关于某ios app登录关键字加密分析

关于某ios app登录关键字加密分析

一点感想：

学逆向到现在，本来以为可以找个大神带一下，不过一路做来基本是在自学。还有好多东西不知到如何下手，世界上本来就是学无止境，找到自己需要的我觉得更关键。学了两周的ios逆向，顺便总结下：

需要工具：

越狱iPhone

cydia

*openssh和socat

IDA或者HOPPER dis

个人感觉这两个工具虽然目的一样，但用起来还是差别还是很大。HP动不动就卡的半死，IDA虽然是业界大佬，速度也比较快，不过伪代码的重建还是优化不如后者。HP的最大有事就是简洁，用过IDA的基本打开就能用，界面上太友好了（关键是把常用的功能放在了最显眼的地方，要不是突然就会卡死，我还真是不想用IDA了）

frida

charels

lldb,debugger这两个在过程中没咋用，也没啥效果最后，不过也有些心得。

初入ios逆向

感觉不管是ios逆向，windows逆向，还是android逆向，其实基本的分析思路还是一样的。最大的差别是工具的使用方式比较大。window od ida windbg; 动态调试极其方便，还少有人用挂钩调试。android deb IDA smali,.so文件，android studio。动静态调试也是比较方便的，当然挂钩也是可以在很大程度上减轻工作量的。ios逆向就基本在用挂钩，动态调试就变成了辅助。可能是这个命令行实在是用不惯。

唯一的共同点就是静态调试的地位在三者中地位差不多。

charels抓包

这种在数据包中的分析当然还是老套路，抓包。

n6第一次

appid yidian

cv 4.5.3.11

distribution com.apple.appstore

idfa 8d3b3828bdc029855abafa0b6d0b20ea

net wifi

password c035b72a0ceb25e42962c8452b81fd90c8a073b1

platform 0

reqid 1511164920272_10

secret 500a9c8432161edb6502cc9962be9f7ef77d84e5

username HG_65B678294F40

version 020130

n6第二次

appid yidian

cv 4.5.3.11

distribution com.apple.appstore

idfa 8d3b3828bdc029855abafa0b6d0b20ea

net wifi

password 2c3e94aa43f37c8134df8f7e2a6460fdc8fd9684

platform 0

reqid 1511165339686_10

secret ad86d687fc19a8d83bc5229fbcb529dfbeee2ece

username HG_227900D833DE

这里我省略了header 的具体数据，没啥大用，直接照办就行。我们从上面的分析，和最后的验证过程会发现。这个过程中，最关键的两个加密点就是password和secret关键字。当然username也发生了变化，这个是随机的我们不管了。

静态分析

我们启用HP和IDA,分析过程有好几分钟，等下吧。

void * -[RRNetWorkingHelper configureSignNatureWithClientType:clientVersion:clientSecret:](void * self, void * _cmd, void * arg2, void * arg3, void * ret_addr) {

(id)buildLoginAsGuestAllInOneRequestWithUserName:(id)arg1 password:(id)arg2 distributionChannel

unsigned int -[HpEngine loginAsGuestAllInOneWithUserName:distributionChannel:](void * self, void * _cmd, void * arg2, void * arg3)

