• 周四. 3月 28th, 2024

5G编程聚合网

5G时代下一个聚合的编程学习网

热门标签

android逆向奇技淫巧十七:android客户端自动x红包(一):代码原理分析

admin

11月 28, 2021

  前面介绍了PC端hook关键函数得到xxxx客户端消息,也导出了sqlite数据库;事实上,xxxx官方的答复是xxxx不会存用户的消息,所有的消息就只能存客户端的sqlite数据库,红包消息也不例外;那么通过sqlite数据是不是可以判断当前的消息是不是红包了?com.tencent.wcdb.database.SQLiteDatabase下面有个insert方法,hook这个方法看看能不能得到红包消息,js代码如下:

function luckyMsgParse() {
    Java.perform(function () {
        var sqLite = Java.use('com.tencent.wcdb.database.SQLiteDatabase');
        var Set = Java.use("java.util.Set");
        var ContentValues = Java.use("android.content.ContentValues");
        sqLite.insert.implementation = function(arg1,arg2,arg3){
            var retval = this.insert(arg1,arg2,arg3);//先执行以前的方法,确保逻辑不会出错
            console.log("[insert]:"+arg1+"---"+arg2);//先打印前面两个string参数

            var values = Java.cast(arg3,ContentValues);
            var sets = Java.cast(values.keySet(),Set);

            var array = sets.toArray().toString().split(",");
            for(var i = 0;i<array.length;i++){
                console.log("[insert]: key="+array[i] +"-----value:"+values.get(array[i]));
            }

            if (arg3.getAsInteger('type') == 436207665 && arg3.getAsInteger('status') == 3){
                //setTimeout(luckyMoneyGet, 5000);
                //luckyMoneyGet();
            }

            return retval;
        }
    })
}

  得到如下消息:上述的insert方法果然也包括红包消息;

[KIW AL10::com.tencent.mm]-> [insert]:LuckyMoneyDetailOpenRecord---send_id
[insert]: key=send_id-----value:1000039801202107046167708300133
[insert]: key=open_count-----value:0
[insert]:message---msgId
[insert]: key=bizClientMsgId-----value:
[insert]: key=reserved-----value:~SEMI_XML~
[insert]: key=msgId-----value:57
[insert]: key=msgSvrId-----value:5838206542265258358
[insert]: key=talker-----value:wahaha
[insert]: key=content-----value:<msg>
        <appmsg appid="" sdkver="">
                <des><![CDATA[我给你发了一个红包,赶紧去拆!]]></des>
                <url><![CDATA[https://wxapp.tenpay.com/mmpayhb/wxhb_personalreceive?showwxpaytitle=1&msgtype=1&channelid=1&sendid=1000039801202107046167708300133&ver=6&sign=062075120c92e1
0baca28b1ea93763d3ff7b3e7522ccbef75bccdbd4e457e1027ae9a3b36830c43fac0ec1c2fa95d47b563a79d725fb768d124f1ae22d5bd1ffce83b72177b8697224bdd85cee87bed5]]></url>
                <type><![CDATA[2001]]></type>
                <title><![CDATA[微信红包]]></title>
                <thumburl><![CDATA[https://wx.gtimg.com/hongbao/1800/hb.png]]></thumburl>
                <wcpayinfo>
                        <templateid><![CDATA[7a2a165d31da7fce6dd77e05c300028a]]></templateid>
                        <url><![CDATA[https://wxapp.tenpay.com/mmpayhb/wxhb_personalreceive?showwxpaytitle=1&msgtype=1&channelid=1&sendid=1000039801202107046167708300133&ver=6&sign=062075
120c92e10baca28b1ea93763d3ff7b3e7522ccbef75bccdbd4e457e1027ae9a3b36830c43fac0ec1c2fa95d47b563a79d725fb768d124f1ae22d5bd1ffce83b72177b8697224bdd85cee87bed5]]></url>
                        <iconurl><![CDATA[https://wx.gtimg.com/hongbao/1800/hb.png]]></iconurl>
                        <receivertitle><![CDATA[恭喜发财,大吉大利]]></receivertitle>
                        <sendertitle><![CDATA[恭喜发财,大吉大利]]></sendertitle>
                        <scenetext><![CDATA[微信红包]]></scenetext>
                        <senderdes><![CDATA[查看红包]]></senderdes>
                        <receiverdes><![CDATA[领取红包]]></receiverdes>
                        <nativeurl><![CDATA[wxpay://c2cbizmessagehandler/hongbao/receivehongbao?msgtype=1&channelid=1&sendid=1000039801202107046167708300133&sendusername=wahaha&ver
=6&sign=062075120c92e10baca28b1ea93763d3ff7b3e7522ccbef75bccdbd4e457e1027ae9a3b36830c43fac0ec1c2fa95d47b563a79d725fb768d124f1ae22d5bd1ffce83b72177b8697224bdd85cee87bed5]]></nativeurl>
                        <sceneid><![CDATA[1002]]></sceneid>
                        <innertype><![CDATA[0]]></innertype>
                        <paymsgid><![CDATA[1000039801202107046167708300133]]></paymsgid>
                        <scenetext>微信红包</scenetext>
                        <locallogoicon><![CDATA[c2c_hongbao_icon_cn]]></locallogoicon>
                        <invalidtime><![CDATA[1625457178]]></invalidtime>
                        <broaden />
                </wcpayinfo>
        </appmsg>
        <fromusername><![CDATA[wahaha]]></fromusername>
</msg>

