0x63, 0x63, 0xC6, 0xA5, 0x7C, 0x7C, 0xF8, 0x84, 0x77, 0x77, 0xEE, 0x99, 0x7B, 0x7B, 0xF6, 0x8D,
0xF2, 0xF2, 0xFF, 0x0D, 0x6B, 0x6B, 0xD6, 0xBD, 0x6F, 0x6F, 0xDE, 0xB1, 0xC5, 0xC5, 0x91, 0x54,
0x30, 0x30, 0x60, 0x50, 0x01, 0x01, 0x02, 0x03, 0x67, 0x67, 0xCE, 0xA9, 0x2B, 0x2B, 0x56, 0x7D,
0xFE, 0xFE, 0xE7, 0x19, 0xD7, 0xD7, 0xB5, 0x62, 0xAB, 0xAB, 0x4D, 0xE6, 0x76, 0x76, 0xEC, 0x9A,
0xCA, 0xCA, 0x8F, 0x45, 0x82, 0x82, 0x1F, 0x9D, 0xC9, 0xC9, 0x89, 0x40, 0x7D, 0x7D, 0xFA, 0x87,
0xFA, 0xFA, 0xEF, 0x15, 0x59, 0x59, 0xB2, 0xEB, 0x47, 0x47, 0x8E, 0xC9, 0xF0, 0xF0, 0xFB, 0x0B,
0xAD, 0xAD, 0x41, 0xEC, 0xD4, 0xD4, 0xB3, 0x67, 0xA2, 0xA2, 0x5F, 0xFD, 0xAF, 0xAF, 0x45, 0xEA,
0x9C, 0x9C, 0x23, 0xBF, 0xA4, 0xA4, 0x53, 0xF7, 0x72, 0x72, 0xE4, 0x96, 0xC0, 0xC0, 0x9B, 0x5B,
0xB7, 0xB7, 0x75, 0xC2, 0xFD, 0xFD, 0xE1, 0x1C, 0x93, 0x93, 0x3D, 0xAE, 0x26, 0x26, 0x4C, 0x6A,
0x36, 0x36, 0x6C, 0x5A, 0x3F, 0x3F, 0x7E, 0x41, 0xF7, 0xF7, 0xF5, 0x02, 0xCC, 0xCC, 0x83, 0x4F,
0x34, 0x34, 0x68, 0x5C, 0xA5, 0xA5, 0x51, 0xF4, 0xE5, 0xE5, 0xD1, 0x34, 0xF1, 0xF1, 0xF9, 0x08,
0x71, 0x71, 0xE2, 0x93, 0xD8, 0xD8, 0xAB, 0x73, 0x31, 0x31, 0x62, 0x53, 0x15, 0x15, 0x2A, 0x3F,
0x04, 0x04, 0x08, 0x0C, 0xC7, 0xC7, 0x95, 0x52, 0x23, 0x23, 0x46, 0x65, 0xC3, 0xC3, 0x9D, 0x5E,
0x18, 0x18, 0x30, 0x28, 0x96, 0x96, 0x37, 0xA1, 0x05, 0x05, 0x0A, 0x0F, 0x9A, 0x9A, 0x2F, 0xB5,
0x07, 0x07, 0x0E, 0x09, 0x12, 0x12, 0x24, 0x36, 0x80, 0x80, 0x1B, 0x9B, 0xE2, 0xE2, 0xDF, 0x3D,
0xEB, 0xEB, 0xCD, 0x26, 0x27, 0x27, 0x4E, 0x69, 0xB2, 0xB2, 0x7F, 0xCD, 0x75, 0x75, 0xEA, 0x9F,
0x09, 0x09, 0x12, 0x1B, 0x83, 0x83, 0x1D, 0x9E, 0x2C, 0x2C, 0x58, 0x74, 0x1A, 0x1A, 0x34, 0x2E,
0x1B, 0x1B, 0x36, 0x2D, 0x6E, 0x6E, 0xDC, 0xB2, 0x5A, 0x5A, 0xB4, 0xEE, 0xA0, 0xA0, 0x5B, 0xFB,
0x52, 0x52, 0xA4, 0xF6, 0x3B, 0x3B, 0x76, 0x4D, 0xD6, 0xD6, 0xB7, 0x61, 0xB3, 0xB3, 0x7D, 0xCE,
0x29, 0x29, 0x52, 0x7B, 0xE3, 0xE3, 0xDD, 0x3E, 0x2F, 0x2F, 0x5E, 0x71, 0x84, 0x84, 0x13, 0x97,
0x53, 0x53, 0xA6, 0xF5, 0xD1, 0xD1, 0xB9, 0x68, 0x00, 0x00, 0x00, 0x00, 0xED, 0xED, 0xC1, 0x2C,
0x20, 0x20, 0x40, 0x60, 0xFC, 0xFC, 0xE3, 0x1F, 0xB1, 0xB1, 0x79, 0xC8, 0x5B, 0x5B, 0xB6, 0xED,
0x6A, 0x6A, 0xD4, 0xBE, 0xCB, 0xCB, 0x8D, 0x46, 0xBE, 0xBE, 0x67, 0xD9, 0x39, 0x39, 0x72, 0x4B,
0x4A, 0x4A, 0x94, 0xDE, 0x4C, 0x4C, 0x98, 0xD4, 0x58, 0x58, 0xB0, 0xE8, 0xCF, 0xCF, 0x85, 0x4A,
0xD0, 0xD0, 0xBB, 0x6B, 0xEF, 0xEF, 0xC5, 0x2A, 0xAA, 0xAA, 0x4F, 0xE5, 0xFB, 0xFB, 0xED, 0x16,
0x43, 0x43, 0x86, 0xC5, 0x4D, 0x4D, 0x9A, 0xD7, 0x33, 0x33, 0x66, 0x55, 0x85, 0x85, 0x11, 0x94,
0x45, 0x45, 0x8A, 0xCF, 0xF9, 0xF9, 0xE9, 0x10, 0x02, 0x02, 0x04, 0x06, 0x7F, 0x7F, 0xFE, 0x81,
0x50, 0x50, 0xA0, 0xF0, 0x3C, 0x3C, 0x78, 0x44, 0x9F, 0x9F, 0x25, 0xBA, 0xA8, 0xA8, 0x4B, 0xE3,
0x51, 0x51, 0xA2, 0xF3, 0xA3, 0xA3, 0x5D, 0xFE, 0x40, 0x40, 0x80, 0xC0, 0x8F, 0x8F, 0x05, 0x8A,
0x92, 0x92, 0x3F, 0xAD, 0x9D, 0x9D, 0x21, 0xBC, 0x38, 0x38, 0x70, 0x48, 0xF5, 0xF5, 0xF1, 0x04,
0xBC, 0xBC, 0x63, 0xDF, 0xB6, 0xB6, 0x77, 0xC1, 0xDA, 0xDA, 0xAF, 0x75, 0x21, 0x21, 0x42, 0x63,
0x10, 0x10, 0x20, 0x30, 0xFF, 0xFF, 0xE5, 0x1A, 0xF3, 0xF3, 0xFD, 0x0E, 0xD2, 0xD2, 0xBF, 0x6D,
0xCD, 0xCD, 0x81, 0x4C, 0x0C, 0x0C, 0x18, 0x14, 0x13, 0x13, 0x26, 0x35, 0xEC, 0xEC, 0xC3, 0x2F,
