frida hook md5 加密信息

還是上次的app 引力波

我們用frida hook住md5的加密函數，md5加密方式一共有四種，我們 不知道哪一種，就都寫上，看打印輸出結果

hook函數 如下

import frida
import sys


def on_message(message, data):
    if message['type'] == 'send':
        print("[*]{0}".format(message['payload']))
    else:
        print(message)


jscode = """
Java.perform(function(){
        var Testsig=Java.use('com.yaotong.crackme.MainActivity')
        Testsig.onCreate.overload('android.os.Bundle').implementation=function(v){
            send('I am here');
            this.onCreate();
        return true ;
        }
})
"""
# 打印輸出基礎地址
jscode1="""
        
        var base_address = Module.findBaseAddress('libc.so');
        send('base_address:'+base_address);
        
        var mod_address=Module.findExportByName('libc.so','dlopen');
        send('mod_address:'+mod_address);
        
        var lib_module=Process.findModuleByAddress(base_address);
        send('lib_module_name:'+lib_module.name);
        
        Interceptor.attach(mod_address,{
        onEnter: function(args){
            send("open("+Memory.readUtf8String(args[0])+","+args[1]+")");   
        },
        onLeave: function(retval){
            send('retval:'+retval);
        }
        })
        

"""
#hook md5加密
jscode2="""
    //打印調用堆棧
    function printstact(){     
        send(Java.use('android.util.log').getStackTraceString(Java.use('java.lang.Exception').$new()));
    }
    //array 轉成 string
    function array2string(array){
            var buffer=Java.array('byte',array);
            var result='';
            for (var i = 0;i<buffer.length;i++){
            result +=(String.fromCharCode(buffer[i]))
            }
            return result;
    }
    Java.perform(function(){ 
        var MessageDigest=Java.use('java.security.MessageDigest');     
        MessageDigest.update.overload('[B').implementation= function (bytesarray) {
        send ('I am here 0');  
        send('ori:'+ array2string(bytesarray));
        printstact() ;
        send('md5:'+this.update('bytesarray'));
        },           
        MessageDigest.update.overload('byte').implementation=function(bytesarray){
        send ('I am here 1'); 
        send('ori:'+array2string(bytesarray));
        printstact();
        send('md5:'+this.update('bytesarray'));
        },   
        MessageDigest.update.overload('java.nio.ByteBuffer').implementation=function(bytesarray){
        send ('I am here 2');
        send('ori:'+array2string(bytesarray));
        printstact();
        send('md5:'+this.update('bytesarray'));
        },   
        MessageDigest.update.overload('[B','int','int').implementation=function(bytesarray){
        send ('I am here 3');
        send('ori:'+array2string(bytesarray));
        printstact();
        send('md5:'+this.update('bytesarray'));
        },
        
        MessageDigest.getInstance.overloads[0].implementation=function(algorithm){
        send('call->getInstance for ' + algorithm);
        return this.getInstance.overloads[0].apply(this,arguments);
        };
            
    }
    );
    """
deveice = frida.get_usb_device()

pid = deveice.spawn(['cn.soulapp.android'])

process = deveice.attach(pid)

# 創建運行腳本
script = process.create_script(jscode2)
# 輸入打印，寫死
script.on('message', on_message)
print('[*] Running CTF')
# 寫死
script.load()
# 重啟程序
deveice.resume(pid)
# 寫死
sys.stdin.read()
最后打印結果，看出加密方式