[insert]: key=flag-----value:0
[insert]: key=status-----value:3
[insert]: key=msgSeq-----value:736015725
[insert]: key=imgPath-----value:THUMBNAIL_DIRPATH://th_44a88a61f9d4fcd328322568fe1d597a
[insert]: key=createTime-----value:1625370778000
[insert]: key=lvbuffer-----value:[B@be30b5
[insert]: key=isSend-----value:0
[insert]: key=type-----value:436207665
[insert]: key=bizChatId-----value:-1
[insert]: key=talkerId-----value:35
[insert]:AppMessage---msgId
[insert]: key=appId-----value:
[insert]: key=source-----value:null
[insert]: key=description-----value:我给你发了一个红包,赶紧去拆!
[insert]: key=title-----value:微信红包
[insert]: key=xml-----value:null
[insert]: key=msgId-----value:57
[insert]: key=type-----value:2001
[KIW AL10::com.tencent.mm]->                                                                                                                                                              
[KIW AL10::com.tencent.mm]-> exit

  既然这里能探测到红包了,下一步直接调用onClick方法是不是就达到自动抢红包的目的了?刚开始我就是这样想的(后面才发现我想的太简单了)!; 

  这里通过adb shell dumpsys activity top| grep ACTIVITY命令找红包界面的top activity,发现有个类com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI很可疑:从名称上看是接受红包的UI界面(这里专门标注了NotHook,估计是专门防hook的,后面详细说这个!);这个类里面有10多个内部匿名类,每个类都有onClick方法,到底那个onClick才是红包“开”的那个onClick了?我也不知道,挨个去hook这些onClick太耗时了;仔细分析每个onClick,发现每个函数都调用了com.tencent.mm.hellhoundlib.a.a.a方法。这里暂时不分析该方法的功能;既然每个onClick都调用,说明很重要,那就用objection hook这个函数试试。点击红包的“开”后,结果如下:

com.tencent.mm on (HONOR: 6.0.1) [usb] # (agent) [672845] Called com.tencent.mm.hellhoundlib.a.a.a(java.lang.String, java.lang.String, java.lang.String, java.lang.String, java.lang.Object, [Ljava.lang.Object;)
(agent) [672845] Backtrace:
        com.tencent.mm.hellhoundlib.a.a.a(Native Method)
        com.tencent.mm.hellhoundlib.a.a(SourceFile:450)
        com.tencent.mm.hellhoundlib.a.a.b(SourceFile:527)
        com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15.onClick(SourceFile)
        android.view.View.performClick(View.java:5264)
        android.view.View$PerformClick.run(View.java:21297)
        android.os.Handler.handleCallback(Handler.java:743)
        android.os.Handler.dispatchMessage(Handler.java:95)
        android.os.Looper.loop(Looper.java:150)
        android.app.ActivityThread.main(ActivityThread.java:5621)
        java.lang.reflect.Method.invoke(Native Method)
        com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:794)
        com.android.internal.os.ZygoteInit.main(ZygoteInit.java:684)

(agent) [672845] Arguments com.tencent.mm.hellhoundlib.a.a.a(com/tencent/mm/plugin/luckymoney/ui/LuckyMoneyNotHookReceiveUI$9, android/view/View$OnClickListener, onClick, (Landroid/view/View;)V, com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15@629f4b0, android.widget.Button{88aff29 VFED..C.. ...P.... 256,892-526,1162 #7f091f3f app:id/f4f})
(agent) [672845] Return Value: (none)
(agent) [672845] Called com.tencent.mm.hellhoundlib.a.a.a(java.lang.Object, java.lang.String, java.lang.String, java.lang.String, java.lang.String)
(agent) [672845] Backtrace:
        com.tencent.mm.hellhoundlib.a.a.a(Native Method)
        com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15.onClick(SourceFile:908)
        android.view.View.performClick(View.java:5264)
        android.view.View$PerformClick.run(View.java:21297)
        android.os.Handler.handleCallback(Handler.java:743)
        android.os.Handler.dispatchMessage(Handler.java:95)
        android.os.Looper.loop(Looper.java:150)
        android.app.ActivityThread.main(ActivityThread.java:5621)
        java.lang.reflect.Method.invoke(Native Method)
        com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:794)
        com.android.internal.os.ZygoteInit.main(ZygoteInit.java:684)