0x5F, 0x5F, 0xBE, 0xE1, 0x97, 0x97, 0x35, 0xA2, 0x44, 0x44, 0x88, 0xCC, 0x17, 0x17, 0x2E, 0x39,
0xC4, 0xC4, 0x93, 0x57, 0xA7, 0xA7, 0x55, 0xF2, 0x7E, 0x7E, 0xFC, 0x82, 0x3D, 0x3D, 0x7A, 0x47,
0x64, 0x64, 0xC8, 0xAC, 0x5D, 0x5D, 0xBA, 0xE7, 0x19, 0x19, 0x32, 0x2B, 0x73, 0x73, 0xE6, 0x95,
0x60, 0x60, 0xC0, 0xA0, 0x81, 0x81, 0x19, 0x98, 0x4F, 0x4F, 0x9E, 0xD1, 0xDC, 0xDC, 0xA3, 0x7F,
0x22, 0x22, 0x44, 0x66, 0x2A, 0x2A, 0x54, 0x7E, 0x90, 0x90, 0x3B, 0xAB, 0x88, 0x88, 0x0B, 0x83,
0x46, 0x46, 0x8C, 0xCA, 0xEE, 0xEE, 0xC7, 0x29, 0xB8, 0xB8, 0x6B, 0xD3, 0x14, 0x14, 0x28, 0x3C,
0xDE, 0xDE, 0xA7, 0x79, 0x5E, 0x5E, 0xBC, 0xE2, 0x0B, 0x0B, 0x16, 0x1D, 0xDB, 0xDB, 0xAD, 0x76,
0xE0, 0xE0, 0xDB, 0x3B, 0x32, 0x32, 0x64, 0x56, 0x3A, 0x3A, 0x74, 0x4E, 0x0A, 0x0A, 0x14, 0x1E,
0x49, 0x49, 0x92, 0xDB, 0x06, 0x06, 0x0C, 0x0A, 0x24, 0x24, 0x48, 0x6C, 0x5C, 0x5C, 0xB8, 0xE4,
0xC2, 0xC2, 0x9F, 0x5D, 0xD3, 0xD3, 0xBD, 0x6E, 0xAC, 0xAC, 0x43, 0xEF, 0x62, 0x62, 0xC4, 0xA6,
0x91, 0x91, 0x39, 0xA8, 0x95, 0x95, 0x31, 0xA4, 0xE4, 0xE4, 0xD3, 0x37, 0x79, 0x79, 0xF2, 0x8B,
0xE7, 0xE7, 0xD5, 0x32, 0xC8, 0xC8, 0x8B, 0x43, 0x37, 0x37, 0x6E, 0x59, 0x6D, 0x6D, 0xDA, 0xB7,
0x8D, 0x8D, 0x01, 0x8C, 0xD5, 0xD5, 0xB1, 0x64, 0x4E, 0x4E, 0x9C, 0xD2, 0xA9, 0xA9, 0x49, 0xE0,
0x6C, 0x6C, 0xD8, 0xB4, 0x56, 0x56, 0xAC, 0xFA, 0xF4, 0xF4, 0xF3, 0x07, 0xEA, 0xEA, 0xCF, 0x25,
0x65, 0x65, 0xCA, 0xAF, 0x7A, 0x7A, 0xF4, 0x8E, 0xAE, 0xAE, 0x47, 0xE9, 0x08, 0x08, 0x10, 0x18,
0xBA, 0xBA, 0x6F, 0xD5, 0x78, 0x78, 0xF0, 0x88, 0x25, 0x25, 0x4A, 0x6F, 0x2E, 0x2E, 0x5C, 0x72,
0x1C, 0x1C, 0x38, 0x24, 0xA6, 0xA6, 0x57, 0xF1, 0xB4, 0xB4, 0x73, 0xC7, 0xC6, 0xC6, 0x97, 0x51,
0xE8, 0xE8, 0xCB, 0x23, 0xDD, 0xDD, 0xA1, 0x7C, 0x74, 0x74, 0xE8, 0x9C, 0x1F, 0x1F, 0x3E, 0x21,
0x4B, 0x4B, 0x96, 0xDD, 0xBD, 0xBD, 0x61, 0xDC, 0x8B, 0x8B, 0x0D, 0x86, 0x8A, 0x8A, 0x0F, 0x85,
0x70, 0x70, 0xE0, 0x90, 0x3E, 0x3E, 0x7C, 0x42, 0xB5, 0xB5, 0x71, 0xC4, 0x66, 0x66, 0xCC, 0xAA,
0x48, 0x48, 0x90, 0xD8, 0x03, 0x03, 0x06, 0x05, 0xF6, 0xF6, 0xF7, 0x01, 0x0E, 0x0E, 0x1C, 0x12,
0x61, 0x61, 0xC2, 0xA3, 0x35, 0x35, 0x6A, 0x5F, 0x57, 0x57, 0xAE, 0xF9, 0xB9, 0xB9, 0x69, 0xD0,
0x86, 0x86, 0x17, 0x91, 0xC1, 0xC1, 0x99, 0x58, 0x1D, 0x1D, 0x3A, 0x27, 0x9E, 0x9E, 0x27, 0xB9,
0xE1, 0xE1, 0xD9, 0x38, 0xF8, 0xF8, 0xEB, 0x13, 0x98, 0x98, 0x2B, 0xB3, 0x11, 0x11, 0x22, 0x33,
0x69, 0x69, 0xD2, 0xBB, 0xD9, 0xD9, 0xA9, 0x70, 0x8E, 0x8E, 0x07, 0x89, 0x94, 0x94, 0x33, 0xA7,
0x9B, 0x9B, 0x2D, 0xB6, 0x1E, 0x1E, 0x3C, 0x22, 0x87, 0x87, 0x15, 0x92, 0xE9, 0xE9, 0xC9, 0x20,
0xCE, 0xCE, 0x87, 0x49, 0x55, 0x55, 0xAA, 0xFF, 0x28, 0x28, 0x50, 0x78, 0xDF, 0xDF, 0xA5, 0x7A,
0x8C, 0x8C, 0x03, 0x8F, 0xA1, 0xA1, 0x59, 0xF8, 0x89, 0x89, 0x09, 0x80, 0x0D, 0x0D, 0x1A, 0x17,
0xBF, 0xBF, 0x65, 0xDA, 0xE6, 0xE6, 0xD7, 0x31, 0x42, 0x42, 0x84, 0xC6, 0x68, 0x68, 0xD0, 0xB8,
0x41, 0x41, 0x82, 0xC3, 0x99, 0x99, 0x29, 0xB0, 0x2D, 0x2D, 0x5A, 0x77, 0x0F, 0x0F, 0x1E, 0x11,
0xB0, 0xB0, 0x7B, 0xCB, 0x54, 0x54, 0xA8, 0xFC, 0xBB, 0xBB, 0x6D, 0xD6, 0x16, 0x16, 0x2C, 0x3A

0x18998 处 TBox_3：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
0x63A5C663, 0x7C84F87C, 0x7799EE77, 0x7B8DF67B, 0xF20DFFF2, 0x6BBDD66B, 0x6FB1DE6F, 0xC55491C5,
0x30506030, 0x01030201, 0x67A9CE67, 0x2B7D562B, 0xFE19E7FE, 0xD762B5D7, 0xABE64DAB, 0x769AEC76,
