一
前言

二
Introduction

三
从去除字符串加密开始

typedef struct {
        Elf64_Word      p_type;
        Elf64_Word      p_flags;
        Elf64_Off       p_offset;
        Elf64_Addr      p_vaddr;
        Elf64_Addr      p_paddr;
        Elf64_Xword     p_filesz;
        Elf64_Xword     p_memsz;
        Elf64_Xword     p_align;
} Elf64_Phdr;

for seg in lib.iter_segments_by_type('PT_LOAD'):
    st_addr, size = get_mapping_address(seg)
    # don't care, rwx everywhere
    emulator.mem_map(lib.address + st_addr, size, UC_PROT_ALL)
    emulator.mem_write(lib.address + seg.header.p_vaddr, seg.data())
    log.info("loaded segment 0x%x-0x%x to memory 0x%x-0x%x", seg.header.p_vaddr,seg.header.p_vaddr+seg.header.p_memsz, lib.address + st_addr, lib.address + st_addr+size)

datadivs = []
for name in lib.symbols:
    if name.startswith(".datadiv_decode"):
        datadivs.append(name)
for datadiv in datadivs:
    log.info("[%s] Function %s invoke", hex(lib.symbols[datadiv]), datadiv)
    emulator.reg_write(arm64_const.UC_ARM64_REG_LR, 0) # 把return pointer (LR) 设置为0
    emulator.emu_start(begin=lib.symbols[datadiv], until=0)
    log.info("[%s] Function return",hex(lib.symbols[datadiv]),)

log.info("Patch .data section")
new_data = emulator.mem_read(lib.address + data_section_header.sh_addr, data_section_header.sh_size)
libfile.seek(data_section_header.sh_offset)
libfile.write(new_data)

log.info("Patch .datadiv_decode functions")
for datadiv in datadivs:
    libfile.seek(lib.symbols[datadiv] & 0xFFFFFFFE)
    ret = b''
    try:
        ret = asm(shellcraft.ret())
    except:
        # fallback to manual
        ret = asm("ret")
    libfile.write(ret)

四
ELF文件是怎么Load的

typedef struct {
    Elf64_Xword d_tag;
    union {
        Elf64_Xword     d_val;
        Elf64_Addr      d_ptr;
    } d_un;
} Elf64_Dyn;

typedef struct {
    Elf64_Word      st_name;
    unsigned char   st_info;
    unsigned char   st_other;
    Elf64_Half      st_shndx;
    Elf64_Addr      st_value;
    Elf64_Xword     st_size;
} Elf64_Sym;

typedef struct {
  Elf64_Addr    r_offset;   // Address
  Elf64_Xword   r_info;	    // 32-bit relocation type; 32-bit symbol index
} Elf64_Rel;
typedef struct {
  Elf64_Addr    r_offset;   // Address
  Elf64_Xword   r_info;	    // 32-bit relocation type; 32-bit symbol index
  Elf64_Sxword  r_addend;   // Addend
} Elf64_Rela;

r_info_sym = r_info >> 8
r_info_type = r_info && 0xff

def get_symbol_table(elf: 'ELF') -> SymbolTableSection:
    for section in elf.iter_sections():
        if section.header.sh_type == "SHT_DYNSYM":
            return section
def get_relocations(elf: 'ELF') -> Dict[int, Relocation]:
    rel_sections: List[RelocationSection] = []
    for section in elf.iter_sections():
        if section.header.sh_type in ["SHT_REL", "SHT_RELA"]:
            rel_sections.append(section)
        if section.header.sh_type == "SHT_DYNSYM":
            dynsym = section
    relocs = dict()
    # https://static1.squarespace.com/static/59c4375b8a02c798d1cce06f/t/59d55a7bf5e2319471bb94a4/1507154557709/ELF+for+ARM64.pdf
    for rel_section in rel_sections:
        for reloc in rel_section.iter_relocations():
            r_offset = reloc.entry.r_offset  # 表示 .text[r_offset]处需要进行修复
            if r_offset in relocs:
                raise Exception("wtf")
            relocs[r_offset] = reloc
            # print(reloc.entry.r_info_sym)
            # r_info = reloc.entry.r_info  # 用来存放 r_info_sym 和 r_info_type
            # r_info_sym = reloc.entry.r_info_sym  # 表示该重定向为符号表中的第 N 项
            # r_info_type = reloc.entry.r_info_type  # 表示该重定向的类型，对应枚举值 ENUM_RELOC_TYPE_ARM
            # r_addend = reloc.entry.r_addend
            # print(f"{rel_section.name} fixing {dynsym.get_symbol(r_info_sym).name} at {hex(r_offset)} to {hex(dynsym.get_symbol(r_info_sym).entry.st_value)} with type {hex(r_info_type)} added {hex(r_addend)}", )
            # # print(dynsym.get_symbol(r_info_sym).name,dynsym.get_symbol(r_info_sym).entry)
    return relocs
# fix relocation
relocs = get_relocations(lib)
symtab = get_symbol_table(lib)
for addr, reloc in relocs.items():
    # 0x4962a0
    # https://static1.squarespace.com/static/59c4375b8a02c798d1cce06f/t/59d55a7bf5e2319471bb94a4/1507154557709/ELF+for+ARM64.pdf
    if reloc.entry.r_info_type == ENUM_RELOC_TYPE_AARCH64['R_AARCH64_JUMP_SLOT']:
        name = symtab.get_symbol(relocs[addr].entry.r_info_sym).name
        # need to import from external library
        if symtab.get_symbol(relocs[addr].entry.r_info_sym).entry.st_value == 0:
            print(name, hex(addr), symtab.get_symbol(relocs[addr].entry.r_info_sym).entry.st_value,
                  relocs[addr].entry.r_addend)
    if reloc.entry.r_info_type in [
        ENUM_RELOC_TYPE_AARCH64['R_AARCH64_ABS64'],
        ENUM_RELOC_TYPE_AARCH64['R_AARCH64_GLOB_DAT'],
        ENUM_RELOC_TYPE_AARCH64['R_AARCH64_JUMP_SLOT']]:
        ql.mem.write(lib.address + addr,
                     (lib.address + symtab.get_symbol(relocs[addr].entry.r_info_sym).entry.st_value + relocs[
                         addr].entry.r_addend).to_bytes(8,
                                                        "little"))
    elif reloc.entry.r_info_type in [ENUM_RELOC_TYPE_AARCH64['R_AARCH64_RELATIVE']]:
        ql.mem.write(lib.address + addr,
                     (lib.address + relocs[addr].entry.r_addend).to_bytes(8, "little"))
    else:
        print(f"not handled r_info_type {reloc.entry.r_info_type}")
        # exit(0)