(agent) [672845] Arguments com.tencent.mm.hellhoundlib.a.a.a(com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15@629f4b0, com/tencent/mm/plugin/luckymoney/ui/LuckyMoneyNotHookReceiveUI$9, android/view/View$OnClickListener, onClick, (Landroid/view/View;)V)
(agent) [672845] Called com.tencent.mm.hellhoundlib.a.a.a(java.lang.String, java.lang.String, java.lang.String, java.lang.String, java.lang.Object, java.lang.Object)
(agent) [672845] Backtrace:
        com.tencent.mm.hellhoundlib.a.a.a(Native Method)
        com.tencent.mm.hellhoundlib.a.a(SourceFile:464)
        com.tencent.mm.hellhoundlib.a.a.a(SourceFile:538)
        com.tencent.mm.hellhoundlib.a.a.a(Native Method)
        com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15.onClick(SourceFile:908)
        android.view.View.performClick(View.java:5264)
        android.view.View$PerformClick.run(View.java:21297)
        android.os.Handler.handleCallback(Handler.java:743)
        android.os.Handler.dispatchMessage(Handler.java:95)
        android.os.Looper.loop(Looper.java:150)
        android.app.ActivityThread.main(ActivityThread.java:5621)
        java.lang.reflect.Method.invoke(Native Method)
        com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:794)
        com.android.internal.os.ZygoteInit.main(ZygoteInit.java:684)

  从日志很容易发现:LuckyMoneyNotHookReceiveUI$15.onClick反复被调用好几次,有重大作案嫌疑!那就直接调用这个方法呗!代码如下:

    Java.perform(function () {
        Java.choose("com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15", {
            onMatch: function (instance) {
                console.log("com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15.onClick before invoke onclick2!");
                var view = Java.use('android.view.View').$new();
                instance.onClick(view);
                console.log("com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15.onClick after invoke onclick2!");
            },
            onComplete: function () {
                console.log("com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15.onClick cpmplete invoke onclick2!");//这里打印了,说明没匹配上,和下面的类找不到是一样的
            }
        });
    })

  结果傻眼了:com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15.onClick cpmplete invoke onclick2!  这个打印了出来!说明$15这个匿名类根本就没找到!好吧,可能是方法没用对,换个姿势继续尝试,这次这样写hook代码:通过classloader来遍历LuckyMoneyNotHookReceiveUI$15这个类,如下:

Java.perform(function () {
        Java.enumerateClassLoadersSync().forEach(function (classloader) {
            try {
                var receive = classloader.findClass("com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15");
                var view = Java.use('android.view.View').$new();
                console.log("com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15.onClick before invoke onclick3!");
                receive.onClick(view);
                console.log("com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15.onClick after invoke onclick!3");
            } catch (e) {
                console.log("com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15.onClick exception:"+e);//类找不到
            }
        })
    })

  结果更是傻眼,直接打印了如下的日志:这次更直接,爆出找不到类的错误!想了半天,原因可能是:我是从sqlite数据库的insert函数开始hook的,而objection hook的时候是手动点击红包的结果,所以sqlite中insert消息时这个类可能确实还没加载到内存,所以classloader都找不到即使用了setTimeout(luckyMoneyGet, 15000)让点击红包的函数延迟加载还是报找不到类的错误;   这么来看直接简单粗暴的点击onClick方法大概率是行不通的!这个类名里面的NotHook名称看还真不是白取的┭┮﹏┭┮!

com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15.onClick before invoke onclick3!
com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15.onClick exception:TypeError: not a function
com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15.onClick exception:Error: java.lang.ClassNotFoundException: com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15
com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15.onClick exception:Error: java.lang.ClassNotFoundException: Didn't find class "com.tencent.mm.plugin.luckymoney.ui.LuckyMoneyNotHookReceiveUI$15" on path: DexPathList[[zip file "/system/app/webview/webview.apk"],nativeLibraryDirectories=[/system/app/webview/lib/x86, /system/app/webview/webview.apk!/lib/x86,
/system/lib, /vendor/lib, /system/lib, /vendor/lib]]

  没办法,只能老老实实继续逆向onClick方法,而不是偷懒式地简单粗暴调用!下面这是LuckyMoneyNotHookReceiveUI$15.onClick的代码:

public final void onClick(View view) {
                                AppMethodBeat.i(65741);
                                b bVar = new b();
                                bVar.bm(view);
                                com.tencent.mm.hellhoundlib.a.a.b("com/tencent/mm/plugin/luckymoney/ui/LuckyMoneyNotHookReceiveUI$9", "android/view/View$OnClickListener", "onClick", "(Landroid/view/View;)V", this, bVar.axR());
                                g.af(com.tencent.mm.pluginsdk.wallet.b.class).he(10, 3);
                                com.tencent.mm.plugin.report.service.h.CyF.a(11701, new Object[]{5, Integer.valueOf(LuckyMoneyNotHookReceiveUI.awY(LuckyMoneyNotHookReceiveUI.this.yXY.egY)), Integer.valueOf(LuckyMoneyNotHookReceiveUI.m5701m(LuckyMoneyNotHookReceiveUI.this)), 0, 2});
                                Log.i("MicroMsg.LuckyMoneyNotHookReceiveUI", "open btn click!");
                                LuckyMoneyNotHookReceiveUI.this.yRl.setClickable(false);
                                m.vli.a(s.bh.UTO, s.bg.UTG, true);
                                LuckyMoneyNotHookReceiveUI.this.aDF("");
                                com.tencent.mm.hellhoundlib.a.a.a(this, "com/tencent/mm/plugin/luckymoney/ui/LuckyMoneyNotHookReceiveUI$9", "android/view/View$OnClickListener", "onClick", "(Landroid/view/View;)V");
                                AppMethodBeat.o(65741);
                            }