0xCA458FCA, 0x829D1F82, 0xC94089C9, 0x7D87FA7D, 0xFA15EFFA, 0x59EBB259, 0x47C98E47, 0xF00BFBF0,
0xADEC41AD, 0xD467B3D4, 0xA2FD5FA2, 0xAFEA45AF, 0x9CBF239C, 0xA4F753A4, 0x7296E472, 0xC05B9BC0,
0xB7C275B7, 0xFD1CE1FD, 0x93AE3D93, 0x266A4C26, 0x365A6C36, 0x3F417E3F, 0xF702F5F7, 0xCC4F83CC,
0x345C6834, 0xA5F451A5, 0xE534D1E5, 0xF108F9F1, 0x7193E271, 0xD873ABD8, 0x31536231, 0x153F2A15,
0x040C0804, 0xC75295C7, 0x23654623, 0xC35E9DC3, 0x18283018, 0x96A13796, 0x050F0A05, 0x9AB52F9A,
0x07090E07, 0x12362412, 0x809B1B80, 0xE23DDFE2, 0xEB26CDEB, 0x27694E27, 0xB2CD7FB2, 0x759FEA75,
0x091B1209, 0x839E1D83, 0x2C74582C, 0x1A2E341A, 0x1B2D361B, 0x6EB2DC6E, 0x5AEEB45A, 0xA0FB5BA0,
0x52F6A452, 0x3B4D763B, 0xD661B7D6, 0xB3CE7DB3, 0x297B5229, 0xE33EDDE3, 0x2F715E2F, 0x84971384,
0x53F5A653, 0xD168B9D1, 0x00000000, 0xED2CC1ED, 0x20604020, 0xFC1FE3FC, 0xB1C879B1, 0x5BEDB65B,
0x6ABED46A, 0xCB468DCB, 0xBED967BE, 0x394B7239, 0x4ADE944A, 0x4CD4984C, 0x58E8B058, 0xCF4A85CF,
0xD06BBBD0, 0xEF2AC5EF, 0xAAE54FAA, 0xFB16EDFB, 0x43C58643, 0x4DD79A4D, 0x33556633, 0x85941185,
0x45CF8A45, 0xF910E9F9, 0x02060402, 0x7F81FE7F, 0x50F0A050, 0x3C44783C, 0x9FBA259F, 0xA8E34BA8,
0x51F3A251, 0xA3FE5DA3, 0x40C08040, 0x8F8A058F, 0x92AD3F92, 0x9DBC219D, 0x38487038, 0xF504F1F5,
0xBCDF63BC, 0xB6C177B6, 0xDA75AFDA, 0x21634221, 0x10302010, 0xFF1AE5FF, 0xF30EFDF3, 0xD26DBFD2,
0xCD4C81CD, 0x0C14180C, 0x13352613, 0xEC2FC3EC, 0x5FE1BE5F, 0x97A23597, 0x44CC8844, 0x17392E17,
0xC45793C4, 0xA7F255A7, 0x7E82FC7E, 0x3D477A3D, 0x64ACC864, 0x5DE7BA5D, 0x192B3219, 0x7395E673,
0x60A0C060, 0x81981981, 0x4FD19E4F, 0xDC7FA3DC, 0x22664422, 0x2A7E542A, 0x90AB3B90, 0x88830B88,
0x46CA8C46, 0xEE29C7EE, 0xB8D36BB8, 0x143C2814, 0xDE79A7DE, 0x5EE2BC5E, 0x0B1D160B, 0xDB76ADDB,
0xE03BDBE0, 0x32566432, 0x3A4E743A, 0x0A1E140A, 0x49DB9249, 0x060A0C06, 0x246C4824, 0x5CE4B85C,
0xC25D9FC2, 0xD36EBDD3, 0xACEF43AC, 0x62A6C462, 0x91A83991, 0x95A43195, 0xE437D3E4, 0x798BF279,
0xE732D5E7, 0xC8438BC8, 0x37596E37, 0x6DB7DA6D, 0x8D8C018D, 0xD564B1D5, 0x4ED29C4E, 0xA9E049A9,
0x6CB4D86C, 0x56FAAC56, 0xF407F3F4, 0xEA25CFEA, 0x65AFCA65, 0x7A8EF47A, 0xAEE947AE, 0x08181008,
0xBAD56FBA, 0x7888F078, 0x256F4A25, 0x2E725C2E, 0x1C24381C, 0xA6F157A6, 0xB4C773B4, 0xC65197C6,
0xE823CBE8, 0xDD7CA1DD, 0x749CE874, 0x1F213E1F, 0x4BDD964B, 0xBDDC61BD, 0x8B860D8B, 0x8A850F8A,
0x7090E070, 0x3E427C3E, 0xB5C471B5, 0x66AACC66, 0x48D89048, 0x03050603, 0xF601F7F6, 0x0E121C0E,
0x61A3C261, 0x355F6A35, 0x57F9AE57, 0xB9D069B9, 0x86911786, 0xC15899C1, 0x1D273A1D, 0x9EB9279E,
0xE138D9E1, 0xF813EBF8, 0x98B32B98, 0x11332211, 0x69BBD269, 0xD970A9D9, 0x8E89078E, 0x94A73394,
0x9BB62D9B, 0x1E223C1E, 0x87921587, 0xE920C9E9, 0xCE4987CE, 0x55FFAA55, 0x28785028, 0xDF7AA5DF,
0x8C8F038C, 0xA1F859A1, 0x89800989, 0x0D171A0D, 0xBFDA65BF, 0xE631D7E6, 0x42C68442, 0x68B8D068,
0x41C38241, 0x99B02999, 0x2D775A2D, 0x0F111E0F, 0xB0CB7BB0, 0x54FCA854, 0xBBD66DBB, 0x163A2C16

0x18d98 处 TBox_4：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
0x6363A5C6, 0x7C7C84F8, 0x777799EE, 0x7B7B8DF6, 0xF2F20DFF, 0x6B6BBDD6, 0x6F6FB1DE, 0xC5C55491,
0x30305060, 0x01010302, 0x6767A9CE, 0x2B2B7D56, 0xFEFE19E7, 0xD7D762B5, 0xABABE64D, 0x76769AEC,
0xCACA458F, 0x82829D1F, 0xC9C94089, 0x7D7D87FA, 0xFAFA15EF, 0x5959EBB2, 0x4747C98E, 0xF0F00BFB,
