锐客网

  1. 首页 > 睿知 > it技术 > >

nProtect APPGuard安卓反外挂分析

IT知识安卓protect外挂

今日长缨在手，何时缚住苍龙。这篇文章主要讲述nProtect APPGuard安卓反外挂分析相关的知识，希望能为你提供帮助。
工具与环境:
IDA7.0
JEB2.2.5
Nexus 5
android 4.4
目录:
一:app简单分析与java层反编译
二: compatible.so反调试与反反调试
三: compatible.so注册jni函数分析
四: stub.so反调试与反反调试
五: stub.so注册jni函数分析
六: Assembly-CSharp.dll解密分析
七: libengine模块分析
八：总结
一:app简单分析与java层反编译整体图:

nProtect APPGuard安卓反外挂分析

文章图片

1.最近在学习手游保护方面的技术，本文是学习过程中分析某反外挂的一点记录，高手莫要见笑，有不对的地方还请指教，首先简单通过资源目录中文件名做基本了解，
在lib目录中有libmono.so、libunity.so，资源目录中存在(assets\\bin\\Data\\Managed\\Assembly-CSharp.dll)，应该是unity 3D编写，通过反编译发现该文件己被加密，在资源目录下armeabi文件夹中还存放着libengine.sox与libstub.sox文件，看名字猜测很可能这两个文件就是反外挂其中的一些模块了，在看看lib目录下只有libcompatible.so模块比较可疑。如下图所示:
nProtect APPGuard安卓反外挂分析

文章图片

nProtect APPGuard安卓反外挂分析

文章图片

【nProtect APPGuard安卓反外挂分析】
nProtect APPGuard安卓反外挂分析

文章图片

当我们用调试器附加游戏程进时会有如下提示：
nProtect APPGuard安卓反外挂分析

文章图片

被发现有调试器附加，下节我们将分析它的反调试机制。
2.通过JEB反编译来看看大致流程，反编译后先找到application类，代码如下图：
nProtect APPGuard安卓反外挂分析

文章图片

主要是加载so模块，so名称字符串被加密了，解密出来后so名称"compatible",将compatible.so放到IDA中反编译发现函数名被混淆了，字符串己加密，如下图：
nProtect APPGuard安卓反外挂分析