  进入LuckyMoneyNotHookReceiveUI.this.aDF()方法后,发现有3个方法都在为同一个变量赋值:

if (C43670af.m67519rQ(this.zbZ)) {
            ayVar = new C43694az(this.yXY.msgType, this.yXY.channelId, this.yXY.yQE, this.yXY.egX, C43670af.efj(), C13715z.aUa(), stringExtra, "v1.0", this.yXY.yXR);
        } else if (this.gwE == 3) {
            ayVar = new C43660b(this.yXY.msgType, this.yXY.channelId, this.yXY.yQE, this.yXY.egX, C43670af.efj(), C13715z.aUa(), stringExtra, "v1.0", this.yXY.yXR, str2, getIntent().getStringExtra("key_live_id"), getIntent().getStringExtra("key_live_attach"), this.UXQ);
        } else {
            ayVar = new C43693ay(this.yXY.msgType, this.yXY.channelId, this.yXY.yQE, this.yXY.egX, C43670af.efj(), C13715z.aUa(), stringExtra, "v1.0", this.yXY.yXR, str2);
        }

  分别进入这3个方法哈看,发现实现都大同小异,举例如下:分别用各种字段填充hashmap结构体,其中包括很重要的timingIdentifier字段(也就是this.yYY.yXR参数),这里疑似要发请求包了;下面还有Log日志打印,内容是“NetSceneOpenLuckyMoney”,看着像是打开红包的;不得不说:xxxx研发同学的心是真大,居然打印这么明显的日志!

public C43660b(int i, int i2, String str, String str2, String str3, String str4, String str5, String str6, String str7, String str8, String str9, String str10, int i3) {
        AppMethodBeat.m16755i(258596);
        this.yQE = str;
        this.egX = str2;
        this.talker = str5;
        HashMap hashMap = new HashMap();
        hashMap.put("msgType", String.valueOf(i));
        hashMap.put("channelId", String.valueOf(i2));
        hashMap.put("sendId", str);
        if (!Util.isNullOrNil(str2)) {
            hashMap.put("nativeUrl", URLEncoder.encode(str2));
        }
        if (!Util.isNullOrNil(str3)) {
            hashMap.put("headImg", URLEncoder.encode(str3));
            hashMap.put("nickName", URLEncoder.encode(Util.nullAsNil(str4)));
        }
        hashMap.put("ver", str6);
        hashMap.put("timingIdentifier", str7);
        hashMap.put("left_button_continue", str8);
        hashMap.put("liveid", str9);
        hashMap.put("liveattach", str10);
        if (i3 > 0) {
            hashMap.put("channellive_sender_flag", String.valueOf(i3));
        }
        Log.m102527i("MicroMsg.NetSceneLiveOpenLuckyMoney", "NetSceneOpenLuckyMoney request");
        setRequestData(hashMap);
        AppMethodBeat.m16756o(258596);
    }

   回到onCreate方法,有个很大的分支如下: 最后面的if执行判断条件:nativeurl(红包内置的一个url)、红包金额小于0、红包时间超过1天了就执行另一个分支;正常情况下这个分支是可以忽略的,我们直接看另一个分支!

      this.yUq = getIntent().getStringExtra("key_native_url");
        this.zge = getIntent().getStringExtra("key_cropname");
        this.gof = getIntent().getLongExtra("key_msgid", 0);
        this.qBv = getIntent().getIntExtra("key_material_flag", 0);
        this.zbZ = getIntent().getIntExtra("scene_id", 1002);
        this.mRa = getIntent().getStringExtra("key_username");
        this.gwE = getIntent().getIntExtra("key_from", 0);
        this.UXO = getIntent().getStringExtra("key_live_id");
        this.UXP = getIntent().getStringExtra("key_live_attach");
        this.UYr = (ResultReceiver) getIntent().getParcelableExtra("key_open_result_receiver");
        this.UXQ = getIntent().getIntExtra("key_live_anchor_type", 0);
        Log.m102527i("MicroMsg.LuckyMoneyNotHookReceiveUI", "nativeUrl= " + Util.nullAsNil(this.yUq));
        initView();
        Uri parse = Uri.parse(Util.nullAsNil(this.yUq));
        try {
            this.yUc = parse.getQueryParameter("sendid");
        } catch (Exception e) {
        }
        this.yUs = C59398t.fQE().aVA(this.yUq);
        if (this.yUs == null || this.yUs.field_receiveAmount <= 0 || Util.milliSecondsToNow(this.yUs.field_receiveTime) >= Util.MILLSECONDS_OF_DAY){

    }

  另一个分支的完整代码:根据接受到的红包消息对intent做各种字段的填充,然后调用startActivity生成开红包的界面!