0xADADEC41, 0xD4D467B3, 0xA2A2FD5F, 0xAFAFEA45, 0x9C9CBF23, 0xA4A4F753, 0x727296E4, 0xC0C05B9B,
0xB7B7C275, 0xFDFD1CE1, 0x9393AE3D, 0x26266A4C, 0x36365A6C, 0x3F3F417E, 0xF7F702F5, 0xCCCC4F83,
0x34345C68, 0xA5A5F451, 0xE5E534D1, 0xF1F108F9, 0x717193E2, 0xD8D873AB, 0x31315362, 0x15153F2A,
0x04040C08, 0xC7C75295, 0x23236546, 0xC3C35E9D, 0x18182830, 0x9696A137, 0x05050F0A, 0x9A9AB52F,
0x0707090E, 0x12123624, 0x80809B1B, 0xE2E23DDF, 0xEBEB26CD, 0x2727694E, 0xB2B2CD7F, 0x75759FEA,
0x09091B12, 0x83839E1D, 0x2C2C7458, 0x1A1A2E34, 0x1B1B2D36, 0x6E6EB2DC, 0x5A5AEEB4, 0xA0A0FB5B,
0x5252F6A4, 0x3B3B4D76, 0xD6D661B7, 0xB3B3CE7D, 0x29297B52, 0xE3E33EDD, 0x2F2F715E, 0x84849713,
0x5353F5A6, 0xD1D168B9, 0x00000000, 0xEDED2CC1, 0x20206040, 0xFCFC1FE3, 0xB1B1C879, 0x5B5BEDB6,
0x6A6ABED4, 0xCBCB468D, 0xBEBED967, 0x39394B72, 0x4A4ADE94, 0x4C4CD498, 0x5858E8B0, 0xCFCF4A85,
0xD0D06BBB, 0xEFEF2AC5, 0xAAAAE54F, 0xFBFB16ED, 0x4343C586, 0x4D4DD79A, 0x33335566, 0x85859411,
0x4545CF8A, 0xF9F910E9, 0x02020604, 0x7F7F81FE, 0x5050F0A0, 0x3C3C4478, 0x9F9FBA25, 0xA8A8E34B,
0x5151F3A2, 0xA3A3FE5D, 0x4040C080, 0x8F8F8A05, 0x9292AD3F, 0x9D9DBC21, 0x38384870, 0xF5F504F1,
0xBCBCDF63, 0xB6B6C177, 0xDADA75AF, 0x21216342, 0x10103020, 0xFFFF1AE5, 0xF3F30EFD, 0xD2D26DBF,
0xCDCD4C81, 0x0C0C1418, 0x13133526, 0xECEC2FC3, 0x5F5FE1BE, 0x9797A235, 0x4444CC88, 0x1717392E,
0xC4C45793, 0xA7A7F255, 0x7E7E82FC, 0x3D3D477A, 0x6464ACC8, 0x5D5DE7BA, 0x19192B32, 0x737395E6,
0x6060A0C0, 0x81819819, 0x4F4FD19E, 0xDCDC7FA3, 0x22226644, 0x2A2A7E54, 0x9090AB3B, 0x8888830B,
0x4646CA8C, 0xEEEE29C7, 0xB8B8D36B, 0x14143C28, 0xDEDE79A7, 0x5E5EE2BC, 0x0B0B1D16, 0xDBDB76AD,
0xE0E03BDB, 0x32325664, 0x3A3A4E74, 0x0A0A1E14, 0x4949DB92, 0x06060A0C, 0x24246C48, 0x5C5CE4B8,
0xC2C25D9F, 0xD3D36EBD, 0xACACEF43, 0x6262A6C4, 0x9191A839, 0x9595A431, 0xE4E437D3, 0x79798BF2,
0xE7E732D5, 0xC8C8438B, 0x3737596E, 0x6D6DB7DA, 0x8D8D8C01, 0xD5D564B1, 0x4E4ED29C, 0xA9A9E049,
0x6C6CB4D8, 0x5656FAAC, 0xF4F407F3, 0xEAEA25CF, 0x6565AFCA, 0x7A7A8EF4, 0xAEAEE947, 0x08081810,
0xBABAD56F, 0x787888F0, 0x25256F4A, 0x2E2E725C, 0x1C1C2438, 0xA6A6F157, 0xB4B4C773, 0xC6C65197,
0xE8E823CB, 0xDDDD7CA1, 0x74749CE8, 0x1F1F213E, 0x4B4BDD96, 0xBDBDDC61, 0x8B8B860D, 0x8A8A850F,
0x707090E0, 0x3E3E427C, 0xB5B5C471, 0x6666AACC, 0x4848D890, 0x03030506, 0xF6F601F7, 0x0E0E121C,
0x6161A3C2, 0x35355F6A, 0x5757F9AE, 0xB9B9D069, 0x86869117, 0xC1C15899, 0x1D1D273A, 0x9E9EB927,
0xE1E138D9, 0xF8F813EB, 0x9898B32B, 0x11113322, 0x6969BBD2, 0xD9D970A9, 0x8E8E8907, 0x9494A733,
0x9B9BB62D, 0x1E1E223C, 0x87879215, 0xE9E920C9, 0xCECE4987, 0x5555FFAA, 0x28287850, 0xDFDF7AA5,
0x8C8C8F03, 0xA1A1F859, 0x89898009, 0x0D0D171A, 0xBFBFDA65, 0xE6E631D7, 0x4242C684, 0x6868B8D0,
0x4141C382, 0x9999B029, 0x2D2D775A, 0x0F0F111E, 0xB0B0CB7B, 0x5454FCA8, 0xBBBBD66D, 0x16163A2C

0x17098 处 TBox_5：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
0x51F4A750, 0x7E416553, 0x1A17A4C3, 0x3A275E96, 0x3BAB6BCB, 0x1F9D45F1, 0xACFA58AB, 0x4BE30393,
0x2030FA55, 0xAD766DF6, 0x88CC7691, 0xF5024C25, 0x4FE5D7FC, 0xC52ACBD7, 0x26354480, 0xB562A38F,
0xDEB15A49, 0x25BA1B67, 0x45EA0E98, 0x5DFEC0E1, 0xC32F7502, 0x814CF012, 0x8D4697A3, 0x6BD3F9C6,
0x038F5FE7, 0x15929C95, 0xBF6D7AEB, 0x955259DA, 0xD4BE832D, 0x587421D3, 0x49E06929, 0x8EC9C844,
