iOS逆向工程（十二）：微信自动抢红包实战（方法一）

2020-05-20  本文已影响0人  冰风v落叶

前言

基础知识都学完了，我们来实战一下微信自动抢红包的功能，最终实现的效果就是给微信增加一个开关，用来控制自动抢红包功能的开启，并且安装到非越狱手机上。
为了更清晰的展示逆向的过程，除了签名之外，其他的步骤尽量都用原生的工具去给大家展示 ，所以流程会比较繁琐，如果想省事的话，请直接看方法二，方法二里用的工具都高度封装好了，会非常省事
方法一用的Hook语法是：Logos语法 (想在Xcode的.xm文件中打断点，需要在右侧，更改type为Objective-C Source)
方法一用的主要工具是Hopper Disassembler、命令行的LLDB

项目代码已经放到github上了，点击查看WXTweak

一、逆向的整个流程

我们把主要精力放在动态调试和编写逆向代码即可，其他步骤都是固定死的，按部就班来即可。

二、动态调试微信，分析收到红包消息的流程

下面的过程其实非常简单，就是找到聊天界面对应的类，打印出此类的函数调用流程，找到与消息处理有关的类，分析出处理消息的函数，找到红包消息的消息类型

在Mac上打开命令行窗口，让10011端口与10011端口映射、10010与22端口映射
`$ sh usb.sh`

在Mac上新建命令行窗口，然后SSH登陆到手机
`$ sh login.sh`

登录到手机后，启动手机的debugserver服务，让其与App建立交互
`iPhone7ceshiji:~ root# debugserver 127.0.0.1:10011 -a WeChat`

在Mac上新建命令行窗口，进入lldb工具，并且让LLDB与debugserver建立交互
`$ lldb`
`(lldb) process connect connect://localhost:10011`

使用LLDB命令c，先让程序继续运行
`(lldb) c`

使用LLDB命令image list -o -f | grep Mach-O文件名称，查看本次的ASLR偏移量
(lldb) image list -o -f | grep WeChat
结果是：0x0000000002c28000 /private/var/containers/Bundle/Application/F8A60B41-E821-4F80-94F8-E45B7D5EB7B2/WeChat.app/WeChat(0x0000000102c28000)

(lldb) breakpoint set -a 0x100e41984+0x2c28000

* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
  * frame #0: 0x0000000103a69984 WeChat`___lldb_unnamed_symbol47595$$WeChat
    frame #1: 0x0000000111e9c008 WeChatTest.dylib`_logos_method$_ungrouped$BaseMsgContentViewController$addMessageNode$layout$addMoreMsg$(self=0x000000010eb56800, _cmd="addMessageNode:layout:addMoreMsg:", arg1=0x0000000125569600, arg2=true, arg3=false) at BaseMsgContentViewController.xm:375:362
    frame #2: 0x00000001030643f8 WeChat`___lldb_unnamed_symbol15009$$WeChat + 460
    frame #3: 0x0000000104b24228 WeChat`___lldb_unnamed_symbol100217$$WeChat + 356
    frame #4: 0x0000000102c42538 WeChat`___lldb_unnamed_symbol239$$WeChat + 476
    frame #5: 0x0000000102ce775c WeChat`___lldb_unnamed_symbol1834$$WeChat + 552
    frame #6: 0x00000001a507f22c Foundation`__NSThreadPerformPerform + 232
    frame #7: 0x00000001a4c14a00 CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 24
    frame #8: 0x00000001a4c14958 CoreFoundation`__CFRunLoopDoSource0 + 80
    frame #9: 0x00000001a4c140f0 CoreFoundation`__CFRunLoopDoSources0 + 180
    frame #10: 0x00000001a4c0f23c CoreFoundation`__CFRunLoopRun + 1080
    frame #11: 0x00000001a4c0eadc CoreFoundation`CFRunLoopRunSpecific + 464
    frame #12: 0x00000001aeb94328 GraphicsServices`GSEventRunModal + 104
    frame #13: 0x00000001a8d09ae0 UIKitCore`UIApplicationMain + 1936
    frame #14: 0x0000000102e35910 WeChat`___lldb_unnamed_symbol7084$$WeChat + 492
    frame #15: 0x00000001a4a98360 libdyld.dylib`start + 4

'函数基地址 = 虚拟内存中的函数地址 - ASLR偏移地址

frame #0 = 0x0000000103a69984 - 0x2c28000 = 0x100E41984

frame #1 = 0x0000000111e9c008 - 0x2c28000 = 0x10F274008

frame #2 = 0x00000001030643f8 - 0x2c28000 = 0x10043C3F8

frame #3 = 0x0000000104b24228 - 0x2c28000 = 0x101EFC228

frame #4 = 0x0000000102c42538 - 0x2c28000 = 0x10001A538

’在Hopper中，按G键，跳转到指定地址，查看这个地址对应的函数

frame #0：[BaseMsgContentViewController addMessageNode:layout:addMoreMsg:]

frame #1：[BaseMsgContentLogicController DidAddMsg:]

frame #2：[BaseMsgContentLogicController OnAddMsg:MsgWrap:]

frame #3：MMCommon`_callExtension + 480 //扩展函数，排除

frame #4：[CMessageMgr MainThreadNotifyToExt:]

