iOS逆向记录(五)微信抢红包第一篇

2017-09-14  本文已影响198人  Flonger

14. 项目实战(微信抢红包插件)

14.1 定位红包消息响应方法

14.1.1 砸壳和导出头文件以供分析用

详细过程见笔记第7章

 DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Containers/Bundle/Application/749DC69A-3A8D-4B5C-9926-1220E69FC85F/WeChat.app/WeChat
  
class-dump -s -S -H WeChat.decrypted -o ./MyHeaders

14.1.2 借助cycript来动态分析界面定位视图控制器（ViewController）

  cycript -p WeChat

 [[UIApp keyWindow] recursiveDescription].toString()
 或者
 UIApp.keyWindow.recursiveDescription().toString()

 <UIView: 0x14eaed070; frame = (0 0; 320 568); autoresize = W+H; layer = <CALayer: 0x14eafa130>>
  
 //使用nextResponder找到视图控制器（ViewController）
 cy# [#0x14eaed070 nextResponder]
 #"<BaseMsgContentViewController: 0x14f1dc200>"

 ➜ ls -al *BaseMsgContentViewController*
 -rw-r--r--  1 liuzhongzheng  staff  26105 Aug 25 15:59 BaseMsgContentViewController.h

14.1.3 借助Reveal来动态分析界面定位视图控制器（ViewController）

14.1.4 借助thoes模块Logify来精确定位消息响应方法

/opt/theos/bin/logify.pl ../WeChat/Headers/BaseMsgContentViewController.h > Tweak.xm

make package
make install

tail -f /var/log/syslog | grep WeChat
 
[<BaseMsgContentViewController: 0x1368e9c00> addMessageNode:{m_uiMesLocalID=38, m_ui64MesSvrID=6021494297990342718, m_nsFromUsr=wxi*431~19, m_nsToUsr=wxi*r12~19, m_uiStatus=4, type=1, msgSource="<msgsource><sequence_id>649531066</sequence_id></msgsource>"}  layout:1 addMoreMsg:0]
 
//定位到与消息响应相关的方法
- (void)addMessageNode:(id)arg1 layout:(_Bool)arg2 addMoreMsg:(_Bool)arg3 { %log; %orig; }

14.1.5 借助lldb进行动态调试

 Flongers-iPhone:/Developer/usr/bin root# ls
 DTDeviceArbitration*  ScreenShotr*  XcodeDeviceMonitor*  debugserver*  iprofiler*  xctest*

 lldb 
 process connect connect://192.168.1.113:9527  //ip是iPhone的地址，端口要一致

 //把本地2222端口转发到iOS的22(ssh)端口
 ./tcprelay.py -t 22:2222
 Forwarding local port 2222 to remote port 22

 //ssh进行连接 - localhost(127.0.0.1)是本地主机(本机的标准域名)
 ssh root@localhost -p 2222   

image list -o -f 
 
(lldb) image list -o -f
[  0] 0x0000000000054000 /private/var/mobile/Containers/Bundle/Application/749DC69A-3A8D-4B5C-9926-1220E69FC85F/WeChat.app/WeChat(0x0000000100054000)

偏移后模块基地址 = 偏移前模块基地址 + 模块的ASLR偏移
偏移后符号基地址 = 偏移前符号基地址 + 符号所在模块的ASLR偏移（一般用在这儿）
偏移后指令基地址 = 偏移前指令基地址 + 指令所在模块的ASLR偏移

 -[BaseMsgContentViewController addMessageNode:layout:addMoreMsg:]:
0000000101dcbb0c         db  0xe9 ; '.'                                         
0000000101dcbb0d         db  0x23 ; '#'

(lldb) bt
   * thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 2.1
     * frame #0: 0x0000000101defb0c WeChat`_mcwxh_dydx33_8to8(_VDecStruct*, unsigned char*, unsigned char*, unsigned int, unsigned int, unsigned int, unsigned int) + 23979876
       frame #1: 0x0000000102035434 WeChat`_mcwxh_dydx33_8to8(_VDecStruct*, unsigned char*, unsigned char*, unsigned int, unsigned int, unsigned int, unsigned int) + 26361996
       frame #2: 0x000000010202059c WeChat`_mcwxh_dydx33_8to8(_VDecStruct*, unsigned char*, unsigned char*, unsigned int, unsigned int, unsigned int, unsigned int) + 26276340
       frame #3: 
       WeChat`_mcwxh_dydx33_8to8(_VDecStruct*, unsigned char*, unsigned char*, unsigned int, unsigned int, unsigned int, unsigned int) + 34703800
       frame #4: 0x0000000187955f9c Foundation`__NSThreadPerformPerform + 372
       frame #5: 0x0000000186a0c240 CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 24
       frame #6: 0x0000000186a0b4e4 CoreFoundation`__CFRunLoopDoSources0 + 264
       frame #7: 0x0000000186a09594 CoreFoundation`__CFRunLoopRun + 712
       frame #8: 0x00000001869352d4 CoreFoundation`CFRunLoopRunSpecific + 396
       frame #9: 0x00000001901536fc GraphicsServices`GSEventRunModal + 168
       frame #10: 0x000000018b4fafac UIKit`UIApplicationMain + 1488
       frame #11: 0x00000001000bab5c WeChat`_mh_execute_header + 617308
       frame #12: 0x00000001988a6a08 libdyld.dylib`start + 4
  