通过关键字找到了三个函数，接着我对这三个函数的条用毁掉过程进行了漫长的分析，好像有一天。

最后发现其实根本没必要。这里为了还原过程还是说一下把：

void -[UIV2SplashViewController tryToRegisterGuest](void * self, void * _cmd) {
r7 = (sp - 0x14) + 0xc;
sp = sp - 0x24;
r5 = self;
r6 = 0x10f3a48;
r10 = @selector(sharedInstance);
r11 = [objc_msgSend(*r6, r10, r2, r3, stack[2039], stack[2040], stack[2041], stack[2042]) retain];
r7 = r7;
r4 = [[r11 user] retain];
stack[2039] = r5;
if (r4 != 0x0) {
r5 = [objc_msgSend(*r6, r10) retain];
r7 = r7;
r8 = 0x0;
if ([[[r5 userChannels] retain] count] == 0x0) {
CMP(stack[2039]->_loginRequestId, 0x0);
r8 = 0x1;
}
[0x10f3a48 release];
[r5 release];
r6 = 0x10f3a48;
}
else {
CMP(r5->_loginRequestId, 0x0);
r8 = 0x1;
}
[r4 release];
[r11 release];
if (r8 == 0x1) {
r11 = [[HpUser guestUser] retain];
r5 = [objc_msgSend(*r6, r10) retain];
r6 = [[NSUserDefaults standardUserDefaults] retain];
r4 = [[r6 valueForKey:@"kHpDistributionChannel"] retain];
stack[2039]->_loginRequestId = [r5 loginAsGuestAllInOneWithUserName:r11 distributionChannel:r4];
[r4 release];
[r6 release];
[r5 release];
loc_d0a5e4();
}
return;
}
unsigned int -[HpEngine loginAsGuestAllInOneWithUserName:distributionChannel:](void * self, void * _cmd, void * arg2, void * arg3) {
r7 = (sp - 0x14) + 0xc;
sp = sp - 0x40;
r8 = self;
r5 = [arg2 retain];
r11 = [arg3 retain];
r10 = [[r5 userName] retain];
r6 = [[r5 password] retain];
r4 = [r8 buildLoginAsGuestAllInOneRequestWithUserName:r10 password:r6 distributionChannel:r11];
[r11 release];
r4 = [r4 retain];
[r6 release];
[r10 release];
asm{ stm        r3, {r0, r1, r2, r5} };
r5 = [r5 retain];
r6 = [r8 retain];
stack[2039] = r6;
[r4 setCompletion:sp + 0x4];
r6 = [r6 executeRequest:r4];
[stack[2039] release];
[stack[2038] release];
[r5 release];
[r4 release];
r0 = r6;
return r0;
}

tryToRegisterGuest 到最后这里 r11 = [[HpUser guestUser] retain];

有一个初始化客户登录的过程我们跟进去。

void * +[HpUser guestUser](void * self, void * _cmd) {
stack[2043] = r4;
*((sp - 0x14) + 0xfffffffffffffffc) = r8;
r5 = [[NSString uuidString] retain];
r6 = [[r5 componentsSeparatedByString:@"-"] retain];
r8 = [[r6 lastObject] retain];
[r6 release];
[r5 release];
r5 = [[@"HG_" stringByAppendingString:r8] retain];
r6 = [[@"3958dde99ed6ed817adfee423ebeb4fa613196db" encryptedPasswordForUser:r5] retain];
r4 = [[HpUser alloc] initWithGuestUserName:r5 password:r6];
[r6 release];
[r5 release];
[r8 release];
r0 = loc_d0a5f0(r4, @selector(initWithGuestUserName:password:));
return r0;
}
void * -[NSString encryptedPasswordForUser:](void * self, void * _cmd, void * arg2) {
stack[2043] = r4;
*((sp - 0x14) + 0xfffffffffffffffc) = r8;
r5 = [[arg2 lowercaseString] retain];//,HG_D55370101219
r6 = [[self MD5] retain];
r7 = (sp - 0x14) + 0xc;
r4 = [[r5 stringByAppendingString:r6] retain];
[r6 release];
[r5 release];
r5 = 0x3e8;
r8 = @selector(SHA1);
do {
r7 = r7;
r6 = [objc_msgSend(r4, r8) retain];
[r4 release];
r5 = r5 - 0x1;
r4 = r6;
} while (r5 != 0x0);
r0 = [r6 autorelease];
return r0;
}

很显然我们的加密函数encryptedPasswordForUser:r5根据字面意思会加密password,但这其实是object-C的库函数，我还以为是自定义的。之后找了半天secret关键字，愣是没找到加密在那。

编写挂钩程序

最后经同事提醒，把这个加密函数和里面的md5 sh1统统挂钩后，发现。如下：

Nov 21 09:52:55 4goukuni yidian[7063] : [ServerConnectionConnect:366] ConnectionEstablish failed, (os/kern) successful, Operation not permitted

Nov 21 09:52:55 4goukuni yidian[7063] : [ydhook] Tweak.xm:86 DEBUG: -[ encryptedPasswordForUser:0x13833bfc0]: encryptedPasswordForUser::arg1:,HG_D55370101219

Nov 21 09:52:55 4goukuni yidian[7063] : [ydhook] Tweak.xm:92 DEBUG: -[ encryptedPasswordForUser:0x13833bfc0]: 8dba029dd6e342f292974e6902aa8364c3dddf99//这里对照结果是password