文章图片

通过以上简单分析，我们主要关注的重点关注的模块主要有lib目录下的libcompatible.so与资源目录中的libengine.sox与libstub.sox，还有就是发现java层的字符串与函数名都被混淆，so模块中的字符串也函数名也被混淆。
3.拷贝资源,解密libstub.sox并加载 。
在Lcom/inca/security/Core/AppGuardEngine初始函数< init> (Landroid/content/Context; Lcom/inca/security/AppGuard/AppGuardEventListener; Z)V中将判断X86或ARM平台并将对应的\\assets\\appguard中的libengine.sox、libstub.sox、update.dat拷贝到程序安装目录。JEB未能正常反编译出java代码,看smali代码。
1 :1946 2 00001946const/4v9, 3 3 00001948if-gev6, v9, :1C16 4 :194C 5 0000194Cinvoke-staticBinder-> getABI()I 6 00001952move-resultv6 7 00001954move-object/from16v0, p0 8 00001958move-object/from16v1, p1 9 0000195Cinvoke-virtualAppGuardEngine-> iiIIIiiiIi(Context, I)Z, v0, v1, v6# 拷贝资源 10 00001962move-resultv6 11 00001964if-eqzv6, :1BE0 12 :1968 13 00001968new-instancev6, qb 14 0000196Cinvoke-staticJNISoxProxy-> getContext()Context 15 00001972move-result-objectv9 16 00001974invoke-directqb-> < init> (Context)V, v6, v9 17 0000197Aconst-stringv9, "fChY~_h\\u0004yEr"# libstub.sox 18 0000197Einvoke-virtualqb-> iiIIIiiiIi([B)V, v6, v8 19 00001984invoke-staticb-> iiIIIiiiIi(String)String, v9 20 0000198Amove-result-objectv9 21 0000198Cconst-stringv10, "j\\u000Fd\\u0015r\\u0013dHu\\t"# libstub.so 22 00001990invoke-staticyb-> iiIIIiiiIi(String)String, v10 23 00001996move-result-objectv10 24 00001998const/4v11, 0 25 0000199Ainvoke-virtualqb-> iiIIIiiiIi(String, String, [B)Z, v6, v9, v10, v11# 解密libstub.sox((最终传入so层解密private static native byte[] iIiIIIiIiI(byte[] arg0, int arg1))) 26 000019A0move-resultv6 27 000019A2if-eqzv6, :1BE0 28 :19A6 29 000019A6new-instancev6, File 30 000019AAnew-instancev9, StringBuilder 31 000019AEinvoke-directStringBuilder-> < init> ()V, v9 32 000019B4const/4v10, 0 33 000019B6invoke-staticJNISoxProxy-> getContext()Context 34 000019BCmove-result-objectv11 35 000019BEinvoke-virtualContext-> getFilesDir()File, v11 36 000019C4move-result-objectv11 37 000019C6invoke-virtualFile-> getAbsolutePath()String, v11 38 000019CCmove-result-objectv11 39 000019CEinvoke-virtualStringBuilder-> insert(I, String)StringBuilder, v9, v10, v11 40 000019D4move-result-objectv9 41 000019D6const-stringv10, "%FcHy^\\u007FH$Ye"# /libstub.so 42 000019DAinvoke-staticb-> iiIIIiiiIi(String)String, v10 43 000019E0move-result-objectv10 44 000019E2invoke-virtualStringBuilder-> append(String)StringBuilder, v9, v10 45 000019E8move-result-objectv9 46 000019EAinvoke-virtualStringBuilder-> toString()String, v9 47 000019F0move-result-objectv9 48 000019F2invoke-directFile-> < init> (String)V, v6, v9 49 000019F8invoke-virtualFile-> exists()Z, v6 50 :19FE 51 000019FEmove-resultv9 52 00001A00if-eqzv9, :1BE0 53 :1A04 54 00001A04invoke-virtualFile-> getAbsolutePath()String, v6 55 00001A0Amove-result-objectv9 56 00001A0Cinvoke-staticSystem-> load(String)V, v9# 加载指定路径的SO 57 00001A12invoke-direct/range AppGuardEngine-> lllIIIlllI(Context)V, p0 .. p1# 调用Native 58 :1A18 59 00001A18invoke-virtualFile-> delete()Z, v6 60 00001A1Enew-instancev6, File 61 00001A22new-instancev9, StringBuilder 62 00001A26invoke-directStringBuilder-> < init> ()V, v9 63 00001A2Cconst/4v10, 0 64 00001A2Einvoke-staticJNISoxProxy-> getContext()Context 65 00001A34move-result-objectv11 66 00001A36invoke-virtualContext-> getFilesDir()File, v11 67 00001A3Cmove-result-objectv11 68 00001A3Einvoke-virtualFile-> getAbsolutePath()String, v11 69 00001A44move-result-objectv11 70 00001A46invoke-virtualStringBuilder-> insert(I, String)StringBuilder, v9, v10, v11 71 00001A4Cmove-result-objectv9 72 00001A4Econst-stringv10, ")\\no\\u0004u\\u0012s\\u0004(\\u0015i\\u001E"# /libstub.sox 73 00001A52invoke-staticyb-> iiIIIiiiIi(String)String, v10 74 00001A58move-result-objectv10 75 00001A5Ainvoke-virtualStringBuilder-> append(String)StringBuilder, v9, v10 76 00001A60move-result-objectv9 77 00001A62invoke-virtualStringBuilder-> toString()String, v9 78 00001A68move-result-objectv9 79 00001A6Ainvoke-directFile-> < init> (String)V, v6, v9 80 00001A70invoke-virtualFile-> delete()Z, v6

