AppNinja 开发手记5: gdb&cycript用法 - aes加密key破解

AppNinja 开发手记5: gdb&cycript用法 - aes加密key破解 

学习心得: 动静hook结合，提高破解效率。cycript使用还需要深入。

Written by AppNinja 开发手记

ps aux

gdb -p pid

Reading symbols for shared libraries + done

0x3a4f3a58 in mach_msg_trap ()

1. 目标函数下断点

(gdb) break +[AESCrypt encrypt:password:]    

Breakpoint 1 at 0xce95e

2.执行命中断点:

(gdb) po $r0

AESCrypt

(gdb) po $r1

0xd4628 does not appear to point to a valid object.

(gdb) x/s $r1

0xd4628:         "encrypt:password:"

(gdb) po $r2

aefefefadfaefrefe3023232424242424242444a  

(gdb) po $r3

keypassword           

isEqualToString:

__text:00008958 ; id __cdecl +[AESCrypt encrypt:password:](struct AESCrypt *self, SEL, id, id)

Breakpoint 1 at 0xce95e

cycript

1. 教程
http://www.iphonedevwiki.net/index.php/Cycript_Tricks http://www.cycript.org/manual/#7061c058-5485-4c00-be7e-b67accc55796 http://www.tuicool.com/articles/Ibayy2 http://danqingdani.blog.163.com/blog/static/18609419520135193830786/ http://iphonedevwiki.net/index.php/Cycript http://www.securitylearn.net/2013/09/12/penetration-testing-of-iphone-applications-part-6/
2. 例子

function tryPrintIvars(a){ var x={}; for(i in *a){ try{ x[i] = (*a)[i]; } catch(e){} } return x; }

function printMethods(className) {

  var count = new new Type("I");

  var methods = class_copyMethodList(objc_getClass(className), count);

  var methodsArray = [];

  for(var i = 0; i < *count; i++) {

    var method = methods[i];

    methodsArray.push({selector:method_getName(method), implementation:method_getImplementation(method)});

  }

  free(methods);

  free(count);

  return methodsArray;

}

NSLog_ = dlsym(RTLD_DEFAULT, "NSLog")

NSLog = function() { var types = 'v', args = [], count = arguments.length; for (var i = 0; i != count; ++i) { types += '@'; args.push(arguments[i]); } new Functor(NSLog_, types).apply(null, args); }

NSLog("w ivars: %@", tryPrintIvars(w))

cy# printMethods("NSData")

cy# printMethods("NSString")

cy# @import com.saurik.substrate.MS

cy# var oldm = {};

cy# MS.hookMessage(NSObject, @selector(description), function() {return oldm->call(this) + " (of doom)"; NSLog("ok");}, oldm)

cy# [new NSObject init]

#"<NSObject: 0x100203d10> (of doom)"

cy# @import com.saurik.substrate.MS

cy# fopen = dlsym(RTLD_DEFAULT, "fopen")

cy# fopen = @encode(void *(char *, char *))(fopen)

cy# var oldf = {}

cy# var log = []

# MS.hookFunction(fopen, function(path, mode) {

     var file = (*oldf)(path, mode);

     log.push([path, mode, file]);

     return file;

 }, oldf)

 fopen("/bin/xx", "r");

cy# log

[["/etc/passwd","r",0x7fff72c14280]]

3. 测试 hook function

cy# @import com.saurik.substrate.MS

cy# var oldf = {}

cy# var log = []

cy# MS.hookFunction(fopen, function(path, mode) {

cy>     if (path == "/etc/passwd")

cy>         path = "/var/passwd-fake";

cy>     var file = (*oldf)(path, mode);

cy>     log.push([path, mode, file]);

cy>     return file;

cy> }, oldf)

hook strlen app 马上闪退,为什么?

@import com.saurik.substrate.MS

strlen = dlsym(RTLD_DEFAULT, "strlen")

strlen = @encode(int (const char *))(strlen)

var oldstrlen = {}

var log = []

MS.hookFunction(strlen, function(path) {

     var file = (*oldstrlen)(path);

     log.push([path]);

     return file;

 }, oldstrlen)

4. 测试 hook Message

写法不对,暂时放着。

AESCrypt encrypt:password:

@import com.saurik.substrate.MS

var oldencrypt = {};

var log = []

MS.hookMessage(AESCrypt, @selector(encrypt:password:), function(data, key) {

   log.push([data, key]);

   return oldencrypt->call(this, data, key);

}, oldencrypt)