五
用Qiling来模拟运行

def hook_strlen(ql: Qiling):
    # The string address is in X0 for AArch64
    string_address = ql.arch.regs.read(arm64_const.UC_ARM64_REG_X0)
    length = 0
    while True:
        byte = ql.mem.read(string_address + length, 1)
        if byte[0] == 0:
            break
        length += 1
    stlogger.log(f"strlen called with {ql.mem.read(string_address, length)}")
    # Write the result back to X0
    ql.arch.regs.write(arm64_const.UC_ARM64_REG_X0, length)
    stlogger.callstack.pop(-1)
    ql.arch.regs.write(arm64_const.UC_ARM64_REG_PC, ql.arch.regs.read(arm64_const.UC_ARM64_REG_LR))
ql.hook_address(hook_strlen, base_address + 0x0013b970)

class StackTracerLogger:
    def __init__(self,
                 addr_to_fname,
                 base_address=0,
                 print_func_with_symbol_only=False,
                 print_exit=True,
                 printer=print
                 ):
        self.addr_to_fname = addr_to_fname
        self.base_address = base_address
        self.printer = printer
        self.print_func_with_symbol_only = print_func_with_symbol_only
        self.print_exit = print_exit
        self.callstack = []
    def call(self, func_addr: int, call_from: int):
        self.callstack.append(func_addr)
        fname = ""
        if func_addr in self.addr_to_fname:
            fname = self.addr_to_fname[func_addr]
        if fname == "" and self.print_func_with_symbol_only:
            return
        elif fname == "":
            fname = f"func_{hex(func_addr - base_address)}"
        self.printer(
            f"[{len(self.callstack)}]{' ' * len(self.callstack)}calls {fname} from {hex(call_from - self.base_address)}")
    def exit(self, exit_addr):
        if self.print_exit:
            self.printer(f"[{len(self.callstack)}]{' ' * len(self.callstack)}exit at {hex(exit_addr - base_address)}")
        if self.callstack:
            self.callstack.pop(-1)
    def log(self, msg):
        self.printer(f"[{len(self.callstack)}]{' ' * (len(self.callstack) + 1)}{msg}")
    def select_qiling_backtrace(self, arch_type: QL_ARCH):
        if arch_type == QL_ARCH.ARM64:
            return self.ql_aarch64_backtrace
    def ql_aarch64_backtrace(self, ql: Qiling, address, size):
        # Read the code at the current address
        code = ql.mem.read(address, size)
        # Decode the instruction (simple detection based on opcode; consider using Capstone for complex cases)
        if size == 4:
            opcode = int.from_bytes(code, 'little')
            # Detect BL or BLX (0x94000000 for BL, check mask for lower bits)
            if (int.from_bytes(code, 'little') & 0xFC000000) == 0x94000000:
                # Calculate target address (offset is 26 bits, shift left and sign extend)
                offset = int.from_bytes(code, 'little') & 0x03FFFFFF
                if offset & 0x02000000:  # Sign bit of 26-bit offset
                    offset -= 0x04000000  # 2's complement negative offset
                target = address + (offset << 2)  # left shift to account for instruction size
                self.call(target, address)
            # blr
            elif (opcode & 0xFFFFFC1F) == 0xD63F0000:
                reg_num = (opcode >> 5) & 0x1F
                reg_val = ql.arch.regs.read(reg_num)
                self.call(reg_val, address)
            elif opcode == 0xd65f03c0:  # RET
                self.exit(address)
addr_to_fname = dict((v, k) for k, v in lib.symbols.items())
stlogger = StackTracerLogger(
    addr_to_fname, lib.address, print_func_with_symbol_only=True, print_exit=False,
    printer=log.info
)
ql.hook_code(stlogger.select_qiling_backtrace(ql.arch.type))

六
结语

# 往期推荐

1、Alt-Tab Terminator注册算法逆向

2、恶意木马历险记

3、VMP源码分析：反调试与绕过方法

4、Chrome V8 issue 1486342浅析

5、Cython逆向-语言特性分析