{"id":90669,"date":"2020-05-08T10:10:59","date_gmt":"2020-05-08T02:10:59","guid":{"rendered":"http:\/\/4563.org\/?p=90669"},"modified":"2020-05-08T10:10:59","modified_gmt":"2020-05-08T02:10:59","slug":"%e4%b8%80%e4%b8%aa%e9%9d%99%e6%80%81%e6%b3%a8%e5%85%a5%e5%8a%a8%e6%80%81%e5%ba%93%e7%9a%84%e5%b7%a5%e5%85%b7-luject","status":"publish","type":"post","link":"http:\/\/4563.org\/?p=90669","title":{"rendered":"\u4e00\u4e2a\u9759\u6001\u6ce8\u5165\u52a8\u6001\u5e93\u7684\u5de5\u5177: luject"},"content":{"rendered":"
\n
\n
\n

\u4e00\u4e2a\u9759\u6001\u6ce8\u5165\u52a8\u6001\u5e93\u7684\u5de5\u5177: luject <\/h1>\n

<\/p>\n

\n
\u8cc7\u6df1\u5927\u4f6c : waruqi <\/span> <\/i> 19<\/span> <\/div>\n
<\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n
<\/p>\n

luject\u662f\u4e00\u4e2a\u9759\u6001\u6ce8\u5165\u52a8\u6001\u5e93\u7684\u5de5\u5177\uff0c\u5b83\u53ef\u4ee5\u5b9e\u73b0\u5bf9 mac, ios, linux, windows, android \u7684\u53ef\u6267\u884c\u7a0b\u5e8f\uff0c\u52a8\u6001\u5e93\u7a0b\u5e8f\u8fdb\u884c\u4fee\u6539\uff0c\u6765\u63d2\u5165\u6307\u5b9a\u52a8\u6001\u5e93\u5b9e\u73b0\u6ce8\u5165\u548c\u52a0\u8f7d\u3002<\/p>\n

\u53e6\u5916 luject \u4e5f\u5b9e\u73b0\u4e86\u5bf9 ios \u7684 ipa \u5305\uff0candroid \u7684 apk \u5305\u81ea\u5df1 macOS \u7684.app \u5305\u7684\u52a8\u6001\u5e93\u6ce8\u5165\uff0c\u91cd\u6253\u5305\u548c\u91cd\u7b7e\u540d\u652f\u6301\u3002<\/p>\n

\u6ce8\u5165\u6280\u672f\u7b80\u4ecb<\/h3>\n

\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7 ptrace \u9644\u52a0\u6216\u542f\u52a8\u4e00\u4e2a\u7a0b\u5e8f\uff0c\u7136\u540e\u5c06\u6307\u5b9a\u7684\u52a8\u6001\u5e93\u6ce8\u5165\u8fdb\u53bb\uff0c\u4f46\u5f88\u591a\u60c5\u51b5\u4e0b\u9700\u8981 root \u6743\u9650\u624d\u884c\u3002<\/p>\n

\u9664\u4e86\u901a\u8fc7\u52a8\u6001\u6ce8\u5165\uff0c\u6211\u4eec\u4e5f\u53ef\u4ee5\u901a\u8fc7\u8bbe\u7f6eDYLD_INSERT_LIBRARIES<\/code>\u7b49\u73af\u5883\u53d8\u91cf\u7684\u65b9\u5f0f\uff0c\u6765\u6ce8\u5165\u6307\u5b9a\u7684\u52a8\u6001\u5e93\uff0cmac\/ios \u7a0b\u5e8f\u5c31\u53ef\u4ee5\u4f7f\u7528\u8fd9\u79cd\u65b9\u5f0f\u6765\u7b80\u5355\u5feb\u901f\u5730\u5b9e\u73b0\u6ce8\u5165\uff0c\u4f8b\u5982\uff1a<\/p>\n

