IOS逆向-更改常见算法脚本

以你之姓@ 2023-09-26 18:24 16阅读 0赞

堆栈打印：

log('堆栈 from:\n' +Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n') + '\n');

我们盲猜测算法后，可以直接使用：

> frida-trace -UF -i CC\_MD5 -i CC\_SHA1

可以无限迭代， -i xxx ;

我们知道object-C 前两个参数，一个是类本身，一个是方法名，所以我们打印可以直接打印下标为2的值；

![在这里插入图片描述][c001f82c6b0241aeb5ef03d61a2a8788.png]  
直接更改这个路径下的js文件，完善脚本；

> C:\\Users\\xxx\_*handlers*\_\\libcommonCrypto.dylib

### **CC\_MD5.js** ###

/*
     * Auto-generated by Frida. Please modify to match the signature of CC_MD5.
     * This stub is currently auto-generated from manpages when available.
     *
     * For full API reference, see: https://frida.re/docs/javascript-api/
     */
    
    {
        
      /**
       * Called synchronously when about to call CC_MD5.
       *
       * @this {object} - Object allowing you to store state for use in onLeave.
       * @param {function} log - Call this function with a string to be presented to the user.
       * @param {array} args - Function arguments represented as an array of NativePointer objects.
       * For example use args[0].readUtf8String() if the first argument is a pointer to a C string encoded as UTF-8.
       * It is also possible to modify arguments by assigning a NativePointer object to an element of this array.
       * @param {object} state - Object allowing you to keep state across function calls.
       * Only one JavaScript function will execute at a time, so do not worry about race-conditions.
       * However, do not use this to store function arguments across onEnter/onLeave, but instead
       * use "this" which is an object for keeping state local to an invocation.
       */
      onEnter(log, args, state) {
        
        log('CC_MD5() onEnter: ' + args[0].readCString(args[1].toInt32()));
    	this.args2 = args[2];
      },
    
      /**
       * Called synchronously when about to return from CC_MD5.
       *
       * See onEnter for details.
       *
       * @this {object} - Object allowing you to access state stored in onEnter.
       * @param {function} log - Call this function with a string to be presented to the user.
       * @param {NativePointer} retval - Return value represented as a NativePointer object.
       * @param {object} state - Object allowing you to keep state across function calls.
       */
      onLeave(log, retval, state) {
        
    	log('CC_MD5() onLeave: ' + hexdump(this.args2, {
        length: 16}));
      }
    }

### CC\_SHA1.js ###

/*
     * Auto-generated by Frida. Please modify to match the signature of CC_SHA1.
     * This stub is currently auto-generated from manpages when available.
     *
     * For full API reference, see: https://frida.re/docs/javascript-api/
     */
    
    {
        
      /**
       * Called synchronously when about to call CC_SHA1.
       *
       * @this {object} - Object allowing you to store state for use in onLeave.
       * @param {function} log - Call this function with a string to be presented to the user.
       * @param {array} args - Function arguments represented as an array of NativePointer objects.
       * For example use args[0].readUtf8String() if the first argument is a pointer to a C string encoded as UTF-8.
       * It is also possible to modify arguments by assigning a NativePointer object to an element of this array.
       * @param {object} state - Object allowing you to keep state across function calls.
       * Only one JavaScript function will execute at a time, so do not worry about race-conditions.
       * However, do not use this to store function arguments across onEnter/onLeave, but instead
       * use "this" which is an object for keeping state local to an invocation.
       */
      onEnter(log, args, state) {
        
    	log('CC_SHA1() onEnter: ' + args[0].readCString(args[1].toInt32()));
    	this.args2 = args[2];
      },
    
      /**
       * Called synchronously when about to return from CC_SHA1.
       *
       * See onEnter for details.
       *
       * @this {object} - Object allowing you to access state stored in onEnter.
       * @param {function} log - Call this function with a string to be presented to the user.
       * @param {NativePointer} retval - Return value represented as a NativePointer object.
       * @param {object} state - Object allowing you to keep state across function calls.
       */
      onLeave(log, retval, state) {
        
    	log('CC_SHA1() onLeave: ' + hexdump(this.args2, {
        length: 20}));
      }
    }

### SecKeyEncrypt RSA ###

frida-trace -UF -i CC_MD5 -i CC_SHA1 -i CCCrypt -i SecKeyEncrypt

![在这里插入图片描述][baa1623cabf441f0ae93ee863fe91959.png]

/*
     * Auto-generated by Frida. Please modify to match the signature of SecKeyEncrypt.
     * This stub is currently auto-generated from manpages when available.
     *
     * For full API reference, see: https://frida.re/docs/javascript-api/
     */
    