4. 解密libstub.sox模块。
解密函数在类com/inca/security/qb中iiIIIiiiIi函数，代码如下:
1@SuppressLint(value=https://www.songbingjia.com/android/{"SdCardPath"}) public boolean iiIIIiiiIi(String arg25, String arg26, byte[] arg27) throws IOException, InvalidKeyException { 2Object v18; 3Object v5_2; 4long v16_1; 5Method v8_3; 6Class v11_2; 7Object v7_2; 8Object v4_7; 9Method v15; // doFinal 10Method v14_1; // init java.security.Key 11Object v13_1; // RSA/ECB/PKCS1Padding 12int v8_1; 13int v7; 14FileInputStream v13; 15Method v4_6; 16byte[] v7_1; 17boolean v4_2; 18Method v5_1; // read 19byte[] v12; 20byte[] v11; 21Object v10; // / 22Class v9; // java.io.FileInputStream 23try { 24v9 = Class.forName(vb.iiIIIiiiIi("& 3:3b; #|\\n; 7\\u0005< < \\\'8\\u00018 )3!")); // java.io.FileInputStream 25Constructor v4_1 = v9.getConstructor(String.class); 26v10 = v4_1.newInstance(arg25.indexOf(yb.iiIIIiiiIi("I")) == 0 ? arg25 : new StringBuilder().insert(0, this.iiIiiiIIIi).append(arg25).toString()); // / 27v11 = new byte[16]; 28v12 = new byte[4]; 29v5_1 = v9.getMethod(vb.iiIIIiiiIi(" )3("), byte[].class, Integer.TYPE, Integer.TYPE); // read 30v5_1.invoke(v10, v11, Integer.valueOf(0), Integer.valueOf(3)); 31if(v11[0] == 83 & & v11[1] == 79 & & v11[2] == 88) {// 判断开头是否为SOX 32goto label_82; 33} 34 35v4_2 = false; 36return v4_2; 37} 38catch(Exception v4) { 39goto label_78; 40} 41 42label_82: 43int v4_3 = 3; 44try { 45v5_1.invoke(v10, v11, Integer.valueOf(0), Integer.valueOf(2)); 46if((((short)((((short)v11[0])) | (((short)v11[1])) < < 8))) != 1) { 47return false; 48} 49 50v5_1.invoke(v10, v11, Integer.valueOf(0), Integer.valueOf(1)); 51v5_1.invoke(v10, v11, Integer.valueOf(0), Integer.valueOf(2)); 52v5_1.invoke(v10, v11, Integer.valueOf(0), Integer.valueOf(2)); 53v5_1.invoke(v10, v11, Integer.valueOf(0), Integer.valueOf(4)); 54v5_1.invoke(v10, v11, Integer.valueOf(0), Integer.valueOf(4)); 55v5_1.invoke(v10, v12, Integer.valueOf(0), Integer.valueOf(4)); 56v5_1.invoke(v10, v11, Integer.valueOf(0), Integer.valueOf(12)); 57v5_1.invoke(v10, v11, Integer.valueOf(0), Integer.valueOf(16)); 58v5_1.invoke(v10, v11, Integer.valueOf(0), Integer.valueOf(16)); 59byte[] v4_5 = null; 60if(v11[0] == 0 || v11[1] == 0 || v11[14] == 0 || v11[15] == 0) { 61v7_1 = v4_5; 62v4_6 = v5_1; 63goto label_291; 64label_276: 65while(v7 < 64) { 66v13.read(v11); 67if(v8_1 == v14) { 68v4_5 = new byte[16]; 69System.arraycopy(v11, 0, v4_5, 0, 16); 70} 71 72v7 = v8_1 + 1; 73v8_1 = v7; 74} 75 76v13.close(); 77v7_1 = v4_5; 78v4_6 = v5_1; 79} 80else { 81File v8 = new File(String.format(yb.iiIIIiiiIi("CuI#\\u0015(\\u0012v\\r"), arg25.substring(0, arg25.lastIndexOf(47)), qb.iiIIIiiiIi(v11))); // %s/%s.tpk 