前言
感谢deepseek帮我完成了脱360壳的梦想。
虽然这个壳只是个vip版的，但我仍然从本次逆向中受益颇深。
本篇目只进行技术分析，不涉及任何功能上的破解。
如果有违规的地方，请管理员作删帖处理。谢谢。
使用软件&工具
智慧树app 5.4.1
frida 17.17.0
adb.exe
雷电模拟器9
vdexExtractor.exe
compact_dex_converter
Cygwin64
deepseek网页版
jadx
破解思路
最开始想通过回编译进行一些修改，结果发现MT回包安装不了。
apktool一套工具好一点，能安装但不能运行。
当然嘛，肯定有检测。
所以我换一个思路，直接进行静态分析+动态修改。
在破解之前，就已经听说了frida-server可能会被检测，所谓的命名问题？
所以我将frida-server改名为fserver，并push到/data/local/tmp目录下。
我不太清楚是否有效，或者监测点是否有这个。
不管它，反正后续成功了。
接下来尝试了使用ida先对jiagu.so进行分析。
没什么成果，我不知道从哪里下手。
索性直接放弃静态分析。
既然是个壳，如果可以直接找到业务代码，直接使用frida进行操作不就好了？
所以主要的流程就是dump出业务代码。
破解概述
1.改txt回编译失败,显示-127
{
1.删除android:extractNativeLibs属性失败
2.MT管理器去签名检验失败
3.不修改文件，只共存签名也失败
}
2.放弃MT,改用apktool工具链回编译
3.可以安装但闪退，100%有检验
4.使用adb查看报错日志，显示是so释放失败
5.搜索attachBaseContext,里面有jiagu.so的加载逻辑
{
1.jiagu.so在loadFromLib == false分支加载
2.核心函数是a.a(Context, String, String, String)
}
6.没啥思路，暂时放弃静态打包，进入jiagu.so分析
7.没啥用，直接跳过静态分析尝试dump数据
8.折腾半天，终于dump出dex，流程如下:
{
1.AI给出frida的bypass.js脚本，附加到app
2.AI给出frida临时代码，定位到vdex文件
3.adb dump出vdex
4.Cygwin中编译vdexExtractor.exe将vdex转为cdex
5.compact_dex_converter将cdex转化为dex
}
9.dump的文件不存在native,也就是可能没有下一关
10.dump的ePU565和poZ536都不是业务代码，是getui和igexin的SDK
11.核心代码应该在zx-core中
12.zx-core中有native,多半有下一关
13.zx-core不是真正的业务代码，甚至还只是一个壳
14.推测失败了，zx-core也是卓信的SDK而不是业务代码
15.直接枚举包名,得到一堆类名
Java.perform(function() {
Java.enumerateLoadedClasses({
onMatch: function(name) {
if (name.indexOf("com.able.wisdomtree") !== -1) {
console.log("[+] " + name);
}
},
onComplete: function() { console.log(" done"); }
});
});
16.查找类名的dex路径
Java.perform(function() {
var targetClasses = [
"com.able.wisdomtree.loginNew.LoginNewActivity",
"com.able.wisdomtree.brushlessons.util.BrushUtil",
"com.able.wisdomtree.utils.ApiService"
];
targetClasses.forEach(function(clsName) {
Java.enumerateClassLoaders({
onMatch: function(loader) {
try {
var cl = Java.use("java.lang.ClassLoader");
var cls = cl.loadClass.call(loader, clsName);
console.log("[+] " + clsName + " -> " + loader);
} catch (e) {}
},
onComplete: function() {}
});
});
});
17.根据返回结果，分析得业务代码不在dex里，在内存里，似乎页属性不一样，读取更麻烦一点
//在这里AI跑偏了，去dump了原apk里的dex，及时纠正
18.tmp.dex也是空的，无敌了
19.寻找OpneMemory以获取dex加载
setImmediate(function() {
var libdexfile = Process.findModuleByName("libdexfile.so");
if (!libdexfile) {
console.log("[-] libdexfile.so not loaded");
return;
}
console.log(" libdexfile base: " + libdexfile.base);
var symbols = libdexfile.enumerateSymbols();
var found = 0;
symbols.forEach(function(sym) {
if (sym.name.indexOf("OpenMemory") !== -1 ||
sym.name.indexOf("OpenCommon") !== -1 ||
sym.name.indexOf("DexFile") !== -1) {
console.log("[+] " + sym.name + " @ " + sym.address);
found++;
}
});
console.log(" total found: " + found);
});
20.在程序加载时对DexFileLoader::Open进行hook
frida -U -f com.able.wisdomtree -l bypass.js -l hook_dex.js
21.要爆炸了，全是权限错误
readByteArray不行
Memory.protect(成功) + readByteArray(失败)不行
syscall process_vm_readv不行
memcpy不行
Process.findRangeByAddress不行
22.AI给出的解释是:Process.enumerateRanges不在frida能枚举的范围之内，pread64走内核read路径，不查用户态maps
23.直接使用libc的pread64绕过检测
24.成功了，pread64(/proc/self/mem)+64KB 分块+写 App 私有目录，再将dex pull出来