    {
        
      /**
       * Called synchronously when about to call SecKeyEncrypt.
       *
       * @this {object} - Object allowing you to store state for use in onLeave.
       * @param {function} log - Call this function with a string to be presented to the user.
       * @param {array} args - Function arguments represented as an array of NativePointer objects.
       * For example use args[0].readUtf8String() if the first argument is a pointer to a C string encoded as UTF-8.
       * It is also possible to modify arguments by assigning a NativePointer object to an element of this array.
       * @param {object} state - Object allowing you to keep state across function calls.
       * Only one JavaScript function will execute at a time, so do not worry about race-conditions.
       * However, do not use this to store function arguments across onEnter/onLeave, but instead
       * use "this" which is an object for keeping state local to an invocation.
       */
      onEnter(log, args, state) {
        
    	log('SecKeyEncrypt called from:\n' +
            Thread.backtrace(this.context, Backtracer.ACCURATE)
            .map(DebugSymbol.fromAddress).join('\n') + '\n');
    	log('SecKeyEncrypt key: ' + hexdump(args[0]));
    	log('SecKeyEncrypt padding: ' + (args[1]).toInt32());
    	log('SecKeyEncrypt plainText: ' + (args[2]).readCString());
    	log('SecKeyEncrypt plainTextSize: ' + (args[3]).toInt32());
    	this.args4 = args[4];
    	this.args5 = args[5];
      },
    
      /**
       * Called synchronously when about to return from SecKeyEncrypt.
       *
       * See onEnter for details.
       *
       * @this {object} - Object allowing you to access state stored in onEnter.
       * @param {function} log - Call this function with a string to be presented to the user.
       * @param {NativePointer} retval - Return value represented as a NativePointer object.
       * @param {object} state - Object allowing you to keep state across function calls.
       */
      onLeave(log, retval, state) {
        
    	log('SecKeyEncrypt cipherText: ' + hexdump(this.args4, {
        length: 128}));
    	log('SecKeyEncrypt cipherTextSize: ' + (this.args5).readInt());
      }
    }

frida-trace -UF -m "-[NSData initWithContentsOfFile:]"

查看本地证书

### CCCrypt ###

/*
     * Auto-generated by Frida. Please modify to match the signature of CCCrypt.
     * This stub is currently auto-generated from manpages when available.
     *
     * For full API reference, see: https://frida.re/docs/javascript-api/
     */
    
    {
        
      /**
       * Called synchronously when about to call CCCrypt.
       *
       * @this {object} - Object allowing you to store state for use in onLeave.
       * @param {function} log - Call this function with a string to be presented to the user.
       * @param {array} args - Function arguments represented as an array of NativePointer objects.
       * For example use args[0].readUtf8String() if the first argument is a pointer to a C string encoded as UTF-8.
       * It is also possible to modify arguments by assigning a NativePointer object to an element of this array.
       * @param {object} state - Object allowing you to keep state across function calls.
       * Only one JavaScript function will execute at a time, so do not worry about race-conditions.
       * However, do not use this to store function arguments across onEnter/onLeave, but instead
       * use "this" which is an object for keeping state local to an invocation.
       */
      onEnter(log, args, state) {
        
    	log('CC_MD5 called from:\n' +
            Thread.backtrace(this.context, Backtracer.ACCURATE)
            .map(DebugSymbol.fromAddress).join('\n') + '\n');
    	log('CCCrypt() kCCEncrypt 0 or kCCDecrypt 1: ', args[0]);
        log('CCCrypt() CCAlgorithm: ', args[1]);
        log('CCCrypt() CCOptions 1/2: ', args[2]);
        log('CCCrypt() key: ', hexdump(args[3]));
        log('CCCrypt() keyLen: ', args[4]);
        log('CCCrypt() iv: ', hexdump(args[5]));
        log('CCCrypt() dataIn: ', hexdump(args[6]));
        log('CCCrypt() dataInLength: ', args[7]);
    	this.args8 = args[8];
    	this.args10 = args[10];
      },
    
      /**
       * Called synchronously when about to return from CCCrypt.
       *
       * See onEnter for details.
       *
       * @this {object} - Object allowing you to access state stored in onEnter.
       * @param {function} log - Call this function with a string to be presented to the user.
       * @param {NativePointer} retval - Return value represented as a NativePointer object.
       * @param {object} state - Object allowing you to keep state across function calls.
       */
      onLeave(log, retval, state) {
        
    	log('CCCrypt() dataOut: ', hexdump(this.args8));
        log('CCCrypt() dataOutLen: ', hexdump(this.args10));
      }
    }