        Log.m102528i("MicroMsg.LuckyMoneyNotHookReceiveUI", "use cache this item %s %s", Long.valueOf(this.yUs.field_receiveTime), Util.nullAsNil(this.yUq));
        Intent intent = new Intent();
        intent.setClass(getContext(), LuckyMoneyBeforeDetailUI.class);
        intent.putExtra("key_native_url", this.yUs.field_mNativeUrl);
        intent.putExtra("key_sendid", this.yUc);
        intent.putExtra("key_anim_slide", true);
        intent.putExtra("key_lucky_money_can_received", true);
        intent.putExtra("key_username", getIntent().getStringExtra("key_username"));
        intent.putExtra("scene_id", this.zbZ);
        intent.putExtra("key_msgid", this.gof);
        m68103aH(intent);
        C11767a bl = new C11767a().mo32323bl(intent);
        C11762a.m25042a(this, bl.axQ(), "com/tencent/mm/plugin/luckymoney/ui/LuckyMoneyNotHookReceiveUI", "onCreate", "(Landroid/os/Bundle;)V", "Undefined", "startActivity", "(Landroid/content/Intent;)V");
        startActivity((Intent) bl.mo32324pG(0));
        C11762a.m25041a(this, "com/tencent/mm/plugin/luckymoney/ui/LuckyMoneyNotHookReceiveUI", "onCreate", "(Landroid/os/Bundle;)V", "Undefined", "startActivity", "(Landroid/content/Intent;)V");
        finish();
        AppMethodBeat.m16756o(65743);

   所以这里总结的思路:要想自动抢红包,在hook了sqlite数据库的insert方法后,如果是红包消息,会先构造intent,然后startActivity,生成开红包的界面!用户一旦点击“开”,立即调用onClick方法:这里又开始构造hashMap,收集各种红包的请求参数,然后发给服务器请求开红包;这里最难的就是构造红包的请求包了:LuckyMoneyNotHookReceiveUI.this.aDF()中3个if分支构造请求包,最特殊的字段就是timingIdentifier了!这个字段的值是怎得来的了?继续追踪其调用关系:

  

   上述几个引用挨个查看后,发现只有第一个onGYNetEnd函数在读取timingIdentifier的值,整个代码如下:

public void onGYNetEnd(int p0,String p1,JSONObject p2){    
       JSONObject jObject;
       long vl = 0;
       AppMethodBeat.i(65310);
       Object[] objectArray = new Object[3];
       objectArray[0] = Integer.valueOf(p0);
       objectArray[1] = p1;
       objectArray[2] = p2.toString();
       Log.i("MicroMsg.NetSceneReceiveLuckyMoney", "errCode: %s, errMsg: %s ,json:%s", objectArray);
       this.yXN = p2.optString("sendNick");
       this.yVe = p2.optString("sendHeadImg");
       this.egZ = p2.optInt("hbStatus");
       this.eha = p2.optInt("receiveStatus");
       this.yVb = p2.optString("statusMess");
       this.yPK = p2.optString("wishing");
       this.yVm = p2.optInt("isSender");
       this.yXO = p2.optLong("sceneAmount");
       this.yXP = p2.optLong("sceneRecTimeStamp");
       this.egY = p2.optInt("hbType");
       this.yVt = p2.optString("watermark");
       this.yRQ = p2.optString("externMess");
       this.yVy = p2.optString("sendUserName");
       if (Util.isNullOrNil(this.yXN)) {    
          this.UXB = true;
       }    
       if (!Util.isNullOrNil(this.yVy) && Util.isNullOrNil(this.yXN)) {    
          this.yXN = g.af(b.class).getDisplayName(this.yVy);
       }    
       bg bba = ac.ba(p2.optJSONObject("operationTail"));
       this.yVs = bba;
       this.yXr = p2.optInt("scenePicSwitch");
       if ((jObject = p2.optJSONObject("agree_duty")) != null) {    
          this.yWY = jObject.optString("agreed_flag", "-1");
          this.yWZ = jObject.optString("title", "");
          this.yXa = jObject.optString("service_protocol_wording", "");
          this.yXb = jObject.optString("service_protocol_url", "");
          this.yXc = jObject.optString("button_wording", "");
          this.yXd = jObject.optLong("delay_expired_time", vl);
       }    
       if (this.yXd-vl > 0) {    
          g.aAi();
          g.aAh().azQ().set(ar$a.NXr, Long.valueOf((System.currentTimeMillis()+(this.yXd*1000))));
       }    
       Log.i("MicroMsg.NetSceneReceiveLuckyMoney", "scenePicSwitch:".append(this.yXr).toString());
       this.yXQ = p2.optInt("preStrainFlag", 1);
       Log.i("MicroMsg.NetSceneReceiveLuckyMoney", "preStrainFlag:".append(this.yXQ).toString());
       this.yXD = p2.optInt("showYearExpression");
       objectArray = new Object[1];
       objectArray[0] = Integer.valueOf(this.yXD);
       Log.i("MicroMsg.NetSceneReceiveLuckyMoney", "showYearExpression:%s", objectArray);
       this.yUt = p2.optInt("showRecNormalExpression");
       objectArray = new Object[1];
       objectArray[0] = Integer.valueOf(this.yUt);
       Log.i("MicroMsg.NetSceneReceiveLuckyMoney", "showRecNormalExpression:%s", objectArray);
       g.aAi();
       g.aAh().azQ().set(ar$a.NXg, Integer.valueOf(this.yXQ));
       this.yXR = p2.optString("timingIdentifier");
       this.ivQ = p2.optString("effectResource");
       this.yXh = p2.optString("expression_md5");
       this.yXi = p2.optInt("expression_type");
       this.UXx = p2.optInt("not_show_avatar", 0);
       objectArray = new Object[2];
       objectArray[0] = this.yXh;
       objectArray[1] = Integer.valueOf(this.yXi);
       Log.i("MicroMsg.NetSceneReceiveLuckyMoney", "expressionmd5:%s expressiontype:%s", objectArray);
       this.yXS = bi.bc(p2.optJSONObject("showSourceRec"));
       this.efk();
       AppMethodBeat.o(65310);
       return;
    }