25.经过初步鉴定，这些dump出的代码是带正确包名，也就是真正的业务代码
26.至此，脱壳完成
核心破解流程
首先，cmd启动frida-server
adb shell
su
cd /data/local/tmp
chmod 777 fserver
./fserver
AI给出bypass.js脚本，新建cmd，使用spawn模式启动frida
//bypass.js
(function() {
function findExport(name) {
if (typeof Module.findGlobalExportByName === 'function') {
return Module.findGlobalExportByName(name);
}
return Module.findExportByName(null, name);
}
var abort = findExport("abort");
if (abort) {
Interceptor.replace(abort, new NativeCallback(function() {
console.log(" abort() blocked");
}, 'void', []));
console.log(" abort hooked");
}
['exit', '_exit'].forEach(function(name) {
var fn = findExport(name);
if (fn) {
Interceptor.replace(fn, new NativeCallback(function(code) {
console.log(" " + name + "(" + code + ") blocked");
}, 'void', ['int']));
console.log(" " + name + " hooked");
}
});
console.log(" Simple bypass installed");
})();
frida -U -f com.able.wisdomtree -l bypass.js
在frida控制台枚举ClassLoader尝试寻找dex
Java.perform(function() {
Java.enumerateClassLoaders({
onMatch: function(loader) {
try {
var cl = Java.use("java.lang.ClassLoader");
var cls = cl.loadClass.call(loader, "com.able.wisdomtree.BuildConfig");
console.log("[+] Found in loader: " + loader);
} catch (e) {}
},
onComplete: function() { console.log(" done"); }
});
});
[-] dalvik.system.PathClassLoader[DexPathList[[directory "."],nativeLibraryDirectories=[/system/lib64, /system/vendor/lib64, /system/lib64, /system/vendor/lib64]]] -> java.lang.ClassNotFoundException: Didn't find class "com.able.wisdomtree.BuildConfig" on path: DexPathList[[directory "."],nativeLibraryDirectories=[/system/lib64, /system/vendor/lib64, /system/lib64, /system/vendor/lib64]]
[-] java.lang.BootClassLoader@2d986de -> java.lang.ClassNotFoundException: com.able.wisdomtree.BuildConfig
[+] Found in loader: dalvik.system.PathClassLoader[DexPathList[[zip file "/system/framework/org.apache.http.legacy.boot.jar", zip file "/data/app/com.able.wisdomtree-rsx6O1emPLh0SooGvdirEw==/base.apk", dex file "/data/data/com.able.wisdomtree/.jiagu/tmp.dex"],nativeLibraryDirectories=[/data/app/com.able.wisdomtree-rsx6O1emPLh0SooGvdirEw==/lib/arm64, /data/app/com.able.wisdomtree-rsx6O1emPLh0SooGvdirEw==/base.apk!/lib/arm64-v8a, /system/lib64, /system/vendor/lib64]]]
[+] Found in loader: dalvik.system.DexClassLoader[DexPathList[[zip file "/data/user/0/com.able.wisdomtree/files/zx-core-3.3.2.25477/classes.jar"],nativeLibraryDirectories=[/system/lib64, /system/vendor/lib64]]]
[+] Found in loader: dalvik.system.DexClassLoader[DexPathList[[zip file "/data/user/0/com.able.wisdomtree/files/libs/tdata_poZ536.jar"],nativeLibraryDirectories=[/system/lib64, /system/vendor/lib64]]]
[+] Found in loader: dalvik.system.DexClassLoader[DexPathList[[zip file "/data/user/0/com.able.wisdomtree/files/libs/tdata_ePU565.jar"],nativeLibraryDirectories=[/system/lib64, /system/vendor/lib64]]] done
先看.jiagu目录
C:\Users\HUAWEI>adb shell "su -c 'ls -la /data/data/com.able.wisdomtree/.jiagu/'"
total 1220
drwx------ 3 u0_a53 u0_a53 4096 2026-09-19 18:09 .
drwx------ 13 u0_a53 u0_a53 4096 2026-09-19 18:02 ..