CCCrypt
    CCCryptorStatus CCCrypt(
     CCOperation op, /* kCCEncrypt 0，kCCDecrypt 1 */
    CCAlgorithm alg, /* kCCAlgorithmAES128＝0,kCCAlgorithmAES=0,kCCAlgorithmDES,kCCAlgorithm3DES,kCCAlgorithmCAST,kCCAlgorithmRC4,kCCAlgorithmRC2, kCCAlgorithmBlowfish */
    CCOptions options, /* kCCOptionPKCS7Padding＝1、kCCOptionECBMode＝2 */
    constvoid*key, 秘钥 jdiwjcnd
    size_t keyLength, 秘钥长度，必须和选择的算法相匹配，不同的算法要求的秘钥长度不一样。可选值如下：
    kCCKeySizeAES128 = 16,
    kCCKeySizeAES192 = 24,
    kCCKeySizeAES256 = 32,
    kCCKeySizeDES = 8,
    kCCKeySize3DES = 24,
    kCCKeySizeMinCAST = 5,
    kCCKeySizeMaxCAST = 16,
    kCCKeySizeMinRC4 = 1,
    kCCKeySizeMaxRC4 = 512,
    kCCKeySizeMinRC2 = 1,
    kCCKeySizeMaxRC2 = 128,
    kCCKeySizeMinBlowfish = 8,
    kCCKeySizeMaxBlowfish
    constvoid*iv, /* optional initialization vector */ 加密使用的向量参数，CBC模式需要，16字节。ECB模式不需要。
    原 始解释：初始向量，可选类型，用于CBC模式。如果存在，则必须与所选算法的块大小相同。如果选择了CBC模式(由于选项标志中没有任何模式位)，并且没 有IV，将使用NULL(所有0)IV。如果使用ECB模式或选择了流密码算法，则忽略此操作。对于声音加密，总是使用随机数据初始化IV。
    iv的创建有三种方式：
    const Byte iv[] = {
        1,2,3,4,5,6,7,8};
    const Byte iv[] = {
        0,1,2,3,4,5,6,7};
     
    constvoid*dataIn, /* optional per op and alg */ 加解密的数据，const char *类型，使用字符串的UTF8String进行转换
    size_tdataInLength, 数据的长度，类型size_t
    void*dataOut, /* data RETURNED here */ 输出的数据，加密解密后的数据写在这里，
    size_t dataOutAvailable, 输出数据时需要的可用空间大小。数据缓冲区的大小（字节）
    size_t*dataOutMoved) 输出数据实际的大小。返回成功后，写入dataOut的字节数。如果由于提供的缓冲区空间不足而返回kCCBufferTooSmall，则在这里返回所需的缓冲区空间。

### 通过弹窗定位： ###

弹窗控件：

frida-trace -UF -m "*[UIAlertView *]"

修改js添加堆栈等操作打印

### 通过url ###

frida-trace -UF -m "+[NSURL URLWithString:]"

/*
     * Auto-generated by Frida. Please modify to match the signature of +[NSURL URLWithString:].
     * This stub is currently auto-generated from manpages when available.
     *
     * For full API reference, see: https://frida.re/docs/javascript-api/
     */
    
    {
        
      /**
       * Called synchronously when about to call +[NSURL URLWithString:].
       *
       * @this {object} - Object allowing you to store state for use in onLeave.
       * @param {function} log - Call this function with a string to be presented to the user.
       * @param {array} args - Function arguments represented as an array of NativePointer objects.
       * For example use args[0].readUtf8String() if the first argument is a pointer to a C string encoded as UTF-8.
       * It is also possible to modify arguments by assigning a NativePointer object to an element of this array.
       * @param {object} state - Object allowing you to keep state across function calls.
       * Only one JavaScript function will execute at a time, so do not worry about race-conditions.
       * However, do not use this to store function arguments across onEnter/onLeave, but instead
       * use "this" which is an object for keeping state local to an invocation.
       */
      onEnter(log, args, state) {
        
    	console.log('CCCryptorCreate called from:\n' +
            Thread.backtrace(this.context, Backtracer.ACCURATE)
            .map(DebugSymbol.fromAddress).join('\n') + '\n');
    	log(`+[NSURL URLWithString:]` + ObjC.Object(args[2]));
      },
    
      /**
       * Called synchronously when about to return from +[NSURL URLWithString:].
       *
       * See onEnter for details.
       *
       * @this {object} - Object allowing you to access state stored in onEnter.
       * @param {function} log - Call this function with a string to be presented to the user.
       * @param {NativePointer} retval - Return value represented as a NativePointer object.
       * @param {object} state - Object allowing you to keep state across function calls.
       */
      onLeave(log, retval, state) {
        
      }
    }

### frida demo: ###

[c001f82c6b0241aeb5ef03d61a2a8788.png]: https://img-blog.csdnimg.cn/c001f82c6b0241aeb5ef03d61a2a8788.png
[baa1623cabf441f0ae93ee863fe91959.png]: https://img-blog.csdnimg.cn/baa1623cabf441f0ae93ee863fe91959.png