%hook CMessageMgr

-(void)AsyncOnAddMsg:(id)arg1 MsgWrap:(id)arg2{
    NSLog(@"AsyncOnAddMsg的第一个参数 = %@ , 第二个参数 = %@", arg1, arg2);
    NSLog(@"AsyncOnAddMsg的第一个参数的类型 = %@ , 第二个参数的类型 = %@", [arg1 class], [arg2 class]);
    %orig;
}
%end

打印结果是：
AsyncOnAddMsg的第一个参数 = 17385678347@chatroom , 第二个参数 = {m_uiMesLocalID=2066, m_ui64MesSvrID=7603262124305168898, m_nsFromUsr=17385678347@chatroom, m_nsToUsr=wxi*l21~19, m_uiStatus=3, type=47, createTime=1590045768 msgSource="<msgsource><sequence_id>695455296</sequence_id>
    <silence>1</silence>
    <membercount>484</membercount>
</msgsource>
"} 
AsyncOnAddMsg的第一个参数的类型 = __NSCFString , 第二个参数的类型 = CMessageWrap

总结一下：上述过程其实非常简单，就是找到聊天界面对应的类BaseMsgContentViewController，打印出此类的函数调用流程，发现发送消息时，会调用- (void)addMessageNode:(id)arg1 layout:(_Bool)arg2 addMoreMsg:(_Bool)arg3方法，而addMessageNode是被[CMessageMgr MainThreadNotifyToExt:]方法调用的，通过打印追踪，又发现MainThreadNotifyToExt被[CMessageMgr AsyncOnAddMsg:(id)arg1 MsgWrap:(id)arg2]调用的 ，hook此方法，找出红包消息类型，调用流程如下所示：

微信发送/接受消息时：
先调用这个：[CMessageMgr AsyncOnAddMsg:(id)arg1 MsgWrap:(id)arg2]
->
再调用这个：[CMessageMgr MainThreadNotifyToExt:]
->
再调用这个：[BaseMsgContentViewController addMessageNode:(id)arg1 layout:(_Bool)arg2 addMoreMsg:(_Bool)arg3:]
三、动态调试微信，分析抢红包的流程

接收消息的方法已经找到了，接下来只需要在接受消息的方法里，调用抢红包的方法，就可以实现自动抢红包了

WCRedEnvelopesReceiveHomeViewOpenRedEnvelopes的伪代码3.png 
抢红包时，WCRedEnvelopesLogicMgr类的调用顺序：
ReceiverQueryRedEnvelopesRequest
GetHongbaoBusinessRequest
OnWCToHongbaoCommonResponse
OpenRedEnvelopesRequest

GetHongbaoBusinessRequest
OnWCToHongbaoCommonResponse
addReceiveSystemMsgWithDic

总结一下：逆向工程的最核心的地方就是动态调试分析逻辑的过程，这一步做完，剩下写代码反而是最简单的一个环节了

四、根据动态调试的结果，编写逆向代码
%hook CMessageMgr

- (void)AsyncOnAddMsg:(NSString *)msg MsgWrap:(id)wrap {
    %orig;
    
    CMessageWrap * wrap1 = wrap;
    NSInteger uiMessageType = [wrap1 m_uiMessageType];
    if (uiMessageType == 49){
        //收到红包消息
        NSString *nsFromUsr = [wrap m_nsFromUsr];
        WCPayInfoItem *payInfoItem = [wrap m_oWCPayInfoItem];
        if (payInfoItem == nil){
            return;
        }
        
        NSString * m_c2cNativeUrl = [payInfoItem m_c2cNativeUrl];
        if (m_c2cNativeUrl == nil){
            NSLog(@"m_c2cNativeUrl是nil !!!!!!!!!");
            return;
        }
        NSInteger length = [@"wxpay://c2cbizmessagehandler/hongbao/receivehongbao?" length];
        NSString *subString = [m_c2cNativeUrl substringFromIndex: length];
        NSDictionary *dict =  [%c(WCBizUtil) dictionaryWithDecodedComponets:subString separator:@"&"];
        NSMutableDictionary *mutableDict =  [NSMutableDictionary dictionary];
        [mutableDict setObject:@"1" forKey:@"msgType"];
        NSString *sendId = dict[@"sendid"];
        [mutableDict safeSetObject:sendId forKey:@"sendId"];
        NSString *channelId = dict[@"channelid"];
        [mutableDict safeSetObject:channelId forKey:@"channelId"];
        