-r-x------ 1 u0_a53 u0_a53 1226432 2026-09-19 17:34 libjiagu_64.so
drwx------ 3 u0_a53 u0_a53 4096 2026-09-19 17:34 oat
-rw------- 1 u0_a53 u0_a53 284 2026-09-19 17:34 tmp.dex
C:\Users\HUAWEI>
tmp.dex只有284字节，不是业务dex
转而拉取其他jar
C:\Users\HUAWEI>adb shell "su -c 'cp /data/user/0/com.able.wisdomtree/files/zx-core-3.3.2.25477/classes.jar /sdcard/'"
adb shell "su -c 'cp /data/user/0/com.able.wisdomtree/files/libs/tdata_poZ536.jar /sdcard/'"
adb shell "su -c 'cp /data/user/0/com.able.wisdomtree/files/libs/tdata_ePU565.jar /sdcard/'"
adb pull /sdcard/classes.jar
adb pull /sdcard/tdata_poZ536.jar
adb pull /sdcard/tdata_ePU565.jarcp: bad '/data/user/0/com.able.wisdomtree/files/zx-core-3.3.2.25477/classes.jar': No such file or directory
文件不存在，查看files目录下的文件
adb shell "su -c 'ls -laR /data/data/com.able.wisdomtree/files/'"
......
/data/data/com.able.wisdomtree/files/libs:
total 544
drwx------ 3 u0_a53 u0_a53 4096 2026-09-19 18:09 .
drwxrwx--x 15 u0_a53 u0_a53 4096 2026-09-19 18:09 ..
drwx--x--x 3 u0_a53 u0_a53 4096 2026-09-19 17:36 oat
-rw------- 1 u0_a53 u0_a53 122994 2026-09-19 17:36 tdata_ePU565
-rw------- 1 u0_a53 u0_a53 417737 2026-09-19 17:36 tdata_poZ536
......
/data/data/com.able.wisdomtree/files/libs/oat/x86_64:
total 1396
drwx--x--x 2 u0_a53 u0_a53 4096 2026-09-19 17:36 .
drwx--x--x 3 u0_a53 u0_a53 4096 2026-09-19 17:36 ..
-rw------- 1 u0_a53 u0_a53 21120 2026-09-19 17:36 tdata_ePU565.odex
-rw------- 1 u0_a53 u0_a53 307064 2026-09-19 17:36 tdata_ePU565.vdex
-rw------- 1 u0_a53 u0_a53 37504 2026-09-19 17:36 tdata_poZ536.odex
-rw------- 1 u0_a53 u0_a53 1048228 2026-09-19 17:36 tdata_poZ536.vdex
......
主要看到了有两个vdex，将它们分别pull出来
windows环境里，在Cygwin使用vdexExtractor.exe将vdex转化为cdex
再在linux环境里，使用compact_dex_converter将cdex转化为dex
感觉如果环境配置得好的话应该不会有我这么麻烦
附上我拆zxcore的cmd命令:
Cygwin
mkdir -p /cygdrive/d/Reverse/stubapp/zxcore/out
cd /cygdrive/d/Reverse/stubapp/zxcore
~/vdex/vdexExtractor.exe -i zxcore.vdex -o out --deps
cmd
adb push D:\Reverse\stubapp\zxcore\out\zxcore_classes.cdex /data/local/tmp/
adb shell "cd /data/local/tmp && ./compact_dex_converter zxcore_classes.cdex"
adb pull /data/local/tmp/zxcore_classes.cdex.new D:\Reverse\stubapp\zxcore\
ren D:\Reverse\stubapp\zxcore\zxcore_classes.cdex.new zxcore_classes.dex
仅供参考，因为这些文件都不是关键代码。
得到的dex拖进jadx分析，都是SDK的dex，所以思路错了，一切打到重来。
在frida的控制台，对包名进行枚举。
Java.perform(function() {
Java.enumerateLoadedClasses({
onMatch: function(name) {
if (name.indexOf("com.able.wisdomtree") !== -1) {
console.log("[+] " + name);
}
},
onComplete: function() { console.log(" done"); }
});
});
......
