iOS逆向之砸壳与重签

2021-01-04  本文已影响0人  崔希羽

本文只是为了学习理解整个过程和原理，砸壳和重签都有很多种简单快速的方式，本文不探讨

iPhone配置
越狱，本人使用的是iphone6s plus 12.4(非完美越狱)，最好是能完美越狱，因为有些工具可能不支持非完美越狱手机，截止2020年底12.2以下均可完美越狱，可在pp助手、爱思助手查看。

Mac配置

brew install python  #安装python
brew install wget #安装wget
#安装pip
wget https://bootstrap.pypa.io/get-pip.py
sudo python get-pip.py

pip3 install frida  #安装frida
pip3 install firda-tools #安装frida命令行工具

sudo pip3 install -r requirements.txt --upgrade

brew install usbmuxd   #安装usbmuxd

连接

iproxy 2222 22

此时终端会输出➜ waiting for connection，再打开一个终端窗口，使用ssh登录iphone手机

➜  ~ ssh root@127.0.0.1 -p 2222
root@127.0.0.1's password: #这里密码默认的是alpine
iPhone:~ root#

到了这一步ssh登录成功，下面就可以使用dump.py脚本查看手机里的应用了。

注：我这里使用ssh访问没有成功，折腾半天一直报错ssh_exchange_identification: read: Connection reset by peer最终放弃。采用了第二方案，使用爱思助手 --> 打开SSH通道->弹出提示包含端口，密码，保证dump.py里面一致即可，随后继续后面的步骤

砸壳

➜  dump /Users/Peny/frida-ios-dump/dump.py com.tencent.xin
Start the target app com.tencent.xin
Dumping 微信 to /var/folders/2_/ts8l68y17cncks73d_vjz4vh0000gn/T
[frida-ios-dump]: OpenSSL.framework has been loaded.
[frida-ios-dump]: ProtobufLite.framework has been loaded.
[frida-ios-dump]: andromeda.framework has been loaded.
[frida-ios-dump]: mars.framework has been loaded.
[frida-ios-dump]: marsbridgenetwork.framework has been loaded.
[frida-ios-dump]: matrixreport.framework has been loaded.
start dump /var/containers/Bundle/Application/3356DDD1-7B64-4B8E-AA2D-0F7BAA394A9A/WeChat.app/WeChat
WeChat.fid: 100%|███████████████████████████████████████████████████████████████████████████| 144M/144M [00:04<00:00, 33.9MB/s]
start dump /private/var/containers/Bundle/Application/3356DDD1-7B64-4B8E-AA2D-0F7BAA394A9A/WeChat.app/Frameworks/mars.framework/mars
mars.fid: 100%|███████████████████████████████████████████████████████████████████████████| 12.7M/12.7M [00:00<00:00, 32.7MB/s]
start dump /private/var/containers/Bundle/Application/3356DDD1-7B64-4B8E-AA2D-0F7BAA394A9A/WeChat.app/Frameworks/andromeda.framework/andromeda
andromeda.fid: 100%|██████████████████████████████████████████████████████████████████████| 8.71M/8.71M [00:00<00:00, 31.2MB/s]
start dump /private/var/containers/Bundle/Application/3356DDD1-7B64-4B8E-AA2D-0F7BAA394A9A/WeChat.app/Frameworks/OpenSSL.framework/OpenSSL
OpenSSL.fid: 100%|████████████████████████████████████████████████████████████████████████| 2.38M/2.38M [00:00<00:00, 27.1MB/s]
start dump /private/var/containers/Bundle/Application/3356DDD1-7B64-4B8E-AA2D-0F7BAA394A9A/WeChat.app/Frameworks/ProtobufLite.framework/ProtobufLite
ProtobufLite.fid: 100%|█████████████████████████████████████████████████████████████████████| 205k/205k [00:00<00:00, 10.0MB/s]
start dump /private/var/containers/Bundle/Application/3356DDD1-7B64-4B8E-AA2D-0F7BAA394A9A/WeChat.app/Frameworks/marsbridgenetwork.framework/marsbridgenetwork
marsbridgenetwork.fid: 100%|██████████████████████████████████████████████████████████████| 2.40M/2.40M [00:00<00:00, 27.6MB/s]
start dump /private/var/containers/Bundle/Application/3356DDD1-7B64-4B8E-AA2D-0F7BAA394A9A/WeChat.app/Frameworks/matrixreport.framework/matrixreport
matrixreport.fid: 100%|█████████████████████████████████████████████████████████████████████| 469k/469k [00:00<00:00, 17.3MB/s]
network_setting.html: 260MB [00:12, 22.2MB/s]
0.00B [00:00, ?B/s]
Generating "微信.ipa"
➜  dump

重签名方式一

➜  security find-identity -v -p codesigning
  1) 733B3EBFD4132FB93F8E21ABC93500B89563E212 "Apple Development: xxxx@163.com (HM4asdfads)"
  2) 6A525348B0F4A138E826DF86C15765EC220CAD57 "Apple Development: xxxx (LP48asdfad)"
  3) 1A5BABAD6111FD9C1B947BC7E7B39BF07F28690F "Apple Distribution: Beijing xxxxx (55Wdsasdfadsf)"
     3 valid identities found

➜  codesign -vv -d WeChat.app
Executable=/Users/XXX/Desktop/dump/Payload/WeChat.app/WeChat
Identifier=com.tencent.xin
Format=app bundle with Mach-O thin (arm64)
CodeDirectory v=20500 size=2308891 flags=0x0(none) hashes=36071+7 location=embedded
Signature size=4390
Authority=Apple iPhone OS Application Signing
Authority=Apple iPhone Certification Authority
Authority=Apple Root CA
Info.plist entries=72
TeamIdentifier=88L2Q4487U
Sealed Resources version=2 rules=22 files=1683
Internal requirements count=1 size=96

➜  WeChat.app otool -l WeChat

...
Load command 12
          cmd LC_ENCRYPTION_INFO_64
      cmdsize 24
     cryptoff 16384
    cryptsize 121225216
      cryptid 0   # 0代表没有加密，1代表加密
          pad 0
Load command 13
...