0x75C2896A, 0xF48E7978, 0x99583E6B, 0x27B971DD, 0xBEE14FB6, 0xF088AD17, 0xC920AC66, 0x7DCE3AB4,
0x63DF4A18, 0xE51A3182, 0x97513360, 0x62537F45, 0xB16477E0, 0xBB6BAE84, 0xFE81A01C, 0xF9082B94,
0x70486858, 0x8F45FD19, 0x94DE6C87, 0x527BF8B7, 0xAB73D323, 0x724B02E2, 0xE31F8F57, 0x6655AB2A,
0xB2EB2807, 0x2FB5C203, 0x86C57B9A, 0xD33708A5, 0x302887F2, 0x23BFA5B2, 0x02036ABA, 0xED16825C,
0x8ACF1C2B, 0xA779B492, 0xF307F2F0, 0x4E69E2A1, 0x65DAF4CD, 0x0605BED5, 0xD134621F, 0xC4A6FE8A,
0x342E539D, 0xA2F355A0, 0x058AE132, 0xA4F6EB75, 0x0B83EC39, 0x4060EFAA, 0x5E719F06, 0xBD6E1051,
0x3E218AF9, 0x96DD063D, 0xDD3E05AE, 0x4DE6BD46, 0x91548DB5, 0x71C45D05, 0x0406D46F, 0x605015FF,
0x1998FB24, 0xD6BDE997, 0x894043CC, 0x67D99E77, 0xB0E842BD, 0x07898B88, 0xE7195B38, 0x79C8EEDB,
0xA17C0A47, 0x7C420FE9, 0xF8841EC9, 0x00000000, 0x09808683, 0x322BED48, 0x1E1170AC, 0x6C5A724E,
0xFD0EFFFB, 0x0F853856, 0x3DAED51E, 0x362D3927, 0x0A0FD964, 0x685CA621, 0x9B5B54D1, 0x24362E3A,
0x0C0A67B1, 0x9357E70F, 0xB4EE96D2, 0x1B9B919E, 0x80C0C54F, 0x61DC20A2, 0x5A774B69, 0x1C121A16,
0xE293BA0A, 0xC0A02AE5, 0x3C22E043, 0x121B171D, 0x0E090D0B, 0xF28BC7AD, 0x2DB6A8B9, 0x141EA9C8,
0x57F11985, 0xAF75074C, 0xEE99DDBB, 0xA37F60FD, 0xF701269F, 0x5C72F5BC, 0x44663BC5, 0x5BFB7E34,
0x8B432976, 0xCB23C6DC, 0xB6EDFC68, 0xB8E4F163, 0xD731DCCA, 0x42638510, 0x13972240, 0x84C61120,
0x854A247D, 0xD2BB3DF8, 0xAEF93211, 0xC729A16D, 0x1D9E2F4B, 0xDCB230F3, 0x0D8652EC, 0x77C1E3D0,
0x2BB3166C, 0xA970B999, 0x119448FA, 0x47E96422, 0xA8FC8CC4, 0xA0F03F1A, 0x567D2CD8, 0x223390EF,
0x87494EC7, 0xD938D1C1, 0x8CCAA2FE, 0x98D40B36, 0xA6F581CF, 0xA57ADE28, 0xDAB78E26, 0x3FADBFA4,
0x2C3A9DE4, 0x5078920D, 0x6A5FCC9B, 0x547E4662, 0xF68D13C2, 0x90D8B8E8, 0x2E39F75E, 0x82C3AFF5,
0x9F5D80BE, 0x69D0937C, 0x6FD52DA9, 0xCF2512B3, 0xC8AC993B, 0x10187DA7, 0xE89C636E, 0xDB3BBB7B,
0xCD267809, 0x6E5918F4, 0xEC9AB701, 0x834F9AA8, 0xE6956E65, 0xAAFFE67E, 0x21BCCF08, 0xEF15E8E6,
0xBAE79BD9, 0x4A6F36CE, 0xEA9F09D4, 0x29B07CD6, 0x31A4B2AF, 0x2A3F2331, 0xC6A59430, 0x35A266C0,
0x744EBC37, 0xFC82CAA6, 0xE090D0B0, 0x33A7D815, 0xF104984A, 0x41ECDAF7, 0x7FCD500E, 0x1791F62F,
0x764DD68D, 0x43EFB04D, 0xCCAA4D54, 0xE49604DF, 0x9ED1B5E3, 0x4C6A881B, 0xC12C1FB8, 0x4665517F,
0x9D5EEA04, 0x018C355D, 0xFA877473, 0xFB0B412E, 0xB3671D5A, 0x92DBD252, 0xE9105633, 0x6DD64713,
0x9AD7618C, 0x37A10C7A, 0x59F8148E, 0xEB133C89, 0xCEA927EE, 0xB761C935, 0xE11CE5ED, 0x7A47B13C,
0x9CD2DF59, 0x55F2733F, 0x1814CE79, 0x73C737BF, 0x53F7CDEA, 0x5FFDAA5B, 0xDF3D6F14, 0x7844DB86,
0xCAAFF381, 0xB968C43E, 0x3824342C, 0xC2A3405F, 0x161DC372, 0xBCE2250C, 0x283C498B, 0xFF0D9541,
0x39A80171, 0x080CB3DE, 0xD8B4E49C, 0x6456C190, 0x7BCB8461, 0xD532B670, 0x486C5C74, 0xD0B85742

0x17498 处 TBox_6：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
0x5051F4A7, 0x537E4165, 0xC31A17A4, 0x963A275E, 0xCB3BAB6B, 0xF11F9D45, 0xABACFA58, 0x934BE303,
0x552030FA, 0xF6AD766D, 0x9188CC76, 0x25F5024C, 0xFC4FE5D7, 0xD7C52ACB, 0x80263544, 0x8FB562A3,
0x49DEB15A, 0x6725BA1B, 0x9845EA0E, 0xE15DFEC0, 0x02C32F75, 0x12814CF0, 0xA38D4697, 0xC66BD3F9,
0xE7038F5F, 0x9515929C, 0xEBBF6D7A, 0xDA955259, 0x2DD4BE83, 0xD3587421, 0x2949E069, 0x448EC9C8,