$DYLD_INSERT_LIBRARIES=inject.dylib .\/test <\/code><\/pre>\n
\u4e0d\u8fc7\u8fd9\u79cd\u65b9\u5f0f\u5728 ios \u4e0a\u4e5f\u9700\u8981\u8d8a\u72f1\u540e\u624d\u53ef\u7528\uff0c\u53e6\u5916\u6211\u4eec\u4e5f\u53ef\u4ee5\u5728\u5de5\u7a0b\u7684 Build Settings \u4e2d\u627e\u5230 Other Linker Flages \u5e76\u6dfb\u52a0\u4e0b\u9762\u7684\u5b57\u6bb5\u6765\u9650\u5236\u8fd9\u79cd\u52a0\u8f7d\u65b9\u5f0f\uff0c\u5b9e\u73b0\u5bf9\u53ef\u6267\u884c\u7a0b\u5e8f\u7684\u6ce8\u5165\u4fdd\u62a4\u3002<\/p>\n
-Wl,-sectcreate,__RESTRICT,__restrict,\/dev\/null <\/code><\/pre>\n
\u56e0\u6b64\uff0c\u4e5f\u4e0d\u662f\u975e\u5e38\u7684\u901a\u7528\uff0c\u5176\u5b9e\u8fd8\u6709\u4e00\u79cd\u66f4\u52a0\u901a\u7528\u7684\u65b9\u5f0f\uff0c\u5c31\u662f\u76f4\u63a5\u9759\u6001\u4fee\u6539\u53ef\u6267\u884c\u6587\u4ef6\uff0c\u63d2\u5165\u9700\u8981\u52a0\u8f7d\u7684\u52a8\u6001\u5e93\u5c31\u53ef\u4ee5\u4e86\uff0c\u7b80\u5355\u66b4\u529b\u6709\u6548\u3002<\/p>\n
Mayhem \u5728Phrack\u4e2d\u4e5f\u8be6\u7ec6\u89e3\u91ca\u4e86\u8fd9\u4e00\u6280\u672f\u7684\u539f\u7406\uff0c\u800c LIEF \u5e93\u63d0\u4f9b\u4e86\u4e00\u79cd\u8de8\u5e73\u53f0\u7684 api\uff0c\u5b9e\u73b0\u5bf9 MachO, ELF, PE \u7b49\u53ef\u6267\u884c\u6587\u4ef6\u683c\u5f0f\u7684\u5feb\u901f\u4fee\u6539\u3002<\/p>\n
\u8fd9\u91cc luject \u5c31\u662f\u5229\u7528\u4e86\u8fd9\u4e2a\u5e93\uff0c\u901a\u8fc7\u4fee\u6539\u53ef\u6267\u884c\u6587\u4ef6\uff0c\u63d2\u5165\u52a8\u6001\u5e93\u52a0\u8f7d\u8def\u5f84\uff0c\u6765\u5b9e\u73b0\u9759\u6001\u6ce8\u5165\uff0c\u4f8b\u5982\uff1a<\/p>\n
auto elf_binary = std::unique_ptr<LIEF::ELF::Binary>{LIEF::ELF::Parser::parse(\"testapp\")}; elf_binary->add_library(\"libtest.so\"); elf_binary->write(\"testapp_injected\"); <\/code><\/pre>\n
luject \u7f16\u8bd1\u5b89\u88c5<\/h3>\n
\u51c6\u5907\u5de5\u4f5c<\/h4>\n
\u6211\u4eec\u9700\u8981\u5148\u5b89\u88c5xmake\u6765\u7f16\u8bd1\u6b64\u9879\u76ee\u3002<\/p>\n
\u7f16\u8bd1<\/h4>\n
$ xmake <\/code><\/pre>\n
\u5b89\u88c5<\/h4>\n
$ xmake install <\/code><\/pre>\n
luject \u4f7f\u7528\u8bf4\u660e<\/h3>\n
\u7528\u6cd5\u5f88\u7b80\u5355\uff0c\u4e3b\u8981\u5c31\u662f\u6307\u5b9a\u8f93\u5165\u8f93\u51fa\u7684\u6587\u4ef6\u8def\u5f84\u5c31\u597d\uff1a<\/p>\n
$ luject -i [input] -o [output] -p [libpattern] lib1 lib2 .. <\/code><\/pre>\n
\u6700\u540e\u9762\u7684 lib \u5217\u8868\uff0c\u5c31\u662f\u6307\u5b9a\u6709\u54ea\u4e9b\u52a8\u6001\u5e93\u9700\u8981\u88ab\u6ce8\u5165\u8fdb\u53bb<\/p>\n
\u4f8b\u5982\uff1a<\/p>\n
