一
init_proc

二
dump so

三
修复so

dump() {
        if (this.libso == null) {
            return -1;
        }
        var file_path = this.path + "/" + this.soName;
        logd("dump so:" + this.soName + " to " + file_path);
        var file_handle = new File(file_path, "wb+");
        if (file_handle && file_handle != null) {
            Memory.protect(ptr(this.libso.base.toString()), this.libso.size, 'rwx');
            logd("libso_buffer:" + ptr(this.libso.base.toString()) + " " + this.libso.size);
            var libso_buffer = ptr(this.libso.base.toString()).readByteArray(this.libso.size);
                   this.patchGot(libso_buffer!)
            var pGot = new BigInt64Array(libso_buffer!, 0x1352B8, 424)
                        //创建extern 表
            var table = [{ key: 0x155000, value:"sleep"}, { key: 0x155008, value:"popen"}, { key: 0x155010, value:"mprotect"}, { key: 0x155018, value:"sigemptyset"}, { key: 0x155020, value:"lseek64"}, { key: 0x155028, value:"deflateEnd"}, { key: 0x155030, value:"pipe"}, { key: 0x155038, value:"atoi"}, { key: 0x155040, value:"pthread_create"}, { key: 0x155048, value:"wait"}, { key: 0x155050, value:"realloc"}, { key: 0x155058, value:"open"}, { key: 0x155060, value:"pthread_key_create"}, { key: 0x155068, value:"inflate"}, { key: 0x155070, value:"pthread_once"}, { key: 0x155078, value:"__cxa_finalize"}, { key: 0x155080, value:"ftell"}, { key: 0x155088, value:"ptrace"}, { key: 0x155090, value:"siglongjmp"}, { key: 0x155098, value:"mkdir"}, { key: 0x1550A0, value:"setpgid"}, { key: 0x1550A8, value:"calloc"}, { key: 0x1550B0, value:"fread"}, { key: 0x1550B8, value:"syslog"}, { key: 0x1550C0, value:"stpcpy"}, { key: 0x1550C8, value:"inflateInit2_"}, { key: 0x1550D0, value:"AAsset_getBuffer"}, { key: 0x1550D8, value:"strncmp"}, { key: 0x1550E0, value:"read"}, { key: 0x1550E8, value:"fstat"}, { key: 0x1550F0, value:"inotify_rm_watch"}, { key: 0x1550F8, value:"strncasecmp"}, { key: 0x155100, value:"AAsset_close"}, { key: 0x155108, value:"pthread_mutex_init"}, { key: 0x155110, value:"signal"}, { key: 0x155118, value:"abort"}, { key: 0x155120, value:"closedir"}, { key: 0x155128, value:"strerror"}, { key: 0x155130, value:"lstat"}, { key: 0x155138, value:"lstat64"}, { key: 0x155140, value:"_exit"}, { key: 0x155148, value:"__errno"}, { key: 0x155150, value:"srand"}, { key: 0x155158, value:"snprintf"}, { key: 0x155160, value:"getpid"}, { key: 0x155168, value:"dl_iterate_phdr"}, { key: 0x155170, value:"strcat"}, { key: 0x155178, value:"sscanf"}, { key: 0x155180, value:"android_set_abort_message"}, { key: 0x155188, value:"deflate"}, { key: 0x155190, value:"islower"}, { key: 0x155198, value:"isupper"}, { key: 0x1551A0, value:"write"}, { key: 0x1551A8, value:"toupper"}, { key: 0x1551B0, value:"getenv"}, { key: 0x1551B8, value:"strcasecmp"}, { key: 0x1551C0, value:"strrchr"}, { key: 0x1551C8, value:"access"}, { key: 0x1551D0, value:"time"}, { key: 0x1551D8, value:"rand"}, { key: 0x1551E0, value:"__sF"}, { key: 0x1551E8, value:"memcmp"}, { key: 0x1551F0, value:"fclose"}, { key: 0x1551F8, value:"lseek"}, { key: 0x155200, value:"fputs"}, { key: 0x155208, value:"rewind"}, { key: 0x155210, value:"fputc"}, { key: 0x155218, value:"__stack_chk_fail"}, { key: 0x155220, value:"fgets"}, { key: 0x155228, value:"select"}, { key: 0x155230, value:"fork"}, { key: 0x155238, value:"gettimeofday"}, { key: 0x155240, value:"dlclose"}, { key: 0x155248, value:"pthread_cond_wait"}, { key: 0x155250, value:"strftime"}, { key: 0x155258, value:"memchr"}, { key: 0x155260, value:"prctl"}, { key: 0x155268, value:"ioctl"}, { key: 0x155270, value:"strcasestr"}, { key: 0x155278, value:"pthread_setspecific"}, { key: 0x155280, value:"strncpy"}, { key: 0x155288, value:"opendir"}, { key: 0x155290, value:"dlsym"}, { key: 0x155298, value:"atol"}, { key: 0x1552A0, value:"openlog"}, { key: 0x1552A8, value:"__stack_chk_guard"}, { key: 0x1552B0, value:"environ"}, { key: 0x1552B8, value:"__android_log_print"}, { key: 