        CContactMgr *service =  [[%c(MMServiceCenter) defaultCenter] getService:[%c(CContactMgr) class]];
        CContact *contact =  [service getSelfContact];
        NSString *displayName = [contact getContactDisplayName];
        [mutableDict safeSetObject:displayName forKey:@"nickName"];
        NSString *headerImg =  [contact m_nsHeadImgUrl];
        [mutableDict safeSetObject:headerImg forKey:@"headImg"];
        
        id nativeUrl = [payInfoItem m_c2cNativeUrl];
        [mutableDict safeSetObject:nativeUrl forKey:@"nativeUrl"];
        
        MMMsgLogicManager *logicManager =  [[%c(MMServiceCenter) defaultCenter] getService:[%c(MMMsgLogicManager) class]];
        BaseMsgContentLogicController *logicController = [logicManager GetCurrentLogicController];
        id m_contact = [logicController m_contact];
        id sessionUserName = [m_contact m_nsUsrName];
        [mutableDict safeSetObject:sessionUserName forKey:@"sessionUserName"];
        
        if ([nsFromUsr hasSuffix:@"@chatroom"]){
            //群红包
            [mutableDict safeSetObject:@"0" forKey:@"inWay"]; //0:群聊，1：单聊
        }else {
            //个人红包
            [mutableDict safeSetObject:@"1" forKey:@"inWay"]; //0:群聊，1：单聊
        }
        
        [mutableDict safeSetObject:@"0" forKey:@"agreeDuty"];
        
        if (sendId.length > 0)   {
            SPRedParameter *redParameter = [[SPRedParameter alloc] init];
            redParameter.params = mutableDict;
            [[SPRedManager sharedInstance] addParams:redParameter];
        }
        NSLog(@"SPRedManager------mutableDict=%@",mutableDict);
        
        WCRedEnvelopesLogicMgr *redEnvelopesLogicMgr = [[%c(MMServiceCenter) defaultCenter] getService:[%c(WCRedEnvelopesLogicMgr) class]];
        [redEnvelopesLogicMgr ReceiverQueryRedEnvelopesRequest:mutableDict];
    }
}
%end

%hook WCRedEnvelopesLogicMgr

- (void)OnWCToHongbaoCommonResponse:(id)hongBaoRes Request:(id)hongBaoReq{
    %orig;
    HongBaoRes * response = hongBaoRes;
    HongBaoReq * request = hongBaoReq;
    NSError *err;
    NSDictionary *bufferDic = [NSJSONSerialization JSONObjectWithData:response.retText.buffer options:NSJSONReadingMutableContainers error:&err];
    
    if (response == nil || bufferDic == nil){
        return;
    }
    if (request == nil){
        return;
    }
    if (request.cgiCmd == 3){
        int receiveStatus = [bufferDic[@"receiveStatus"] intValue];
        int hbStatus = [bufferDic[@"hbStatus"] intValue];
        /*
        可抢状态：cgiCmdid = 3 自己可抢 ， cgiCmdid = 5 自己已抢过
        红包状态：hbStatus = 2 可抢红包， hbStatus = 4 自己抢过 ，hbStatus=5 过期红包
        是否自己发的：“isSender”:0 别人发的，“isSender”:1 自己发的
        是否群红包：“hbType”:1 群红包，“hbType”:0 个人红包
        自己是否抢过：“receiveStatus”:0 未抢过 ， “receiveStatus”:2 已抢过
         */
        if (receiveStatus == 0 && hbStatus == 2){
            // 没有timingIdentifier字段会被判定为使用外挂
            NSString *timingIdentifier = bufferDic[@"timingIdentifier"];
            NSString *sendId = bufferDic[@"sendId"];
            if (sendId.length > 0 && timingIdentifier.length > 0){
                SPRedParameter *redParameter = [[SPRedManager sharedInstance] getParams:sendId];
                if (redParameter != nil){
                    redParameter.timingIdentifier = timingIdentifier;
                    // 抢的太快也会被判定为使用外挂
                    sleep(1);
                    WCRedEnvelopesLogicMgr *redEnvelopesLogicMgr = [[%c(MMServiceCenter) defaultCenter] getService:[%c(WCRedEnvelopesLogicMgr) class]];
                    if (nil != redEnvelopesLogicMgr){
                        [redEnvelopesLogicMgr OpenRedEnvelopesRequest:redParameter.params];
                    }

                }
            }
        }
    }
}
%end
五、将动态库注入到微信，并重签名，安装到非越狱手机

因为MonkeyDev已经帮我们封装好了codesign命令重签名，所以我们只需要选择好证书就可以了，过程如下：

image.png
上一篇 下一篇

猜你喜欢

热点阅读