  从代码看,所有的关键字段都保存在JSONObject p2里面了!hook看看函数的调用栈,查查究竟是哪个函数给onGYNetEnd传的JSONObject参数,探索timingIdentifier字段的起源!用objection hook后,结果如下:里面确实包含了timingIdentifier字段;经过多个红包hook后的文本比对,发现第三个JSONObject参数只有sendId和timingIdentifier不同,其他都一样!这么来看,后续我们做自动抢红包脱机协议时需要考虑动态获取这两个字段了,其他字段都可以直接写死

com.tencent.mm on (HONOR: 6.0.1) [usb] # (agent) [927971] Called com.tencent.mm.plugin.luckymoney.model.bd.onGYNetEnd(int, java.lang.String, org.json.JSONObject)
(agent) [927971] Backtrace:
        com.tencent.mm.plugin.luckymoney.model.bd.onGYNetEnd(Native Method)
        com.tencent.mm.plugin.luckymoney.model.ah.onGYNetEnd(SourceFile:170)
        com.tencent.mm.wallet_core.c.w.onGYNetEnd(SourceFile:37)
        com.tencent.mm.ak.w$2.run(SourceFile:124)
        android.os.Handler.handleCallback(Handler.java:743)
        android.os.Handler.dispatchMessage(Handler.java:95)
        com.tencent.mm.sdk.platformtools.MMHandler$2.dispatchMessage(SourceFile:350)
        android.os.Looper.loop(Looper.java:150)
        android.os.HandlerThread.run(HandlerThread.java:61)

(agent) [927971] Arguments com.tencent.mm.plugin.luckymoney.model.bd.onGYNetEnd((none), ok, {"retcode":0,"retmsg":"ok","sendId":"1000039901202107106318211465184","wishing":"恭喜发 财,大吉大利","isSender":0,"receiveStatus":0,"hbStatus":2,"statusMess":"给你发了一个红包","hbType":0,"watermark":"","scenePicSwitch":1,"preStrainFlag":1,"agree_duty":{"title":"","service_protocol_wording":"","service_protocol_url":"","button_wording":"","delay_expired_time":0,"agreed_flag":1},"sendUserName":"wahaha","timingIdentifier":"958F45D1560813371631E5DB53AE520B","showYearExpression":1,"expression_md5":"","showRecNormalExpression":1})

  由于这里的timingIdentifier也是参数传递进来的,并不是自己生成的,所以继续追溯上一层:com.tencent.mm.plugin.luckymoney.model.ah.onGYNetEnd,发现也是第5个参数传进来的!

    

    继续追溯 com.tencent.mm.wallet_core.c.w.onGYNetEnd,发现关键参数也是传进来的!

      

    继续往上追溯:发现包含timingIdentifier是构造对象传进来的! w.f方法返回的是com.tencent.mm.network.s对象

        

  发现这里有引用:

   

  进入该方法,里面有个post方法,疑似发送请求:

   

   post请求,hook看看都传了啥参数:结果很失望,除了p4外其他参数都是null;也就是说new w$2的参数只有第一个this有值,其他的都是null!  从这里调用栈任然能看到com.tencent.mm.ak.w$2,说明这是最关键的类了;

com.tencent.mm on (HONOR: 6.0.1) [usb] # (agent) [459220] Called com.tencent.mm.ak.w.a(int, int, int, java.lang.String, com.tencent.mm.network.t, [B)
(agent) [459220] Backtrace:
        com.tencent.mm.ak.w.a(Native Method)
        com.tencent.mm.network.n$a.onTransact(SourceFile:71)
        android.os.Binder.execTransact(Binder.java:453)

(agent) [459220] Arguments com.tencent.mm.ak.w.a((none), (none), (none), (none), com.tencent.mm.ak.y@9d70429, (none))
(agent) [459220] Return Value: (none)
(agent) [459220] Called com.tencent.mm.ak.w.a(com.tencent.mm.ak.w)
(agent) [459220] Backtrace:
        com.tencent.mm.ak.w.a(Native Method)
        com.tencent.mm.ak.w$2.run(SourceFile:96)
        android.os.Handler.handleCallback(Handler.java:743)
        android.os.Handler.dispatchMessage(Handler.java:95)
        com.tencent.mm.sdk.platformtools.MMHandler$2.dispatchMessage(SourceFile:350)
        android.os.Looper.loop(Looper.java:150)
        android.os.HandlerThread.run(HandlerThread.java:61)