[+] com.able.wisdomtreeforteacher.rongcould.model.Event$UpdateGroupNameEvent
[+] com.able.wisdomtreeforteacher.rongcould.pluginModule.DocPlugin
[+] com.able.wisdomtree.course.course.studycourse.model.QuestionDetialModel$OnAnswerPraiseOrCancelListener
[+] com.able.wisdomtree.newdiscovery.bean.FindStatisticsResponse$FindDetailsResponse
[+] com.able.wisdomtree.authenticate.AuthenticateActivity$CheckRt
[+] com.able.wisdomtree.maincoursepay.model.MainCourseDetialPayModel
[+] com.able.wisdomtree.bean.bean.SSLResultBean$RtBean
......
寻找dex来源
Java.perform(function() {
var targetClasses = [
"com.able.wisdomtree.loginNew.LoginNewActivity",
"com.able.wisdomtree.brushlessons.util.BrushUtil",
"com.able.wisdomtree.utils.ApiService"
];
targetClasses.forEach(function(clsName) {
Java.enumerateClassLoaders({
onMatch: function(loader) {
try {
var cl = Java.use("java.lang.ClassLoader");
var cls = cl.loadClass.call(loader, clsName);
console.log("[+] " + clsName + " -> " + loader);
} catch (e) {}
},
onComplete: function() {}
});
});
});
[+] com.able.wisdomtree.loginNew.LoginNewActivity -> dalvik.system.PathClassLoader[DexPathList[[zip file "/system/framework/org.apache.http.legacy.boot.jar", zip file "/data/app/com.able.wisdomtree-rsx6O1emPLh0SooGvdirEw==/base.apk", dex file "/data/data/com.able.wisdomtree/.jiagu/tmp.dex"],nativeLibraryDirectories=[/data/app/com.able.wisdomtree-rsx6O1emPLh0SooGvdirEw==/lib/arm64, /data/app/com.able.wisdomtree-rsx6O1emPLh0SooGvdirEw==/base.apk!/lib/arm64-v8a, /system/lib64, /system/vendor/lib64]]]
[+] com.able.wisdomtree.loginNew.LoginNewActivity -> dalvik.system.DexClassLoader[DexPathList[[zip file "/data/user/0/com.able.wisdomtree/files/zx-core-3.3.2.25477/classes.jar"],nativeLibraryDirectories=[/system/lib64, /system/vendor/lib64]]]
[+] com.able.wisdomtree.loginNew.LoginNewActivity -> dalvik.system.DexClassLoader[DexPathList[[zip file "/data/user/0/com.able.wisdomtree/files/libs/tdata_poZ536.jar"],nativeLibraryDirectories=[/system/lib64, /system/vendor/lib64]]]
[+] com.able.wisdomtree.loginNew.LoginNewActivity -> dalvik.system.DexClassLoader[DexPathList[[zip file "/data/user/0/com.able.wisdomtree/files/libs/tdata_ePU565.jar"],nativeLibraryDirectories=[/system/lib64, /system/vendor/lib64]]]
[+] com.able.wisdomtree.brushlessons.util.BrushUtil -> dalvik.system.PathClassLoader[DexPathList[[zip file "/system/framework/org.apache.http.legacy.boot.jar", zip file "/data/app/com.able.wisdomtree-rsx6O1emPLh0SooGvdirEw==/base.apk", dex file "/data/data/com.able.wisdomtree/.jiagu/tmp.dex"],nativeLibraryDirectories=[/data/app/com.able.wisdomtree-rsx6O1emPLh0SooGvdirEw==/lib/arm64, /data/app/com.able.wisdomtree-rsx6O1emPLh0SooGvdirEw==/base.apk!/lib/arm64-v8a, /system/lib64, /system/vendor/lib64]]]