$ luject -i app.apk lib1.so lib2.so $ luject -i app.ipa lib1.dylib lib2.dylib $ luject -i liba.so lib1.so lib2.so $ luject -i app.exe lib1.dll lib2.dll $ luject -i a.dll lib1.dll lib2.dll $ luject -i liba.dylib lib1.dylib lib2.dyib $ luject -i bin lib1.so lib2.so <\/code><\/pre>\n
\u5f53\u7136\uff0c\u9664\u4e86\u6307\u5b9a\u5e93\u8def\u5f84\uff0c\u6211\u4eec\u4e5f\u53ef\u4ee5\u6307\u5b9a@loader_path<\/code>, $ORIGIN<\/code>\u7684\u8def\u5f84\u8fdb\u53bb\uff0c\u4f8b\u5982\uff1a<\/p>\n
$ luject -i libdemo.dylib @loader_path\/libtest.dylib <\/code><\/pre>\n
\u4e0a\u9762\u7684\u547d\u4ee4\uff0c\u6211\u4eec\u5c31\u53ef\u4ee5\u628alibtest.dylib<\/code>\u6ce8\u5165\u5230\u53e6\u4e00\u4e2alibdemo.dylib<\/code>\u7684\u52a8\u6001\u5e93\u4e2d\u53bb\uff0c\u5982\u679clibdemo.dylib<\/code>\u88ab\u52a0\u8f7d\uff0c\u90a3\u4e48\u5c31\u4f1a\u4ece@loader_path<\/code>\u4e5f\u5c31\u662f libdemo.dylib \u5f53\u524d\u52a0\u8f7d\u76ee\u5f55\u4e0b \u627e\u5bf9\u5e94\u7684libtest.dylib<\/code>\u5e93\uff0c\u7136\u540e\u81ea\u52a8\u52a0\u8f7d\u8fdb\u6765\uff0c\u6211\u4eec\u4e5f\u53ef\u4ee5\u901a\u8fc7 otool\/ldd \u7b49\u5de5\u5177\u4e5f\u67e5\u770b\u9a8c\u8bc1\u52a0\u8f7d\u5217\u8868\uff1a<\/p>\n
$ otool -L libdemo.dylib libdemo.dylib:  @loader_path\/libtest.dylib (compatibility version 0.0.0, current version 0.0.0)  \/usr\/lib\/libz.1.dylib (compatibility version 1.0.0, current version 1.2.11)  \/usr\/lib\/libc++.1.dylib (compatibility version 1.0.0, current version 800.7.0)  \/usr\/lib\/libSystem.B.dylib (compatibility version 1.0.0, current version 1281.0.0) <\/code><\/pre>\n
\u53ef\u4ee5\u770b\u5230\uff0clibtest \u5e93\u5df2\u7ecf\u88ab\u6210\u529f\u63d2\u5165\u8fdb\u53bb\u4e86\u3002<\/p>\n
\u6ce8\u5165 libfrida-gadget.so \u5230 apk<\/h3>\n
\u901a\u5e38\u6211\u4eec\u5728\u4f7f\u7528 frida \u7cfb\u5217\u5de5\u5177\u5bf9 app \u8fdb\u884c\u52a8\u6001\u5206\u6790\u65f6\uff0c\u5982\u679c\u4e0d\u60f3 root\uff0c\u90a3\u4e48\u53ef\u4ee5\u901a\u8fc7 luject \u5c06 frida-gadget \u5e93\u9759\u6001\u6ce8\u5165\u5230 apk \u91cc\u9762\u7684 so \u5e93\u4e2d\u53bb\uff0c\u6bd4\u5982\uff1a<\/p>\n
$ luject -i app.apk -p libtest \/tmp\/libfrida-gadget.so <\/code><\/pre>\n
\u5176\u4e2d\uff0clibtest \u662f\u6307\u5b9a apk \u4e2d\u9700\u8981\u5339\u914d\u6ce8\u5165\u7684 so \u5e93\uff0c\u5e76\u4e14\u652f\u6301\u6a21\u5f0f\u5339\u914d\u5b9e\u73b0\u6279\u91cf\u6ce8\u5165\uff0c\u4f8b\u5982\uff1alibtest_*.so<\/code>\uff0c\u5982\u679c\u4e0d\u6307\u5b9a-p<\/code>\u53c2\u6570\uff0c\u9ed8\u8ba4\u591a\u6240\u6709 so \u8fdb\u884c\u6279\u91cf\u5168\u6ce8\u5165\u3002<\/p>\n
\u5173\u4e8e\u8fd9\u5757\uff0c\u6211\u4eec\u4e5f\u53ef\u4ee5\u8be6\u7ec6\u770b\u4e0b\u76f8\u5173\u6587\u7ae0: How to use frida on a non-rooted device<\/p>\n