82if(v8.exists()) { 83v13 = new FileInputStream(v8); 84v13.read(v11); 85int v14 = (Math.abs(v11[0] < < 24 | v11[4] < < 16 | v11[8] < < 8 | v11[12]) + 1) % 64; 86v7 = 1; 87v8_1 = 1; 88goto label_276; 89} 90else { 91return false; 92} 93} 94 95label_291: 96v4_6.invoke(v10, v11, Integer.valueOf(0), Integer.valueOf(4)); 97v4_5 = new byte[(v11[3] & 255) < < 24 | 0 | (v11[2] & 255) < < 16 | (v11[1] & 255) < < 8 | v11[0] & 255]; 98v5_1 = v9.getMethod(vb.iiIIIiiiIi(" )3("), byte[].class); // read 99v5_1.invoke(v10, v4_5); 100Class v8_2 = Class.forName(yb.iiIIIiiiIi("\\fg\\u0010g\\u001E(\\u0005t\\u001Fv\\u0012iHE\\u000Fv\\u000Ec\\u0014")); // javax.crypto.Cipher 101Method v11_1 = v8_2.getMethod(vb.iiIIIiiiIi("+78\\u001B\\"!83\\"1)"), String.class); // getInstance 102v13_1 = v11_1.invoke(null, yb.iiIIIiiiIi("T5GIC%DIV-E576g\\u0002b\\u000Fh\\u0001")); // RSA/ECB/PKCS1Padding 103v14_1 = v8_2.getMethod(vb.iiIIIiiiIi("; \\"; 8"), Integer.TYPE, Class.forName(yb.iiIIIiiiIi("\\fg\\u0010gHu\\u0003e\\u0013t\\u000Fr\\u001F(-c\\u001F"))); // init java.security.Key 104v14_1.invoke(v13_1, Integer.valueOf(2), this.iIiIIiIiIi); 105v15 = v8_2.getMethod(vb.iiIIIiiiIi("(=\\n; \\"3 "), byte[].class); // doFinal 106v4_7 = v15.invoke(v13_1, v4_5); 107if(v7_1 != null) { 108v13_1 = v11_1.invoke(null, yb.iiIIIiiiIi("\\\'C5")); // AES 109v14_1.invoke(v13_1, Integer.valueOf(2), Class.forName(vb.iiIIIiiiIi("& 3:34|/ 5\\"8=b!< 7/|\\u001F7/ )& \\u000775\\u0001< 7/")).getConstructor(byte[].class, String.class).newInstance(v7_1, yb.iiIIIiiiIi("\\\'C5"))); // javax.crypto.spec.SecretKeySpec AES 110v4_7 = v15.invoke(v13_1, v4_7); 111} 112 113v7_2 = null; 114v7_2 = v11_1.invoke(v7_2, vb.iiIIIiiiIi("\\r\\u0017\\u001F")); 115v14_1.invoke(v7_2, Integer.valueOf(2), Class.forName(yb.iiIIIiiiIi("\\fg\\u0010g\\u001E(\\u0005t\\u001Fv\\u0012iHu\\u0016c\\u0005(5c\\u0005t\\u0003r-c\\u001FU\\u0016c\\u0005")).getConstructor(byte[].class, String.class).newInstance(v4_7, vb.iiIIIiiiIi("\\r\\u0017\\u001F"))); 116v11_2 = Class.forName(yb.iiIIIiiiIi("\\fg\\u0010gHo\\t($\\u007F\\u0012c\\\'t\\u0014g\\u001FI\\u0013r\\u0016s\\u0012U\\u0012t\\u0003g\\u000B")); 117v13_1 = v11_2.getConstructor(null).newInstance(null); 118byte[] v14_2 = new byte[1024]; 119v15 = v8_2.getMethod(vb.iiIIIiiiIi("\\\'< 6-& )"), byte[].class, Integer.TYPE, Integer.TYPE); 120Method v16 = v11_2.getMethod(yb.iiIIIiiiIi("\\u0011t\\u000Fr\\u0003"), byte[].class); 121for(v4_6 = v5_1; true; v4_6 = v5_1) { 122v4_3 = v4_6.invoke(v10, v14_2).intValue(); 123if(v4_3 == -1) { 124break; 125} 126 127v16.invoke(v13_1, v15.invoke(v7_2, v14_2, Integer.valueOf(0), Integer.valueOf(v4_3))); 