0x1552C0, value:"inotify_init"}, { key: 0x1552C8, value:"unlink"}, { key: 0x1552D0, value:"inflateEnd"}, { key: 0x1552D8, value:"setenv"}, { key: 0x1552E0, value:"sysconf"}, { key: 0x1552E8, value:"strchr"}, { key: 0x1552F0, value:"tolower"}, { key: 0x1552F8, value:"fseek"}, { key: 0x155300, value:"strcmp"}, { key: 0x155308, value:"flock"}, { key: 0x155310, value:"fgetc"}, { key: 0x155318, value:"sprintf"}, { key: 0x155320, value:"strncat"}, { key: 0x155328, value:"sigaction"}, { key: 0x155330, value:"pthread_mutex_lock"}, { key: 0x155338, value:"mmap"}, { key: 0x155340, value:"setjmp"}, { key: 0x155348, value:"closelog"}, { key: 0x155350, value:"pthread_getspecific"}, { key: 0x155358, value:"AAssetManager_open"}, { key: 0x155360, value:"memmove"}, { key: 0x155368, value:"ferror"}, { key: 0x155370, value:"isxdigit"}, { key: 0x155378, value:"inotify_add_watch"}, { key: 0x155380, value:"AAsset_getLength"}, { key: 0x155388, value:"readlink"}, { key: 0x155390, value:"strstr"}, { key: 0x155398, value:"getpagesize"}, { key: 0x1553A0, value:"strdup"}, { key: 0x1553A8, value:"strtok"}, { key: 0x1553B0, value:"usleep"}, { key: 0x1553B8, value:"kill"}, { key: 0x1553C0, value:"readdir"}, { key: 0x1553C8, value:"fdopen"}, { key: 0x1553D0, value:"strlen"}, { key: 0x1553D8, value:"crc32"}, { key: 0x1553E0, value:"exit"}, { key: 0x1553E8, value:"close"}, { key: 0x1553F0, value:"vasprintf"}, { key: 0x1553F8, value:"remove"}, { key: 0x155400, value:"dlopen"}, { key: 0x155408, value:"stat"}, { key: 0x155410, value:"localtime"}, { key: 0x155418, value:"rename"}, { key: 0x155420, value:"munmap"}, { key: 0x155428, value:"get_crc_table"}, { key: 0x155430, value:"fprintf"}, { key: 0x155438, value:"malloc"}, { key: 0x155440, value:"memcpy"}, { key: 0x155448, value:"waitpid"}, { key: 0x155450, value:"deflateInit2_"}, { key: 0x155458, value:"connect"}, { key: 0x155460, value:"memset"}, { key: 0x155468, value:"fopen"}, { key: 0x155470, value:"AAssetManager_fromJava"}, { key: 0x155478, value:"socket"}, { key: 0x155480, value:"pthread_cond_broadcast"}, { key: 0x155488, value:"sigsetjmp"}, { key: 0x155490, value:"pclose"}, { key: 0x155498, value:"strtol"}, { key: 0x1554A0, value:"pthread_kill"}, { key: 0x1554A8, value:"free"}, { key: 0x1554B0, value:"fscanf"}, { key: 0x1554B8, value:"strcpy"}, { key: 0x1554C0, value:"__system_property_get"}, { key: 0x1554C8, value:"pwrite"}, { key: 0x1554D0, value:"pthread_exit"}, { key: 0x1554D8, value:"symlink"}, { key: 0x1554E0, value:"vfprintf"}, { key: 0x1554E8, value:"pthread_mutex_unlock"}, { key: 0x1554F0, value:"clock_gettime"}, { key: 0x1554F8, value:"__cxa_atexit"}, { key: 0x155500, value:"isspace"}] 
            var base =this.libso.base
                        for (var i = 0; i < pGot.length; i++) {
                var addr = pGot[i]
                var funcName = DebugSymbol.fromAddress(ptr(addr.toString())).toString().split("!")[1]
                logd("pgot1:" + i + " " + ptr(addr.toString()) + " " + funcName)
                table.forEach(function (item: any) {
                    var name = item["value"].toString()
                    if (funcName?.indexOf(name) !=-1 && funcName?.length > 0) {
                        pGot[i] = BigInt(ptr(item["key"]).toString())
                        logd("replace pgot:" + i + funcName + "  " + ptr(0x1352B8).add(i*8).add(base).readPointer()+" "+ ptr(pGot[i-1].toString()) +" "+ name + " to " + ptr(item["key"]))
                        return
                    }
                })
                if(ptr(pGot[i].toString()) > base){
                    pGot[i] = BigInt(ptr(pGot[i].toString()).sub(base).toString())
                }
            }
            logd(pGot.toString())
            logd("dump so:" + this.soName + " to " + file_path);
            file_handle.write(libso_buffer!);
            file_handle.flush();
            file_handle.close();
            log("[dump]:"+ file_path);
        }
    }