0x6A75C289, 0x78F48E79, 0x6B99583E, 0xDD27B971, 0xB6BEE14F, 0x17F088AD, 0x66C920AC, 0xB47DCE3A,
0x1863DF4A, 0x82E51A31, 0x60975133, 0x4562537F, 0xE0B16477, 0x84BB6BAE, 0x1CFE81A0, 0x94F9082B,
0x58704868, 0x198F45FD, 0x8794DE6C, 0xB7527BF8, 0x23AB73D3, 0xE2724B02, 0x57E31F8F, 0x2A6655AB,
0x07B2EB28, 0x032FB5C2, 0x9A86C57B, 0xA5D33708, 0xF2302887, 0xB223BFA5, 0xBA02036A, 0x5CED1682,
0x2B8ACF1C, 0x92A779B4, 0xF0F307F2, 0xA14E69E2, 0xCD65DAF4, 0xD50605BE, 0x1FD13462, 0x8AC4A6FE,
0x9D342E53, 0xA0A2F355, 0x32058AE1, 0x75A4F6EB, 0x390B83EC, 0xAA4060EF, 0x065E719F, 0x51BD6E10,
0xF93E218A, 0x3D96DD06, 0xAEDD3E05, 0x464DE6BD, 0xB591548D, 0x0571C45D, 0x6F0406D4, 0xFF605015,
0x241998FB, 0x97D6BDE9, 0xCC894043, 0x7767D99E, 0xBDB0E842, 0x8807898B, 0x38E7195B, 0xDB79C8EE,
0x47A17C0A, 0xE97C420F, 0xC9F8841E, 0x00000000, 0x83098086, 0x48322BED, 0xAC1E1170, 0x4E6C5A72,
0xFBFD0EFF, 0x560F8538, 0x1E3DAED5, 0x27362D39, 0x640A0FD9, 0x21685CA6, 0xD19B5B54, 0x3A24362E,
0xB10C0A67, 0x0F9357E7, 0xD2B4EE96, 0x9E1B9B91, 0x4F80C0C5, 0xA261DC20, 0x695A774B, 0x161C121A,
0x0AE293BA, 0xE5C0A02A, 0x433C22E0, 0x1D121B17, 0x0B0E090D, 0xADF28BC7, 0xB92DB6A8, 0xC8141EA9,
0x8557F119, 0x4CAF7507, 0xBBEE99DD, 0xFDA37F60, 0x9FF70126, 0xBC5C72F5, 0xC544663B, 0x345BFB7E,
0x768B4329, 0xDCCB23C6, 0x68B6EDFC, 0x63B8E4F1, 0xCAD731DC, 0x10426385, 0x40139722, 0x2084C611,
0x7D854A24, 0xF8D2BB3D, 0x11AEF932, 0x6DC729A1, 0x4B1D9E2F, 0xF3DCB230, 0xEC0D8652, 0xD077C1E3,
0x6C2BB316, 0x99A970B9, 0xFA119448, 0x2247E964, 0xC4A8FC8C, 0x1AA0F03F, 0xD8567D2C, 0xEF223390,
0xC787494E, 0xC1D938D1, 0xFE8CCAA2, 0x3698D40B, 0xCFA6F581, 0x28A57ADE, 0x26DAB78E, 0xA43FADBF,
0xE42C3A9D, 0x0D507892, 0x9B6A5FCC, 0x62547E46, 0xC2F68D13, 0xE890D8B8, 0x5E2E39F7, 0xF582C3AF,
0xBE9F5D80, 0x7C69D093, 0xA96FD52D, 0xB3CF2512, 0x3BC8AC99, 0xA710187D, 0x6EE89C63, 0x7BDB3BBB,
0x09CD2678, 0xF46E5918, 0x01EC9AB7, 0xA8834F9A, 0x65E6956E, 0x7EAAFFE6, 0x0821BCCF, 0xE6EF15E8,
0xD9BAE79B, 0xCE4A6F36, 0xD4EA9F09, 0xD629B07C, 0xAF31A4B2, 0x312A3F23, 0x30C6A594, 0xC035A266,
0x37744EBC, 0xA6FC82CA, 0xB0E090D0, 0x1533A7D8, 0x4AF10498, 0xF741ECDA, 0x0E7FCD50, 0x2F1791F6,
0x8D764DD6, 0x4D43EFB0, 0x54CCAA4D, 0xDFE49604, 0xE39ED1B5, 0x1B4C6A88, 0xB8C12C1F, 0x7F466551,
0x049D5EEA, 0x5D018C35, 0x73FA8774, 0x2EFB0B41, 0x5AB3671D, 0x5292DBD2, 0x33E91056, 0x136DD647,
0x8C9AD761, 0x7A37A10C, 0x8E59F814, 0x89EB133C, 0xEECEA927, 0x35B761C9, 0xEDE11CE5, 0x3C7A47B1,
0x599CD2DF, 0x3F55F273, 0x791814CE, 0xBF73C737, 0xEA53F7CD, 0x5B5FFDAA, 0x14DF3D6F, 0x867844DB,
0x81CAAFF3, 0x3EB968C4, 0x2C382434, 0x5FC2A340, 0x72161DC3, 0x0CBCE225, 0x8B283C49, 0x41FF0D95,
0x7139A801, 0xDE080CB3, 0x9CD8B4E4, 0x906456C1, 0x617BCB84, 0x70D532B6, 0x74486C5C, 0x42D0B857

0x17898 处 TBox_7：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
0xA75051F4, 0x65537E41, 0xA4C31A17, 0x5E963A27, 0x6BCB3BAB, 0x45F11F9D, 0x58ABACFA, 0x03934BE3,
0xFA552030, 0x6DF6AD76, 0x769188CC, 0x4C25F502, 0xD7FC4FE5, 0xCBD7C52A, 0x44802635, 0xA38FB562,
0x5A49DEB1, 0x1B6725BA, 0x0E9845EA, 0xC0E15DFE, 0x7502C32F, 0xF012814C, 0x97A38D46, 0xF9C66BD3,
0x5FE7038F, 0x9C951592, 0x7AEBBF6D, 0x59DA9552, 0x832DD4BE, 0x21D35874, 0x692949E0, 0xC8448EC9,
0x896A75C2, 0x7978F48E, 0x3E6B9958, 0x71DD27B9, 0x4FB6BEE1, 0xAD17F088, 0xAC66C920, 0x3AB47DCE,
