12_脱壳

2020-08-04  本文已影响0人  伶俐ll

什么是加壳?

利用特殊的算法,对可执行文件的编码进行改变(比如压缩、加密),以达到保护程序代码的目的


Snip20200804_6.png

什么是脱壳?

摘掉壳程序,将未加密的可执行文件还原出来(有些人也称为“砸壳”)

脱壳主要有2种方法:硬脱壳、动态脱壳


Snip20200804_7.png

如何验证可执行文件是否已经脱壳?

iOS中的脱壳工具

iOS中有很多好用的脱壳工具

Clutch

配置:

使用:

iiiiiiiiphone:~ root# Clutch -i
Installed apps:
1:   爱思助手 <com.diary.mood>
2:   快读免费小说-看书追书,聊天交友 <com.book.yueliao>
iiiiiiiiphone:~ root# Clutch -d 2
Zipping YueLiao.app
Swapping architectures..
ASLR slide: 0xa0000
Dumping <YueLiao> (armv7)
Patched cryptid (32bit segment)
Writing new checksum
ASLR slide: 0x1000b4000
Dumping <YueLiao> (arm64)
Patched cryptid (64bit segment)
Writing new checksum
DONE: /private/var/mobile/Documents/Dumped/com.book.yueliao-iOS7.0-(Clutch-2.0.4).ipa
Finished dumping com.book.yueliao in 26.4 seconds

脱壳成功后会生成一个ipa文件,文件路径:/private/var/mobile/Documents/Dumped/com.book.yueliao-iOS7.0-(Clutch-2.0.4).ipa

dumpdecrypted

配置:

iiiiiiiiphone:~ root# DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Containers/Bundle/Application/60903954-D55C-46F3-A655-A1739CE983EE/YueLiao.app/YueLiao
iiiiiiiiphone:~ root# ls -l
total 177640
drwxr-xr-x  3 root wheel       102 Jan 13  2018 Application Support
drwxr-xr-x  7 root wheel       238 Feb  5  2018 Documents
drwxr-xr-x 10 root wheel       340 Feb  5  2018 Library
drwxr-xr-x  3 root wheel       136 Aug  1 10:51 Media
-rw-r--r--  1 root wheel 139181536 Feb  5  2018 WeChat.decrypted
-rw-r--r--  1 root wheel  42514128 Aug  4 16:00 YueLiao.decrypted
-rw-r--r--  1 root wheel    197528 Jan 24  2018 dumpdecrypted.dylib
-rw-r--r--  1 root wheel       400 Jan 21  2018 id_rsa.pub
上一篇下一篇

猜你喜欢

热点阅读