四
字符串解密

__int64 __fastcall sub_181D4(__int64 result, int a2, char a3)
{
  int v3; // w5
  char v4; // w7
  v3 = 0;
  v4 = *(result + 1) ^ a3;
  while ( a2 > v3 )
  {
    *(result + v3) = v4 ^ *(result + v3 + 2);
    ++v3;
  }
  *(result + v3) = 0;
  return result;
}

五
间接跳转

六
init_array

mprotect
mmap
munmap
fopen
fclose
fgets
fwrite
fread
sprintf
pthread_create

00000000 struct libcPFuncAry // sizeof=0x38
00000000 {                                       // XREF: .data:g_func_fopen_ptr/r
00000000     FILE *(__fastcall *pFopen)(const char *filename, const char *modes);
00000000                                         // XREF: sub_158AC+30/r
00000000                                         // sub_15AE0+14/r ...
00000008     int (__fastcall *pFclose)(FILE *stream); // XREF: sub_E1F78/o
00000008                                         // sub_E1F78+4/r
00000010     char *(__fastcall *pFgets)(char *s, int n, FILE *stream);
00000010                                         // XREF: inotify_init_function+28/o
00000010                                         // inotify_init_function+AC/r
00000018     unsigned __int64 (__fastcall *pFwrite)(__int64 a1, unsigned __int64 a2, unsigned __int64 a3, __int64 a4);
00000018                                         // XREF: sub_1989C/o
00000018                                         // sub_1989C+C/r ...
00000020     unsigned __int64 (__fastcall *pFread)(char *a1, unsigned __int64 a2, unsigned __int64 a3, __int64 a4);
00000020                                         // XREF: .text&ARM.extab:0000000000037FE8/o
00000020                                         // .text&ARM.extab:0000000000037FF4/r
00000028     __int64 (*pSprintf)(__int64 a1, unsigned __int8 *a2, ...);
00000028                                         // XREF: struc_func_ptr_ctor+18/o
00000028                                         // struc_func_ptr_ctor+1C/r
00000030     __int64 (__fastcall *pPthread_create)(_QWORD *a1, __int64 a2, __int64 a3, __int64 a4);
00000030                                         // XREF: operator new(ulong)+44/o
00000030                                         // operator new(ulong)+4C/r ...
00000038 };

七
JNI_OnLoad

BL              __stack_chk_fail

FindClass android/app/ActivityThread
GetStaticMethodID currentActivityThread
CallStaticObjectMethod currentActivityThread
GetMethodID getSystemContext
CallObjectMethod getSystemContext
FindClass  android/app/ContextImpl
GetMethodID getPackageManager
CallObjectMethod getPackageManager
GetMethodID getPackageInfo
NewStringUTF 包名
CallObjectMethod getPackageInfo
GetFieldID applicationInfo
GetObjectField  applicationInfo:Landroid/content/pm/ApplicationInfo
>GetObjectClass applicationInfo:Landroid/content/pm/ApplicationInfo
GetFieldID sourceDir
GetObjectField sourceDir
GetStringUTFChars sourceDir
GetFieldID dataDir
GetObjectField dataDir
GetStringUTFChars dataDir
GetFieldID nativeLibraryDir
GetObjectField nativeLibraryDir
GetStringUTFChars nativeLibraryDir

dalvik/system/DexPathList
akeInMemoryDexElements
([Ljava/nio/ByteBuffer;Ljava/util/List;)[Ldalvik/system/DexPathList$Element;
java/nio/ByteBuffer
wra
([B)Ljava/nio/ByteBuffer;
java/util/ArrayList
size

# 往期推荐

1、Alt-Tab Terminator注册算法逆向

2、恶意木马历险记

3、VMP源码分析：反调试与绕过方法

4、Chrome V8 issue 1486342浅析

5、Cython逆向-语言特性分析