0x4A1863DF, 0x3182E51A, 0x33609751, 0x7F456253, 0x77E0B164, 0xAE84BB6B, 0xA01CFE81, 0x2B94F908,
0x68587048, 0xFD198F45, 0x6C8794DE, 0xF8B7527B, 0xD323AB73, 0x02E2724B, 0x8F57E31F, 0xAB2A6655,
0x2807B2EB, 0xC2032FB5, 0x7B9A86C5, 0x08A5D337, 0x87F23028, 0xA5B223BF, 0x6ABA0203, 0x825CED16,
0x1C2B8ACF, 0xB492A779, 0xF2F0F307, 0xE2A14E69, 0xF4CD65DA, 0xBED50605, 0x621FD134, 0xFE8AC4A6,
0x539D342E, 0x55A0A2F3, 0xE132058A, 0xEB75A4F6, 0xEC390B83, 0xEFAA4060, 0x9F065E71, 0x1051BD6E,
0x8AF93E21, 0x063D96DD, 0x05AEDD3E, 0xBD464DE6, 0x8DB59154, 0x5D0571C4, 0xD46F0406, 0x15FF6050,
0xFB241998, 0xE997D6BD, 0x43CC8940, 0x9E7767D9, 0x42BDB0E8, 0x8B880789, 0x5B38E719, 0xEEDB79C8,
0x0A47A17C, 0x0FE97C42, 0x1EC9F884, 0x00000000, 0x86830980, 0xED48322B, 0x70AC1E11, 0x724E6C5A,
0xFFFBFD0E, 0x38560F85, 0xD51E3DAE, 0x3927362D, 0xD9640A0F, 0xA621685C, 0x54D19B5B, 0x2E3A2436,
0x67B10C0A, 0xE70F9357, 0x96D2B4EE, 0x919E1B9B, 0xC54F80C0, 0x20A261DC, 0x4B695A77, 0x1A161C12,
0xBA0AE293, 0x2AE5C0A0, 0xE0433C22, 0x171D121B, 0x0D0B0E09, 0xC7ADF28B, 0xA8B92DB6, 0xA9C8141E,
0x198557F1, 0x074CAF75, 0xDDBBEE99, 0x60FDA37F, 0x269FF701, 0xF5BC5C72, 0x3BC54466, 0x7E345BFB,
0x29768B43, 0xC6DCCB23, 0xFC68B6ED, 0xF163B8E4, 0xDCCAD731, 0x85104263, 0x22401397, 0x112084C6,
0x247D854A, 0x3DF8D2BB, 0x3211AEF9, 0xA16DC729, 0x2F4B1D9E, 0x30F3DCB2, 0x52EC0D86, 0xE3D077C1,
0x166C2BB3, 0xB999A970, 0x48FA1194, 0x642247E9, 0x8CC4A8FC, 0x3F1AA0F0, 0x2CD8567D, 0x90EF2233,
0x4EC78749, 0xD1C1D938, 0xA2FE8CCA, 0x0B3698D4, 0x81CFA6F5, 0xDE28A57A, 0x8E26DAB7, 0xBFA43FAD,
0x9DE42C3A, 0x920D5078, 0xCC9B6A5F, 0x4662547E, 0x13C2F68D, 0xB8E890D8, 0xF75E2E39, 0xAFF582C3,
0x80BE9F5D, 0x937C69D0, 0x2DA96FD5, 0x12B3CF25, 0x993BC8AC, 0x7DA71018, 0x636EE89C, 0xBB7BDB3B,
0x7809CD26, 0x18F46E59, 0xB701EC9A, 0x9AA8834F, 0x6E65E695, 0xE67EAAFF, 0xCF0821BC, 0xE8E6EF15,
0x9BD9BAE7, 0x36CE4A6F, 0x09D4EA9F, 0x7CD629B0, 0xB2AF31A4, 0x23312A3F, 0x9430C6A5, 0x66C035A2,
0xBC37744E, 0xCAA6FC82, 0xD0B0E090, 0xD81533A7, 0x984AF104, 0xDAF741EC, 0x500E7FCD, 0xF62F1791,
0xD68D764D, 0xB04D43EF, 0x4D54CCAA, 0x04DFE496, 0xB5E39ED1, 0x881B4C6A, 0x1FB8C12C, 0x517F4665,
0xEA049D5E, 0x355D018C, 0x7473FA87, 0x412EFB0B, 0x1D5AB367, 0xD25292DB, 0x5633E910, 0x47136DD6,
0x618C9AD7, 0x0C7A37A1, 0x148E59F8, 0x3C89EB13, 0x27EECEA9, 0xC935B761, 0xE5EDE11C, 0xB13C7A47,
0xDF599CD2, 0x733F55F2, 0xCE791814, 0x37BF73C7, 0xCDEA53F7, 0xAA5B5FFD, 0x6F14DF3D, 0xDB867844,
0xF381CAAF, 0xC43EB968, 0x342C3824, 0x405FC2A3, 0xC372161D, 0x250CBCE2, 0x498B283C, 0x9541FF0D,
0x017139A8, 0xB3DE080C, 0xE49CD8B4, 0xC1906456, 0x84617BCB, 0xB670D532, 0x5C74486C, 0x5742D0B8

0x17c98 处 TBox_8：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
0xF4A75051, 0x4165537E, 0x17A4C31A, 0x275E963A, 0xAB6BCB3B, 0x9D45F11F, 0xFA58ABAC, 0xE303934B,
0x30FA5520, 0x766DF6AD, 0xCC769188, 0x024C25F5, 0xE5D7FC4F, 0x2ACBD7C5, 0x35448026, 0x62A38FB5,
0xB15A49DE, 0xBA1B6725, 0xEA0E9845, 0xFEC0E15D, 0x2F7502C3, 0x4CF01281, 0x4697A38D, 0xD3F9C66B,
0x8F5FE703, 0x929C9515, 0x6D7AEBBF, 0x5259DA95, 0xBE832DD4, 0x7421D358, 0xE0692949, 0xC9C8448E,
0xC2896A75, 0x8E7978F4, 0x583E6B99, 0xB971DD27, 0xE14FB6BE, 0x88AD17F0, 0x20AC66C9, 0xCE3AB47D,
0xDF4A1863, 0x1A3182E5, 0x51336097, 0x537F4562, 0x6477E0B1, 0x6BAE84BB, 0x81A01CFE, 0x082B94F9,