128} 129 130v16.invoke(v13_1, v8_2.getMethod(vb.iiIIIiiiIi("(=\\n; \\"3 "), null).invoke(v7_2, null)); 131v4_7 = v11_2.getMethod(yb.iiIIIiiiIi("\\u0012i$\\u007F\\u0012c\\\'t\\u0014g\\u001F"), null).invoke(v13_1, null); 132if(arg25.indexOf(vb.iiIIIiiiIi("c")) != 0) { 133arg26 = new StringBuilder().insert(0, this.iiIiiiIIIi).append(arg26).toString(); 134} 135 136Class v7_3 = Class.forName(yb.iiIIIiiiIi("l\\u0007p\\u0007(\\u000FiH@\\u000Fj\\u0003I\\u0013r\\u0016s\\u0012U\\u0012t\\u0003g\\u000B")); 137v8_3 = v7_3.getMethod(vb.iiIIIiiiIi("; %& )"), byte[].class); 138v14_1 = v7_3.getMethod(yb.iiIIIiiiIi("\\u0005j\\tu\\u0003"), null); 139v15 = v7_3.getMethod(vb.iiIIIiiiIi("*> 9!$"), null); 140v7_2 = v7_3.getConstructor(String.class).newInstance(arg26); 141v16_1 = na.iIIIiiiIII(((byte[])v4_7), 5); 142v5_2 = null; 143} 144catch(Exception v4) { 145goto label_78; 146} 147 148try { 149v18 = Binder.getReserved1(); 150if(v18 == null) { 151goto label_761; 152} 153} 154catch(Exception v4) { 155goto label_760; 156} 157 158try { 159v5_2 = v18.getClass().getMethod(yb.iiIIIiiiIi("o/o/O\\u000Fo/o/"), byte[].class, Integer.TYPE).invoke(v18, v4_7, Integer.valueOf(((int)v16_1))); 160} 161catch(Exception v4) { 162try { 163v4.printStackTrace(); 164goto label_659; 165label_761: 166byte[] v5_3 = AppGuardEngine.iiIIIiiiIi(((byte[])v4_7), ((int)v16_1)); // 传入SO层解密 （该Native函数在compatible.so进行动态注册） 167label_760: 168} 169catch(Exception v4) { 170goto label_760; 171} 172} 173 174label_659: 175v4_3 = 3; 176try { 177int v12_1 = v12[0] & 255 | ((v12[v4_3] & 255) < < 24 | 0 | (v12[2] & 255) < < 16 | (v12[1] & 255) < < 8); 178Class v16_2 = Class.forName(vb.iiIIIiiiIi("& 3:3b\\\'8; |6; < |\\r6 7> a~")); 179Object v17 = v16_2.getConstructor(null).newInstance(null); 180v16_2.getMethod(yb.iiIIIiiiIi("s\\u0016b\\u0007r\\u0003"), byte[].class, Integer.TYPE, Integer.TYPE).invoke(v17, v5_2, Integer.valueOf(0), Integer.valueOf(v5_2.length)); 181v16_1 = v16_2.getMethod(vb.iiIIIiiiIi("5)& \\u001A3 \\\')"), null).invoke(v17, null).longValue(); 182if(v12_1 != 0 & & v12_1 != (((int)v16_1))) { 183v14_1.invoke(v7_2, null); 184v4_2 = false; 185} 186else { 187v8_3.invoke(v7_2, v5_2); 188v15.invoke(v7_2, null); 189v14_1.invoke(v7_2, null); 190v9.getMethod(yb.iiIIIiiiIi("\\u0005j\\tu\\u0003"), null).invoke(v10, null); 191v11_2.getMethod(vb.iiIIIiiiIi("/> #!)"), null).invoke(v13_1, null); 192v9.getMethod(yb.iiIIIiiiIi("\\u0005j\\tu\\u0003"), null).invoke(v10, null); 193v4_2 = true; 194} 195 196return v4_2; 197} 198catch(Exception v4) { 199label_78: 200Exception v5_4 = v4; 201v4_2 = false; 202v5_4.printStackTrace(); 203return v4_2; 204} 205}