\u53e6\u5916\uff0cluject \u91cd\u6253\u5305\u540e\uff0c\u8fd8\u4f1a\u5bf9 apk \u8fdb\u884c\u91cd\u7b7e\u540d\uff0c\u6765\u786e\u4fdd\u53ef\u4ee5\u6b63\u5e38\u5b89\u88c5\u4f7f\u7528<\/p>\n
\u6ce8\u5165 libfrida-gadget.dylib \u5230 ipa<\/h3>\n
\u9664\u4e86 android \u7684\u5e94\u7528\u7a0b\u5e8f\u5305\uff0cluject \u4e5f\u652f\u6301\u5bf9 ios \u7684 ipa \u5305\u8fdb\u884c\u6ce8\u5165\uff0c\u7528\u6cd5\u7c7b\u4f3c\uff1a<\/p>\n
$ luject -i app.ipa -p libtest \/tmp\/libfrida-gadget.dylib <\/code><\/pre>\n
luject \u4e5f\u4f1a\u5bf9 ipa \u5305\u8fdb\u884c\u91cd\u7b7e\u540d\uff0c\u5b83\u4f1a\u81ea\u52a8\u63a2\u6d4b\u7528\u6237\u73af\u5883\u4e2d\u7684\u6709\u6548\u7b7e\u540d\u8bc1\u4e66\uff0c\u6765\u76f4\u63a5\u91cd\u7b7e\u540d\uff0c\u5f53\u7136\u5982\u679c\u9ed8\u8ba4\u68c0\u6d4b\u7684\u7b7e\u540d\u4e0d\u7b26\u5408\u9700\u6c42\uff0c\u6211\u4eec\u4e5f\u53ef\u4ee5\u624b\u52a8\u6307\u5b9a\u5bf9\u5e94\u7684\u7b7e\u540d\u4fe1\u606f\uff1a<\/p>\n
$ luject -i app.ipa -p libtest --codesign_identity='Apple Development: [email protected] (T3NA4MRVPU)' --mobile_provision='iOS Team Provisioning Profile: org.tboox.test' --bundle_identifier=org.tboox.test \/tmp\/libfrida-gadget.dylib <\/code><\/pre>\n
\u90a3\u5982\u4f55\u77e5\u9053\u6211\u4eec\u9700\u8981\u7684\u7b7e\u540d\u914d\u7f6e\u5462\uff1f\u4e00\u79cd\u5c31\u662f\u5728 xcode \u91cc\u9762\u67e5\u770b\uff0c\u53e6\u5916 xmake \u4e5f\u63d0\u4f9b\u4e86\u4e00\u4e9b\u8f85\u52a9\u5de5\u5177\u53ef\u4ee5 dump \u51fa\u5f53\u524d\u53ef\u7528\u7684\u6240\u6709\u7b7e\u540d\u914d\u7f6e\uff1a<\/p>\n
$ xmake l private.tools.codesign.dump ==================================== codesign identities ==================================== {    \"Apple Development: [email protected] (T3NA4MRVPU)\" = \"AF73C231A0C35335B72761BD3759694739D34EB1\"  }  ===================================== mobile provisions ===================================== {    \"iOS Team Provisioning Profile: org.tboox.test\" = \"<?xml version=\"1.0\" encoding=\"UTF-8\"?> <!DOCTYPE plist PUBLIC \"-\/\/Apple\/\/DTD PLIST 1.0\/\/EN\" \"http:\/\/www.apple.com\/DTDs\/PropertyList-1.0.dtd\"> <plist version=\"1.0\"> <dict>  <key>AppIDName<\/key>  <string>XC org tboox test5<\/string>  <key>ApplicationIdentifierPrefix<\/key>  <array>  <string>43AAQM58X3<\/string> ... <\/code><\/pre>\n
xmake \u4e5f\u63d0\u4f9b\u4e86\u5176\u4ed6\u8f85\u52a9\u5de5\u5177\u6765\u5bf9\u5df2\u6709\u7684 ipa\/app \u7a0b\u5e8f\u8fdb\u884c\u91cd\u7b7e\u540d\uff0c\u4f8b\u5982\uff1a<\/p>\n
$ xmake l utils.ipa.resign test.ipa|test.app [codesign_identity] [mobile_provision] [bundle_identifier] <\/code><\/pre>\n