0x48685870, 0x45FD198F, 0xDE6C8794, 0x7BF8B752, 0x73D323AB, 0x4B02E272, 0x1F8F57E3, 0x55AB2A66,
0xEB2807B2, 0xB5C2032F, 0xC57B9A86, 0x3708A5D3, 0x2887F230, 0xBFA5B223, 0x036ABA02, 0x16825CED,
0xCF1C2B8A, 0x79B492A7, 0x07F2F0F3, 0x69E2A14E, 0xDAF4CD65, 0x05BED506, 0x34621FD1, 0xA6FE8AC4,
0x2E539D34, 0xF355A0A2, 0x8AE13205, 0xF6EB75A4, 0x83EC390B, 0x60EFAA40, 0x719F065E, 0x6E1051BD,
0x218AF93E, 0xDD063D96, 0x3E05AEDD, 0xE6BD464D, 0x548DB591, 0xC45D0571, 0x06D46F04, 0x5015FF60,
0x98FB2419, 0xBDE997D6, 0x4043CC89, 0xD99E7767, 0xE842BDB0, 0x898B8807, 0x195B38E7, 0xC8EEDB79,
0x7C0A47A1, 0x420FE97C, 0x841EC9F8, 0x00000000, 0x80868309, 0x2BED4832, 0x1170AC1E, 0x5A724E6C,
0x0EFFFBFD, 0x8538560F, 0xAED51E3D, 0x2D392736, 0x0FD9640A, 0x5CA62168, 0x5B54D19B, 0x362E3A24,
0x0A67B10C, 0x57E70F93, 0xEE96D2B4, 0x9B919E1B, 0xC0C54F80, 0xDC20A261, 0x774B695A, 0x121A161C,
0x93BA0AE2, 0xA02AE5C0, 0x22E0433C, 0x1B171D12, 0x090D0B0E, 0x8BC7ADF2, 0xB6A8B92D, 0x1EA9C814,
0xF1198557, 0x75074CAF, 0x99DDBBEE, 0x7F60FDA3, 0x01269FF7, 0x72F5BC5C, 0x663BC544, 0xFB7E345B,
0x4329768B, 0x23C6DCCB, 0xEDFC68B6, 0xE4F163B8, 0x31DCCAD7, 0x63851042, 0x97224013, 0xC6112084,
0x4A247D85, 0xBB3DF8D2, 0xF93211AE, 0x29A16DC7, 0x9E2F4B1D, 0xB230F3DC, 0x8652EC0D, 0xC1E3D077,
0xB3166C2B, 0x70B999A9, 0x9448FA11, 0xE9642247, 0xFC8CC4A8, 0xF03F1AA0, 0x7D2CD856, 0x3390EF22,
0x494EC787, 0x38D1C1D9, 0xCAA2FE8C, 0xD40B3698, 0xF581CFA6, 0x7ADE28A5, 0xB78E26DA, 0xADBFA43F,
0x3A9DE42C, 0x78920D50, 0x5FCC9B6A, 0x7E466254, 0x8D13C2F6, 0xD8B8E890, 0x39F75E2E, 0xC3AFF582,
0x5D80BE9F, 0xD0937C69, 0xD52DA96F, 0x2512B3CF, 0xAC993BC8, 0x187DA710, 0x9C636EE8, 0x3BBB7BDB,
0x267809CD, 0x5918F46E, 0x9AB701EC, 0x4F9AA883, 0x956E65E6, 0xFFE67EAA, 0xBCCF0821, 0x15E8E6EF,
0xE79BD9BA, 0x6F36CE4A, 0x9F09D4EA, 0xB07CD629, 0xA4B2AF31, 0x3F23312A, 0xA59430C6, 0xA266C035,
0x4EBC3774, 0x82CAA6FC, 0x90D0B0E0, 0xA7D81533, 0x04984AF1, 0xECDAF741, 0xCD500E7F, 0x91F62F17,
0x4DD68D76, 0xEFB04D43, 0xAA4D54CC, 0x9604DFE4, 0xD1B5E39E, 0x6A881B4C, 0x2C1FB8C1, 0x65517F46,
0x5EEA049D, 0x8C355D01, 0x877473FA, 0x0B412EFB, 0x671D5AB3, 0xDBD25292, 0x105633E9, 0xD647136D,
0xD7618C9A, 0xA10C7A37, 0xF8148E59, 0x133C89EB, 0xA927EECE, 0x61C935B7, 0x1CE5EDE1, 0x47B13C7A,
0xD2DF599C, 0xF2733F55, 0x14CE7918, 0xC737BF73, 0xF7CDEA53, 0xFDAA5B5F, 0x3D6F14DF, 0x44DB8678,
0xAFF381CA, 0x68C43EB9, 0x24342C38, 0xA3405FC2, 0x1DC37216, 0xE2250CBC, 0x3C498B28, 0x0D9541FF,
0xA8017139, 0x0CB3DE08, 0xB4E49CD8, 0x56C19064, 0xCB84617B, 0x32B670D5, 0x6C5C7448, 0xB85742D0

之后的对提取出来的 hmac_string 进行解密，先将其进行 Base64 解码，得到原始密文再转成 hex，一共 96 字节，在进行 aes 解密，每轮用 TBox_5 ~ TBox_8 查表，完成 AES 的字节替换、行移位、列混淆、轮密钥加的步骤，并且是 CBC 模式，有块异或的操作，初始 IV 是固定值 31 01 32 34 04 02 08 61 66 7A 66 66 07 17 66 39，最后一轮用逆 S 盒完成字节替换，行移位，轮密钥加的步骤，所有 6 个块解完后去掉前 16 字节和后 16 字节，只保留中间的 64 字节，再后续的 HMAC-MD5 中去异或 0x36 和 0x5c 分别得到 ipad 和 opad

总流程

原始数据：build_id 即 APP 版本号 、device_id 即设备 uuid 、hmac_string (从 data/data/com.xingin.xhs/shared_prefs/s.xml 中提取)

对 build_id 进行密钥拓展得到 AES 解密轮密钥， hmac_string 经过魔改 AES 解密得到 64 字节和 message 一起传入 HMAC-MD5 得到 16 字节摘要，最后是一个 RC4 + Base64，最后的生成结果前加上 XY 就是 shield 的最终参数

实战
#Reverse #Android
xhs shield 参数分析
http://example.com/2026/03/31/xhs_shield/
作者
Eleven
发布于
2026年3月31日
许可协议