➜  WeChat.app cd Frameworks
➜  Frameworks codesign -fs "Apple Development: xxxx@163.com (HM4asdfads)"  xxx.frameworks

➜  WeChat.app security cms -Di embedded.mobileprovision
...
<key>Entitlements</key>
    <dict>
        <key>application-identifier</key>
        <string>HM4asdfads.con.xxxx.demo*</string>
        <key>keychain-access-groups</key>
        <array>
        <string>HM4asdfads.*</string>
        <string>com.apple.token</string>
        </array>
        <key>get-task-allow</key>
        <true/>
        <key>com.apple.developer.team-identifier</key>
        <string>55WHPN47NF</string>
    </dict>
...

将<dict></dict>中的内容填充到ent.plist文件中，接下来就可以使用ent.plist对WeChat.app进行签名了

➜  WeChatDemo ls
AppDelegate.h     AppDelegate.m     Assets.xcassets   Base.lproj        Info.plist        SceneDelegate.h   SceneDelegate.m   ViewController.h  ViewController.m  WeChat.app        ent.plist         main.m
➜  WeChatDemo codesign -fs "Apple Development: xxxx@163.com (HM4asdfads)" --no-strict --entitlements=ent.plist WeChat.app
WeChat.app: replacing existing signature
➜  WeChatDemo

重签名方式二

使用xcode创建同名工程，这里的同名指的是target一致，xcode根据target在run的时候生成app文件。新创建一个WeChat或者在任意一个工程的TARGETS添加WeChat都可以。

重签名方式三
借助xcode中Run Script，编写shell脚本，实现自动重签，主要是脚本的编写，引用一下别人写的脚本示例：

# ${SRCROOT} 它是工程文件所在的目录
TEMP_PATH="${SRCROOT}/Temp"
#资源文件夹，我们提前在工程目录下新建一个APP文件夹，里面放ipa包
ASSETS_PATH="${SRCROOT}/APP"
#目标ipa包路径
TARGET_IPA_PATH="${ASSETS_PATH}/*.ipa"
#清空Temp文件夹
rm -rf "${SRCROOT}/Temp"
mkdir -p "${SRCROOT}/Temp"



#----------------------------------------
# 1. 解压IPA到Temp下
unzip -oqq "$TARGET_IPA_PATH" -d "$TEMP_PATH"
# 拿到解压的临时的APP的路径
TEMP_APP_PATH=$(set -- "$TEMP_PATH/Payload/"*.app;echo "$1")
# echo "路径是:$TEMP_APP_PATH"


#----------------------------------------
# 2. 将解压出来的.app拷贝进入工程下
# BUILT_PRODUCTS_DIR 工程生成的APP包的路径
# TARGET_NAME target名称
TARGET_APP_PATH="$BUILT_PRODUCTS_DIR/$TARGET_NAME.app"
echo "app路径:$TARGET_APP_PATH"

rm -rf "$TARGET_APP_PATH"
mkdir -p "$TARGET_APP_PATH"
cp -rf "$TEMP_APP_PATH/" "$TARGET_APP_PATH"



#----------------------------------------
# 3. 删除extension和WatchAPP.个人证书没法签名Extention
rm -rf "$TARGET_APP_PATH/PlugIns"
rm -rf "$TARGET_APP_PATH/Watch"



#----------------------------------------
# 4. 更新info.plist文件 CFBundleIdentifier
#  设置:"Set : KEY Value" "目标文件路径"
/usr/libexec/PlistBuddy -c "Set :CFBundleIdentifier $PRODUCT_BUNDLE_IDENTIFIER" "$TARGET_APP_PATH/Info.plist"


#----------------------------------------
# 5. 给MachO文件上执行权限
# 拿到MachO文件的路径
APP_BINARY=`plutil -convert xml1 -o - $TARGET_APP_PATH/Info.plist|grep -A1 Exec|tail -n1|cut -f2 -d\>|cut -f1 -d\<`
#上可执行权限
chmod +x "$TARGET_APP_PATH/$APP_BINARY"



#----------------------------------------
# 6. 重签名第三方 FrameWorks
TARGET_APP_FRAMEWORKS_PATH="$TARGET_APP_PATH/Frameworks"
if [ -d "$TARGET_APP_FRAMEWORKS_PATH" ];
then
for FRAMEWORK in "$TARGET_APP_FRAMEWORKS_PATH/"*
do

#签名
/usr/bin/codesign --force --sign "$EXPANDED_CODE_SIGN_IDENTITY" "$FRAMEWORK"
done
fi

PS：本人只是为了学习和研究，如有冒犯请多多见谅~

上一篇 下一篇

猜你喜欢

热点阅读