(agent) [459220] Arguments com.tencent.mm.ak.w.a(com.tencent.mm.ak.w@48773ae)
(agent) [459220] Return Value: (none)

  回到com.tencent.mm.ak.w$2的run方法,这里面调用的onGYNetEnd的第5个参数是w.f(this.iMS)的返回值,也就是com.tencent.mm.network.s对象,如下:从成员函数看,getReqObj和getRespObj最可疑!这两个函数会不会是发送验证新信、得到服务器返回的timingIdentifier的函数了?

package com.tencent.mm.network.s;
import java.lang.Object;
import com.tencent.mm.protocal.l$d;
import com.tencent.mm.protocal.l$e;
import java.lang.String;

public interface s extends Object    // class@00119a
{

    public boolean getIsLongPolling();
    public boolean getIsUserCmd();
    public int getLongPollingTimeout();
    public int getNewExtFlags();
    public int getOptions();
    public l$d getReqObj();
    public l$e getRespObj();
    public int getTimeOut();
    public byte[] getTransHeader();
    public int getType();
    public String getUri();
    public boolean isSingleSession();
    public boolean keepAlive();
    public void setConnectionInfo(String p0);
}

  我们先看看getReqObj函数的返回值是l$d对象,进入看看: 果然有大量属性的字段;从rsa、ecdh、sessionkey、verify、ClientVersion等关键字眼看,貌似已经深入到mmtls协议了

public class l$d extends Object    // class@002e16
{
    private boolean bShortSupport;
    private long bufferSize;
    private b$a cgiVerifyKeys;
    private long ecdhEngine;
    private int iClientVersion;
    private int iSceneStatus;
    private int iUin;
    private l$a mReqPackControl;
    private byte[] passKey;
    private int routeInfo;
    private ac rsaInfo;
    private String sDeviceID;
    private String sDeviceType;
    private byte[] sessionKey;
    private boolean useAxSession;
    private boolean useECDH;
    private static final String TAG;

    public void l$d(){    
       Object();
       AppMethodBeat.i(133097);
       this.bShortSupport = true;
       this.useECDH = false;
       this.useAxSession = false;
       this.bufferSize = 0;
       this.iUin = 0;
       this.iClientVersion = 0;
       byte[] obyteArray = new byte[0];
       this.sessionKey = obyteArray;
       this.sDeviceType = "";
       this.sDeviceID = "";
       this.iSceneStatus = 0;
       this.rsaInfo = new ac("", "", 0);
       this.routeInfo = 0;
       this.ecdhEngine = 0;
       AppMethodBeat.o(133097);
    }

  其中有个成员变量:private l$a mReqPackControl; 目测包括了很多请求包的信息,进入l$a后发现是个接口类,找到接口的实现:从打印的日志看,已经是mmtls加解密相关了,这里暂时不深入!

final class q$a$1 extends Object implements l$a    // class@004240
{
    final l$d KzR;
    final q$a KzS;

    void q$a$1(q$a p0,l$d p1){    
       this.KzS = p0;
       this.KzR = p1;
       Object();
    }
    public final boolean a(PByteArray p0,int p1,byte[] p2,byte[] p3,int p4){    
       byte[][] ba;
       Object[] objectArray;
       Object[] objectArray1;
       byte[] bBuf;
       Object[] objectArray2;
       AppMethodBeat.i(152467);
       int vi = this.KzR;
       long vl = (long)this.KzR.getUin();
       long vl1 = (CrashReportFactory.hasDebuger() && !vl)? d.KyN: vl;    
       ac aRsaInfo = this.KzR.getRsaInfo();
       if (p1 == 722) {    
          Log.e("MicroMsg.MMEncryptCheckResUpdate", "MMEncryptCheckResUpdate reqToBuf rsaReqData");
          ajl kzQ = this.KzR.KzQ;
          if ((ba = x.a(vl1, kzQ.LsW, kzQ.LsX)) == null) {    
             AppMethodBeat.o(152467);
          }else if(MMProtocalJni.packHybrid(p0, p2, this.KzR.getDeviceID(), (int)vl1, vi.getFuncId(), aRsaInfo.ver, ba[0], ba[1], aRsaInfo.KAw.getBytes(), aRsaInfo.KAx.getBytes(), this.KzR.getPassKey(), p4, this.KzR.getRouteInfo())){        
             objectArray = new Object[2];
             objectArray[0] = Integer.valueOf(p0.value.length);
             objectArray[1] = Integer.valueOf(p4);
             Log.d("MicroMsg.MMEncryptCheckResUpdate", "IRemoteReqDelegate reqToBuf packHybrid using protobuf ok, len:%d, flag:%d", objectArray);
             AppMethodBeat.o(152467);
          }else {    
          label_0168 :
             AppMethodBeat.o(152467);
          }    

   回到LuckyMoneyNotHookReceiveUI.this.aDF()这个函数:里面有3个分支都用到了timingIdentifier(也就是下面红框框的字段)。以上那个分支流程并未找到这个字段的生成代码,这里只能换个思路继续尝试!