java层AES解密再传入传入so层解密private static native byte[] iIiIIIiIiI(byte[] arg0, int arg1)。
5. 解密libengine.sox模块
在Lcom/inca/security/Core/AppGuardEngine; -> iiIIIiiiIi([B)Z生成一个随机数后SHA1后字会串做为解密后的文件名存放在/data/data/包名/files/目录下,解密函数与上一步相同。
生成随机数代码:
1 .method private synthetic iiIIIiiiIi([B)Z 2.registers 12 3.annotation build SuppressLint 4value = https://www.songbingjia.com/android/{ 5"TrulyRandom" 6} 7.end annotation 8.annotation system Throws 9value = https://www.songbingjia.com/android/{ 10AppGuardException 11} 12.end annotation 13 00000000const/4v9, 2 14 00000002const/16v8, -0x007E 15 00000006const/16v7, 0x0030 16 0000000Aconst/4v2, 0 17 0000000Cconst/4v3, 1 18 :E 19 0000000Econst-stringv1,"U.GW"# SHA1 20 00000012invoke-staticyb-> iiIIIiiiIi(String)String, v1 21 00000018move-result-objectv1 22 0000001Ainvoke-staticMessageDigest-> getInstance(String)MessageDigest, v1 23 :20 24 00000020move-result-objectv1 25 :22 26 00000022new-instancev4, SecureRandom 27 00000026invoke-directSecureRandom-> < init> ()V, v4 28 0000002Cconst/16v5, 0x0100 29 00000030new-arrayv5, v5, [B 30 00000034const/16v6, 0x0126 31 00000038invoke-virtualSecureRandom-> nextBytes([B)V, v4, v5 32 0000003Einvoke-virtualMessageDigest-> update([B)V, v1, v5 33 00000044invoke-virtualSecureRandom-> nextBytes([B)V, v4, v5 34 0000004Ainvoke-virtualMessageDigest-> update([B)V, v1, v5 35 00000050new-instancev4, BigInteger 36 00000054invoke-virtualMessageDigest-> digest()[B, v1 37 0000005Amove-result-objectv1 38 0000005Cinvoke-directBigInteger-> < init> (I, [B)V, v4, v3, v1 39 00000062const/16v1, 0x0010 40 00000066invoke-virtualBigInteger-> toString(I)String, v4, v1# 随机数后SHA1值 41 0000006Cmove-result-objectv1 42 0000006Eiput-objectv1, p0, AppGuardEngine-> IiIIiiiiii_Random_SHA1:String# 解密后文件名 43 //解密并调用 44 00000D7Anew-instancev4, qb 45 00000D7Einvoke-staticJNISoxProxy-> getContext()Context 46 00000D84move-result-objectv5 47 00000D86invoke-directqb-> < init> (Context)V, v4, v5 48 00000D8Cconst-stringv5, "fChOdMcDo\\u0004yEr"# libengine.sox 49 00000D90invoke-virtualqb-> iiIIIiiiIi([B)V, v4, v1 50 00000D96invoke-staticb-> iiIIIiiiIi(String)String, v5 51 00000D9Cmove-result-objectv1 52 00000D9Eiget-objectv5, p0, AppGuardEngine-> IiIIiiiiii_Random_SHA1:String 53 00000DA2const/4v6, 0 54 00000DA4invoke-virtualqb-> iiIIIiiiIi(String, String, [B)Z, v4, v1, v5, v6# 解密libengine.sox(最终传入so层解密private static native byte[] iIiIIIiIiI(byte[] arg0, int arg1)) 55 :DAA 56 00000DAAmove-objectv0, p0 57 :DAC 58 00000DACinvoke-staticJNISoxProxy-> getContext()Context 59 00000DB2move-result-objectv1 60 00000DB4new-instancev4, StringBuilder 61 00000DB8invoke-directStringBuilder-> < init> ()V, v4 62 00000DBEinvoke-staticJNISoxProxy-> getContext()Context 63 00000DC4move-result-objectv5 64 00000DC6invoke-virtualContext-> getFilesDir()File, v5 65 00000DCCmove-result-objectv5 66 00000DCEinvoke-virtualFile-> getAbsolutePath()String, v5 67 00000DD4move-result-objectv5 68 00000DD6invoke-virtualStringBuilder-> insert(I, String)StringBuilder, v4, v2, v5 69 00000DDCmove-result-objectv4 70 00000DDEconst-stringv5, "%"# / 71 00000DE2invoke-staticb-> iiIIIiiiIi(String)String, v5 72 00000DE8move-result-objectv5 73 00000DEAinvoke-virtualStringBuilder-> append(String)StringBuilder, v4, v5 74 00000DF0move-result-objectv4 75 00000DF2iget-objectv5, p0, AppGuardEngine-> IiIIiiiiii_Random_SHA1:String 76 00000DF6invoke-virtualStringBuilder->

    推荐阅读


    上一篇：ArcGISWeb AppBuilder For ArcGIS 配置使用

    下一篇：《Android源码设计模式》--状态模式