[+] com.able.wisdomtree.brushlessons.util.BrushUtil -> dalvik.system.DexClassLoader[DexPathList[[zip file "/data/user/0/com.able.wisdomtree/files/zx-core-3.3.2.25477/classes.jar"],nativeLibraryDirectories=[/system/lib64, /system/vendor/lib64]]]
[+] com.able.wisdomtree.brushlessons.util.BrushUtil -> dalvik.system.DexClassLoader[DexPathList[[zip file "/data/user/0/com.able.wisdomtree/files/libs/tdata_poZ536.jar"],nativeLibraryDirectories=[/system/lib64, /system/vendor/lib64]]]
[+] com.able.wisdomtree.brushlessons.util.BrushUtil -> dalvik.system.DexClassLoader[DexPathList[[zip file "/data/user/0/com.able.wisdomtree/files/libs/tdata_ePU565.jar"],nativeLibraryDirectories=[/system/lib64, /system/vendor/lib64]]]
[+] com.able.wisdomtree.utils.ApiService -> dalvik.system.PathClassLoader[DexPathList[[zip file "/system/framework/org.apache.http.legacy.boot.jar", zip file "/data/app/com.able.wisdomtree-rsx6O1emPLh0SooGvdirEw==/base.apk", dex file "/data/data/com.able.wisdomtree/.jiagu/tmp.dex"],nativeLibraryDirectories=[/data/app/com.able.wisdomtree-rsx6O1emPLh0SooGvdirEw==/lib/arm64, /data/app/com.able.wisdomtree-rsx6O1emPLh0SooGvdirEw==/base.apk!/lib/arm64-v8a, /system/lib64, /system/vendor/lib64]]]
[+] com.able.wisdomtree.utils.ApiService -> dalvik.system.DexClassLoader[DexPathList[[zip file "/data/user/0/com.able.wisdomtree/files/zx-core-3.3.2.25477/classes.jar"],nativeLibraryDirectories=[/system/lib64, /system/vendor/lib64]]]
[+] com.able.wisdomtree.utils.ApiService -> dalvik.system.DexClassLoader[DexPathList[[zip file "/data/user/0/com.able.wisdomtree/files/libs/tdata_poZ536.jar"],nativeLibraryDirectories=[/system/lib64, /system/vendor/lib64]]]
[+] com.able.wisdomtree.utils.ApiService -> dalvik.system.DexClassLoader[DexPathList[[zip file "/data/user/0/com.able.wisdomtree/files/libs/tdata_ePU565.jar"],nativeLibraryDirectories=[/system/lib64, /system/vendor/lib64]]]
4个ClassLoader可以找到同一个类，AI就分析业务dex直接藏在apk里。
然后AI就去dump这个dex，结果发现特么不就是apk里的dex么。。。
又让我绕了一大圈。重新整理思路。
在frida中hook OpenMemory函数以获取dex解密的信息
setImmediate(function() {
var libdexfile = Process.findModuleByName("libdexfile.so");
if (!libdexfile) {
console.log("[-] libdexfile.so not loaded");
return;
}
console.log(" libdexfile base: " + libdexfile.base);
var symbols = libdexfile.enumerateSymbols();
var found = 0;
symbols.forEach(function(sym) {
if (sym.name.indexOf("OpenMemory") !== -1 ||
sym.name.indexOf("OpenCommon") !== -1 ||
sym.name.indexOf("DexFile") !== -1) {
console.log("[+] " + sym.name + " @ " + sym.address);
found++;
}
});
console.log(" total found: " + found);
});
0unique_ptrINS_16DexFileContainerENS3_14default_deleteISG_EEEEb @ 0x763912fce1a0
[+] _ZN3art7DexFileD2Ev @ 0x763912fce780
[+] _ZNK3art14CompactDexFile12IsMagicValidEv @ 0x763912fca960
[+] _ZNK3art14CompactDexFile14IsVersionValidEv @ 0x763912fca970
[+] _ZNK3art14CompactDexFile15GetCodeItemSizeERKNS_7DexFile8CodeItemE @ 0x763912fca990
[+] _ZNK3art14CompactDexFile17CalculateChecksumEv @ 0x763912fcad60
......