Nov 21 09:52:55 4goukuni yidian[7063] : [ydhook] Tweak.xm:49 DEBUG: -[ buildLoginAsGuestAllInOneRequestWithUserName:0x13833bfc0 password:0x1383621c0 distributionChannel:0x0]: buildLoginAsGuestAllInOneRequestWithUserName::arg1:,HG_D55370101219,;arg2:,8dba029dd6e342f292974e6902aa8364c3dddf99,;arg3:,(null)

Nov 21 09:52:55 4goukuni yidian[7063] : hello world

Nov 21 09:52:55 4goukuni yidian[7063] : [ydhook] Tweak.xm:86 DEBUG: -[ encryptedPasswordForUser:0x13833bfc0]: encryptedPasswordForUser::arg1:,HG_D55370101219

Nov 21 09:52:55 4goukuni yidian[7063] : [ydhook] Tweak.xm:92 DEBUG: -[ encryptedPasswordForUser:0x13833bfc0]: 77ef7555227fba77f82ffadc7d423f8c9e29f5df//这里对照结果是secert

Nov 21 09:52:55 4goukuni yidian[7063] : [ydhook] Tweak.xm:55 DEBUG: -[ buildLoginAsGuestAllInOneRequestWithUserName:0x13833bfc0 password:0x1383621c0 distributionChannel:0x0]: 12 Website/user/login-as-guest 0bd6a4906ba6556b62206b6ab518ef12

Nov 21 10:04:49 4goukuni yidian[7218] : [ydhook] Tweak.xm:88 DEBUG: -[ encryptedPasswordForUser:0x16032e030]: encryptedPasswordForUser::arg1:,HG_90C83A7AAD7A

Nov 21 10:04:49 4goukuni yidian[7218] : [ydhook] Tweak.xm:89 DEBUG: -[ encryptedPasswordForUser:0x16032e030]: 3958dde99ed6ed817adfee423ebeb4fa613196db

Nov 21 10:04:49 4goukuni yidian[7218] : [ydhook] Tweak.xm:95 DEBUG: -[ encryptedPasswordForUser:0x16032e030]: 45f1cc0cebc3cb3a49196b85e49f9082a0c1d2d7//这里对照结果是password

Nov 21 10:04:49 4goukuni yidian[7218] : [ydhook] Tweak.xm:49 DEBUG: -[ buildLoginAsGuestAllInOneRequestWithUserName:0x16032e030 password:0x1601f0f80 distributionChannel:0x0]: buildLoginAsGuestAllInOneRequestWithUserName::arg1:,HG_90C83A7AAD7A,;arg2:,45f1cc0cebc3cb3a49196b85e49f9082a0c1d2d7,;arg3:,(null)

Nov 21 10:04:49 4goukuni yidian[7218] : hello world

Nov 21 10:04:49 4goukuni yidian[7218] : [ydhook] Tweak.xm:51 DEBUG: -[ buildLoginAsGuestAllInOneRequestWithUserName:0x16032e030 password:0x1601f0f80 distributionChannel:0x0]:

Nov 21 10:04:49 4goukuni yidian[7218] : [ydhook] Tweak.xm:88 DEBUG: -[ encryptedPasswordForUser:0x16032e030]: encryptedPasswordForUser::arg1:,HG_90C83A7AAD7A

Nov 21 10:04:49 4goukuni yidian[7218] : [ydhook] Tweak.xm:89 DEBUG: -[ encryptedPasswordForUser:0x16032e030]: yidian

Nov 21 10:04:49 4goukuni yidian[7218] : [ydhook] Tweak.xm:95 DEBUG: -[ encryptedPasswordForUser:0x16032e030]: 2f9d8211c8c93483a168917339695bd8c8cb90e4//这里对照结果是secert

Nov 21 10:04:49 4goukuni yidian[7218] : [ydhook] Tweak.xm:56 DEBUG: -[ buildLoginAsGuestAllInOneRequestWithUserName:0x16032e030 password:0x1601f0f80 distributionChannel:0x0]: 12 Website/user/login-as-guest ede84be0e023c2d24559ce20514132b1

Nov 21 10:15:14 4goukuni yidian[7252] : [ServerConnectionConnect:366] ConnectionEstablish failed, (os/kern) successful, Operation not permitted

Nov 21 10:15:14 4goukuni yidian[7252] : [ydhook] Tweak.xm:88 DEBUG: -[ encryptedPasswordForUser:0x13032c560]: encryptedPasswordForUser::arg1:,HG_C66501C5B83A

Nov 21 10:15:14 4goukuni yidian[7252] : [ydhook] Tweak.xm:89 DEBUG: -[ encryptedPasswordForUser:0x13032c560]: 3958dde99ed6ed817adfee423ebeb4fa613196db