 

   要想找到yXY.yXR的值,就要找到这个变量在哪赋值的!层层深入,发现yXR是com.tencent.mm.plugin.luckymoney.model.bd的成员变量,发现并没有初始化这个成员变量的地方,而是直接调用到了 onGYNetEnd(int p0,String p1,JSONObject p2)函数来初始化this.yXY.yXR变量,这个函数上面已经分析过了!重新回到 com.tencent.mm.plugin.luckymoney.model.ah.onGYNetEnd,JSONObject最终是又sVar参数生成的,而这个参数是com.tencent.mm.network.s类,本身是个interface(前面也分析过了),并没有成员变量,自然也找不到在哪初始化的!

    

   不得不说jadx的人性化:检测到了com.tencent.mm.network.s是接口,所有这里把对象强制转换了一下,也就是说实际使用的对象是c1182d类(注意jadx这里改了一下类名),这个类的成员变量是iLL,继续再往下找到iLR是com.tencent.mm.bw.a类的对象,这个对象又被强制转成了com.tencent.mm.protocal.protobuf.cbz类,里面的MhT变量是SKBuiltinBuffer_t类,这里明显是在发送前做最后的序列化工作;

  从上面的代码看,最关键的对象就是iLR了;这个对象的生成如下:

/* renamed from: com.tencent.mm.ak.d$b */
    public static final class C1184b extends C8091l.C8095d implements C8091l.C8093b {
        public int cmdId;
        private int funcId;
        public C1436a iLR;
        private boolean needHeader;

        public C1184b(C1436a aVar, int i, int i2, boolean z, int i3) {
            AppMethodBeat.m2882i(132302);
            this.iLR = aVar;
            this.funcId = i;
            this.cmdId = i2;
            this.needHeader = z;
            setRouteInfo(i3);
            AppMethodBeat.m2883o(132302);
        }
/* renamed from: com.tencent.mm.ak.d$c */
    public static final class C1185c extends C8091l.C8096e implements C8091l.C8094c {
        public int cmdId;
        public C1436a iLR = null;
        private boolean needHeader;

        public C1185c(C1436a aVar, int i, boolean z) {
            this.iLR = aVar;
            this.cmdId = i;
            this.needHeader = z;
        }

        @Override // com.tencent.mm.protocal.C8091l.C8094c
        public final int fromProtoBuf(byte[] bArr) {
            AppMethodBeat.m2882i(132304);
            this.iLR = this.iLR.parseFrom(bArr);
            if (!(this.iLR instanceof dyp)) {
                C8091l.m10518a(this, ((dpc) this.iLR).getBaseResponse());
                int i = ((dpc) this.iLR).getBaseResponse().Ret;
                AppMethodBeat.m2883o(132304);
                return i;
            }
            int ret = ((dyp) this.iLR).getRet();
            AppMethodBeat.m2883o(132304);
            return ret;
        }

  这两个构造函数分别被同com.tencent.mm.ak.d类的d函数调用:

public final class d extends o    // class@000b26
{
    private int funcId;
    public d$b iLK;
    public d$c iLL;
    private boolean iLM;
    private boolean longPolling;
    private int longPollingTimeout;
    private int newExtFlag;
    public int option;
    private int timeout;
    byte[] transferHeader;
    private String uri;

    private void d(a p0,a p1,String p2,int p3,int p4,int p5,boolean p6,int p7,int p8,boolean p9,int p10,boolean p11){    
       super();
       AppMethodBeat.i(197060);
       this.iLK = null;
       this.iLL = null;
       this.option = 0;
       boolean vb = (p6 && p0 instanceof dop)? true: false;    
       this.iLK = new d$b(p0, p3, p4, vb, p8);
       this.iLL = new d$c(p1, p5, p6);
       this.uri = p2;
       this.funcId = p3;
       this.timeout = p7;
       this.longPolling = p9;
       this.longPollingTimeout = p10;
       this.newExtFlag = 0;
       this.transferHeader = null;
       this.iLM = p11;
       AppMethodBeat.o(197060);
       return;
    }
    void d(a p0,a p1,String p2,int p3,int p4,int p5,boolean p6,int p7,int p8,boolean p9,int p10,boolean p11,byte p12){    
       super(p0, p1, p2, p3, p4, p5, p6, p7, p8, p9, p10, p11);
    }

  这个构造函数调用的时候p1(是com.tencent.mm.bw.a类的对象)有没有传入timingIdentifier关键信息了? 我们后续hook看看!

  

   

说明:

1、xxxx android 客户端版本:8.0.1

2、尝试用method profiling跟踪函数执行,试了好几次都失败:DDMS每次都卡死,直观感觉是xxxx用了大量的AppMethodBeat插桩导致的;

3、https://blog.mythsman.com/post/60911a810527a03be7e558f6/  Frida爬虫分析流程——以xxxx视频号下载为例

发表回复

您的电子邮箱地址不会被公开。 必填项已用*标注