\u5176\u4e2d\uff0c\u540e\u9762\u7684\u7b7e\u540d\u53c2\u6570\u90fd\u662f\u53ef\u9009\u7684\uff0c\u5982\u679c\u6ca1\u8bbe\u7f6e\uff0c\u90a3\u4e48\u9ed8\u8ba4\u4f1a\u63a2\u6d4b\u4f7f\u7528\u4e00\u4e2a\u6709\u6548\u7684\u7b7e\u540d\uff1a<\/p>\n
$ xmake l utils.ipa.resign test.ipa $ xmake l utils.ipa.resign test.app \"Apple Development: [email protected] (T3NA4MRVPU)\" $ xmake l utils.ipa.resign test.ipa \"Apple Development: [email protected] (T3NA4MRVPU)\" iOS Team Provisioning Profile: org.tboox.test\" org.tboox.test <\/code><\/pre>\n<\/p><\/div>\n
 \u5927\u4f6c\u6709\u8a71\u8aaa<\/b> (4<\/span>)        <\/div>\n
 <\/div>\n<\/p><\/div>\n<\/p><\/div>\n
    \n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : ostrichb <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 \u8fd9\u4e1c\u897f\u662f\u4e0d\u662f\u6709 xposed \u90a3\u5473                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : colinxu <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 \u8fd9\u4e2a\u6709\u70b9\u725b\u6279\u554a                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u4e3b<\/span> \u8cc7\u6df1\u5927\u4f6c : waruqi <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 @ostrichb \u8fd9\u4e2a\u662f\u76f4\u63a5\u7be1\u6539\u7684\u5305\uff0c\u8ddf xposed \u4e0d\u4e00\u6837                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n
    \n
    \n
     \u8cc7\u6df1\u5927\u4f6c : billwsy <\/span>  <\/div>\n
     <\/i>            <\/span> <\/div>\n<\/p><\/div>\n
                                                                 \u597d\u4e1c\u897f\uff0c\u53ef\u4ee5\u62ff\u6765\u4ee3\u66ff\u8fd9\u4e2a\u4e86 https:\/\/github.com\/Naituw\/IPAPatch                                                            <\/div>\n<\/p><\/div>\n<\/li>\n
  • \n","protected":false},"excerpt":{"rendered":"
    \u4e00\u4e2a\u9759\u6001\u6ce8\u5165\u52a8\u6001\u5e93\u7684\u5de5\u5177: luj…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[],"tags":[],"_links":{"self":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/90669"}],"collection":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=90669"}],"version-history":[{"count":0,"href":"http:\/\/4563.org\/index.php?rest_route=\/wp\/v2\/posts\/90669\/revisions"}],"wp:attachment":[{"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=90669"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=90669"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/4563.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=90669"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}