Nov 21 10:15:14 4goukuni yidian[7252] : [ydhook] Tweak.xm:95 DEBUG: -[ encryptedPasswordForUser:0x13032c560]: f42c20fbc76b0afe6a27f224a5f0b8f2104a73e4//这里对照结果是password

Nov 21 10:15:14 4goukuni yidian[7252] : [ydhook] Tweak.xm:49 DEBUG: -[ buildLoginAsGuestAllInOneRequestWithUserName:0x13032c560 password:0x130358c10 distributionChannel:0x0]: buildLoginAsGuestAllInOneRequestWithUserName::arg1:,HG_C66501C5B83A,;arg2:,f42c20fbc76b0afe6a27f224a5f0b8f2104a73e4,;arg3:,(null)

Nov 21 10:15:14 4goukuni yidian[7252] : hello world

Nov 21 10:15:14 4goukuni yidian[7252] : [ydhook] Tweak.xm:51 DEBUG: -[ buildLoginAsGuestAllInOneRequestWithUserName:0x13032c560 password:0x130358c10 distributionChannel:0x0]:

Nov 21 10:15:14 4goukuni yidian[7252] : [ydhook] Tweak.xm:88 DEBUG: -[ encryptedPasswordForUser:0x13032c560]: encryptedPasswordForUser::arg1:,HG_C66501C5B83A

Nov 21 10:15:14 4goukuni yidian[7252] : [ydhook] Tweak.xm:89 DEBUG: -[ encryptedPasswordForUser:0x13032c560]: yidian

Nov 21 10:15:14 4goukuni yidian[7252] : [ydhook] Tweak.xm:95 DEBUG: -[ encryptedPasswordForUser:0x13032c560]: bb788607ffb215eb93dcb2b96937829166a38323//这里对照结果是secert

Nov 21 10:15:14 4goukuni yidian[7252] : [ydhook] Tweak.xm:56 DEBUG: -[ buildLoginAsGuestAllInOneRequestWithUserName:0x13032c560 password:0x130358c10 distributionChannel:0x0]: 12 Website/user/login-as-guest 288d54b590b2a677900c75e45c1ac2e9

这里要重新charels一下，一对比发现，想骂人了。分本就是条用一个函数生成的这两的关键字。

生成过程引用了相同的usename,不同之处在于字符传拼接过程引入的数据不一样。

3958dde99ed6ed817adfee423ebeb4fa613196db

yidian

根据最后一组的数据判断，拼接用到的字符串分别是以上两个。那么现在加密函数出来了。

void * -[NSString encryptedPasswordForUser:](void * self, void * _cmd, void * arg2) {

stack[2043] = r4;

*((sp - 0x14) + 0xfffffffffffffffc) = r8;

r5 = [[arg2 lowercaseString] retain];//,HG_D55370101219

r6 = [[self MD5] retain];

r7 = (sp - 0x14) + 0xc;

r4 = [[r5 stringByAppendingString:r6] retain];

[r6 release];

[r5 release];

r5 = 0x3e8;

r8 = @selector(SHA1);

do {

r7 = r7;

r6 = [objc_msgSend(r4, r8) retain];

[r4 release];

r5 = r5 - 0x1;

r4 = r6;

} while (r5 != 0x0);

r0 = [r6 autorelease];

return r0;

}

就是这玩意。

经验分享

我发现，分析这个加密过程有个规则。因为我们加密关键字一般要勇担现有的加密库，所以分析的时候所以不管三七二十一现把貌似的加密库函数挂上，跟踪一下，很快就能发现这个加密规则在那。自己在那分析了半天不能说没用，有点没找到北的感觉。

关于lldb和debugserver

这个东西在用的时候真心不是一般的纠结，很多功能自导可以查，但是就是查不出来。我这里找到个偏门的，没大验证。不过以后可以留着用下。我们对函数下段一般是要先找到基地址，然后在找偏移算出实际地址。但在lldb中当一大片基地址划过的时候，我的心是崩溃的，黑压压的一片，啥玩意都找不到。当然，应该能找到，我只是说比较不方便。

这里我可以先在关键函数附近下个钩子弹出一个窗口，然后我们在 lldb端 process interrupt终端一下，然后跟踪，应该就能找到。不过有可能断的地方不是在我们需要的模块上，有点鸡肋了。

以后在改进吧