AI从这一堆函数中注意到了DexFileLoader::Open函数是加载DEX的入口。
新建脚本hook_dex.js
//hook_dex.js
setImmediate(function() {
var libdexfile = Process.findModuleByName("libdexfile.so");
if (!libdexfile) { console.log("[-] no libdexfile"); return; }
var openFn = new NativeFunction(Module.findGlobalExportByName("open"), 'int', ['pointer', 'int']);
var pread64Fn = new NativeFunction(Module.findGlobalExportByName("pread64"), 'long', ['int', 'pointer', 'ulong', 'uint64']);
var closeFn = new NativeFunction(Module.findGlobalExportByName("close"), 'int', ['int']);
var memPath = Memory.allocUtf8String("/proc/self/mem");
var outDir = "/data/data/com.able.wisdomtree/files/dump/";
var chunkSize = 0x10000;
var count = 0;
libdexfile.enumerateSymbols().forEach(function(sym) {
if (sym.name.indexOf("DexFileLoader4OpenE") === -1 &&
sym.name.indexOf("DexFileLoader10OpenCommon") === -1) return;
count++;
Interceptor.attach(sym.address, {
onEnter: function(args) {
var base = args[1];
var size = args[2].toInt32();
if (size < 0x1000 || size > 30000000) return;
console.log("[Open] base=" + base + " size=" + size);
var fd = openFn(memPath, 0);
if (fd < 0) { console.log("[-] open failed"); return; }
var name = outDir + "mem_" + size + "_" + Date.now() + ".dex";
try {
var f = new File(name, "wb");
} catch (e) {
console.log("[-] file open failed: " + e.message);
closeFn(fd);
return;
}
var offset = 0;
while (offset < size) {
var toRead = Math.min(chunkSize, size - offset);
try {
var buf = Memory.alloc(toRead);
var n = pread64Fn(fd, buf, toRead, uint64(base.add(offset).toString()));
if (n <= 0) { console.log("[-] pread ret=" + n + " @" + offset); break; }
f.write(buf.readByteArray(n));
offset += n;
} catch (e) {
console.log("[-] chunk fail @" + offset + ": " + e.message);
break;
}
}
f.close();
closeFn(fd);
console.log("[+] saved " + name + " (" + offset + "/" + size + ")");
}
});
});
console.log(" total hooks: " + count);
});
并且在加载同时进行hook
frida -U -f com.able.wisdomtree -l bypass.js -l hook_dex.js
该脚本修复了很久，AI给出了很多方法，在日志中提到：
21.要爆炸了，全是权限错误
readByteArray不行
Memory.protect(成功) + readByteArray(失败)不行
syscall process_vm_readv不行
memcpy不行
Process.findRangeByAddress不行
22.AI给出的解释是:Process.enumerateRanges不在frida能枚举的范围之内，pread64走内核read路径，不查用户态maps
该处给的是最终脚本，执行后
[+] saved /data/data/com.able.wisdomtree/files/dump/mem_8339560_1789865030378.dex (8339560/8339560)
[Open] base=0x763854aaa000 size=3634252
[+] saved /data/data/com.able.wisdomtree/files/dump/mem_3634252_1789865030408.dex (3634252/3634252)
[Open] base=0x7638563ef000 size=2163588
[+] saved /data/data/com.able.wisdomtree/files/dump/mem_2163588_1789865030421.dex (2163588/2163588)
[Open] base=0x763851187000 size=3026300
[+] saved /data/data/com.able.wisdomtree/files/dump/mem_3026300_1789865030429.dex (3026300/3026300)
[Open] base=0x76388c6c0000 size=110276
[+] saved /data/data/com.able.wisdomtree/files/dump/mem_110276_1789865030443.dex (110276/110276)
[Open] base=0x76385b291000 size=165956
[+] saved /data/data/com.able.wisdomtree/files/dump/mem_165956_1789865031173.dex (165956/165956)
[Open] base=0x76385b245028 size=29376
[+] saved /data/data/com.able.wisdomtree/files/dump/mem_29376_1789865031263.dex (29376/29376)
[Open] base=0x76384641e028 size=169136
[+] saved /data/data/com.able.wisdomtree/files/dump/mem_169136_1789865034977.dex (169136/169136)
[Open] base=0x7638462ac028 size=51888
[+] saved /data/data/com.able.wisdomtree/files/dump/mem_51888_1789865035025.dex (51888/51888)
再使用adb一键pull出来并导入进jadx
可以在里面找到真正的业务代码，至此，分析完毕。
写在后面
说实话，AI完成了大部分工作。
就连网页端的deepseek也可以做到如此地步。
很难想象专业的付费AI能够如何惊艳我。
不过之所以选取免费AI：
一是能够学到更多知识，对整个流程的把握是清晰的，整个过程有很强的参与感。
二是很经济。
我知道这实际上算不上什么。
AI告诉我更高级的版本还有VMP以及其他更难分析的加固技术。
但实际上这也是我当下能力的极限了。
大致熟悉了一下，如何使用frida脱壳。
在这之前，frida的学习成本较高，AI在这里帮了大忙。
本次分析没几乎没有涉及任何动态调试相关的。
也没有涉及防止frida附加之类的。
总之就是一切顺利地不可思议？
我也应该好好复盘一下，学习一下其中的原理，以及AI为什么会能够直接暴力进行破解。
综上，感谢您的参与。
后面附上一些工作文件截图。
发表于 2026-9-21 18:39
发表于 2026-9-24 10:10