 //计算函数地址
偏移后符号基地址 = 偏移前符号基地址 + 符号所在模块的ASLR偏移
偏移后符号基地址 - 符号所在模块的ASLR偏移 = 偏移前符号基地址
0x0000000101e3db24 -  00000000000f4000 =  101D49B24

@interface CMessageWrap
  @property (nonatomic, strong) NSString* m_nsContent;
  @property (nonatomic, assign) NSInteger m_uiMessageType;
  @property(retain, nonatomic) NSString *m_nsFromUsr;
  @property(retain, nonatomic) NSString *m_nsToUsr; 

  @property(retain, nonatomic) NSString *m_nsAtUserList; // @synthesize m_nsAtUserList;
  @property(retain, nonatomic) NSString *m_nsBizChatId; // @synthesize m_nsBizChatId;
  @property(retain, nonatomic) NSString *m_nsBizClientMsgID; // @synthesize m_nsBizClientMsgID;
  @property(retain, nonatomic) NSString *m_nsDisplayName; // @synthesize m_nsDisplayName;
  @property(retain, nonatomic) NSString *m_nsKFWorkerOpenID; // @synthesize m_nsKFWorkerOpenID;
  @property(retain, nonatomic) NSString *m_nsMsgSource; // @synthesize m_nsMsgSource;
  @property(retain, nonatomic) NSString *m_nsPattern; // @synthesize m_nsPattern;
  @property(retain, nonatomic) NSString *m_nsPushContent; // @synthesize m_nushContent;
  @property(retain, nonatomic) NSString *m_nsRealChatUsr; // @synthesize m_nsRealChatUsr;
  @end
   
  %hook CMessageMgr
  - (void)AsyncOnAddMsg:(NSString *)wxid MsgWrap:(CMessageWrap *)wrap {
    %orig;
    NSInteger uiMessageType = [wrap m_uiMessageType];
    NSString* content = [wrap m_nsContent];
    NSString* nsFromUsr = [wrap m_nsFromUsr];
    NSString* nsToUsr = [wrap m_nsToUsr];
    NSString* nsAtUserList = [wrap m_nsAtUserList];
    NSString* nsBizChatId = [wrap m_nsBizChatId];
    NSString* nsBizClientMsgID = [wrap m_nsBizClientMsgID];
    NSString* nsKFWorkerOpenID = [wrap m_nsKFWorkerOpenID];
    NSString* nsMsgSource = [wrap m_nsMsgSource];
    NSString* nsDisplayName = [wrap m_nsDisplayName];
    NSString* nsPattern = [wrap m_nsPattern];
    NSString* nsRealChatUsr = [wrap m_nsRealChatUsr];
    NSString* nsPushContent = [wrap m_nsPushContent];
     
    NSLog(@"m_uiMessageType=%zd m_nsContent=%@ m_nsFromUsr=%@ m_nsToUsr=%@ m_nsAtUserList=%@ m_nsBizChatId=%@ m_nsBizClientMsgID=%@ m_nsDisplayName=%@ m_nsKFWorkerOpenID=%@ m_nsMsgSource=%@ m_nsPattern=%@ m_nsPushContent=%@ m_nsRealChatUsr=%@",
                                          uiMessageType,
                                          content,
                                          nsFromUsr,
                                          nsToUsr,
                                          nsAtUserList,nsBizChatId,                 
                                          nsBizClientMsgID,
                                          nsDisplayName,
                                          nsKFWorkerOpenID,
                                          nsMsgSource,
                                          nsPattern,
                                          nsPushContent,
                                          nsRealChatUsr);
                                            //记录消息 
    if( 1 == uiMessageType ){ //普通消息
      if( 0 == nsPushContent.length){
          if([nsToUsr rangeOfString:@"filehelper"].location != NSNotFound)
              NSLog(@"[文件助手: %@]",content);
          else  NSLog(@"[我: %@]",content);
      }else
        NSLog(@"[%@]",nsPushContent);      
    }else if ( 3 == uiMessageType ){ //图片消息
       NSLog(@"收到图片消息");
    }else if ( 49 == uiMessageType ){ //红包消息
       NSLog(@"收到红包消息");
    }  
  }%end
上一篇下一篇

猜你喜欢

热点阅读