官方bilibiliWindows破解入门Android逆向入门
【网络诊断修复工具】切换到窄版

吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn

 找回密码
 注册[Register]

QQ登录

只需一步，快速开始

吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn»网站 › 【 软件安全 】 › 『移动安全区』 › 乐淘淘企业版过红红的签名
12下一页
返回列表 发新帖
查看: 3231|回复: 13
收起左侧

[Android 原创] 乐淘淘企业版过红红的签名

[复制链接]
冥界3大法王
冥界3大法王 发表于 2020-9-3 14:52
本帖最后由 冥界3大法王 于 2020-9-4 12:22 编辑

image.png
我就随便修改了下，就出来个这东东
困扰了好久不知如何去搞
于是论坛涛之雨大神就给我发了个MHT的存档 《一触即发之：手过签名（非一键）》
于是我就一个字一个字的，一行一行的慢慢研究。
image.png
搜索下这个
image.png
大神经常说，先优先看看包名的，当然就是图中红圈圈所示地方了，随便点一个过去

[Asm] 纯文本查看 复制代码
method private d()Ljava/lang/String;
    .registers 5

    .prologue
    const/4 v1, 0x0

    .line 54
    invoke-static {}, Lcom/hpplay/happyplay/ent/util/p;->k()Landroid/content/Context;

    move-result-object v0

    invoke-virtual {v0}, Landroid/content/Context;->getPackageManager()Landroid/content/pm/PackageManager;

    move-result-object v0

    .line 58
    invoke-static {}, Lcom/hpplay/happyplay/ent/util/p;->k()Landroid/content/Context;

    move-result-object v2

    invoke-virtual {v2}, Landroid/content/Context;->getPackageName()Ljava/lang/String;

    move-result-object v2

    .line 61
    const/16 v3, 0x40

    .line 67
    :try_start_13
    invoke-virtual {v0, v2, v3}, Landroid/content/pm/PackageManager;->getPackageInfo(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;
    :try_end_16
    .catch Landroid/content/pm/PackageManager$NameNotFoundException; {:try_start_13 .. :try_end_16} :catch_25

    move-result-object v0

    .line 72
    :goto_17
    if-eqz v0, :cond_22

    iget-object v2, v0, Landroid/content/pm/PackageInfo;->signatures:[Landroid/content/pm/Signature;  先来到这里

    if-eqz v2, :cond_22

    iget-object v2, v0, Landroid/content/pm/PackageInfo;->signatures:[Landroid/content/pm/Signature;

    array-length v2, v2

    if-nez v2, :cond_2d

    .line 73
    :cond_22
    const-string v0, ""

    .line 126
    :goto_24
    return-object v0

    .line 68
    :catch_25
    move-exception v0

    .line 69
    const-string v2, "SignCheckTool"

    invoke-static {v2, v0}, Lcom/hpplay/happyplay/ent/util/i;->b(Ljava/lang/String;Ljava/lang/Throwable;)V

    move-object v0, v1

    goto :goto_17

    .line 77
    :cond_2d
    iget-object v0, v0, Landroid/content/pm/PackageInfo;->signatures:[Landroid/content/pm/Signature;

    .line 78
    const/4 v2, 0x0

    aget-object v0, v0, v2

    invoke-virtual {v0}, Landroid/content/pm/Signature;->toByteArray()[B

    move-result-object v0

    .line 81
    new-instance v2, Ljava/io/ByteArrayInputStream;

    invoke-direct {v2, v0}, Ljava/io/ByteArrayInputStream;-><init>([B)V

    .line 87
    :try_start_3b
    const-string v0, "X509"

    invoke-static {v0}, Ljava/security/cert/CertificateFactory;->getInstance(Ljava/lang/String;)Ljava/security/cert/CertificateFactory;
    :try_end_40
    .catch Ljava/lang/Exception; {:try_start_3b .. :try_end_40} :catch_46

    move-result-object v0

    .line 92
    :goto_41
    if-nez v0, :cond_4e

    .line 93
    const-string v0, ""

    goto :goto_24

    .line 88
    :catch_46
    move-exception v0

    .line 89
    const-string v3, "SignCheckTool"

    invoke-static {v3, v0}, Lcom/hpplay/happyplay/ent/util/i;->b(Ljava/lang/String;Ljava/lang/Throwable;)V

    move-object v0, v1

    goto :goto_41

    .line 100
    :cond_4e
    :try_start_4e
    invoke-virtual {v0, v2}, Ljava/security/cert/CertificateFactory;->generateCertificate(Ljava/io/InputStream;)Ljava/security/cert/Certificate;

    move-result-object v0

    check-cast v0, Ljava/security/cert/X509Certificate;
    :try_end_54
    .catch Ljava/lang/Exception; {:try_start_4e .. :try_end_54} :catch_59

    .line 105
    :goto_54
    if-nez v0, :cond_61

    .line 106
    const-string v0, ""

    goto :goto_24

    .line 101
    :catch_59
    move-exception v0

    .line 102
    const-string v2, "SignCheckTool"

    invoke-static {v2, v0}, Lcom/hpplay/happyplay/ent/util/i;->b(Ljava/lang/String;Ljava/lang/Throwable;)V

    move-object v0, v1

    goto :goto_54

    .line 113
    :cond_61
    :try_start_61
    const-string v2, "SHA1"

    invoke-static {v2}, Ljava/security/MessageDigest;->getInstance(Ljava/lang/String;)Ljava/security/MessageDigest;

    move-result-object v2

    .line 116
    invoke-virtual {v0}, Ljava/security/cert/X509Certificate;->getEncoded()[B

    move-result-object v0

    invoke-virtual {v2, v0}, Ljava/security/MessageDigest;->digest([B)[B

    move-result-object v0

    .line 119
    invoke-direct {p0, v0}, Lcom/hpplay/happyplay/ent/util/l;->a([B)Ljava/lang/String;
    :try_end_72
    .catch Ljava/security/NoSuchAlgorithmException; {:try_start_61 .. :try_end_72} :catch_74
    .catch Ljava/security/cert/CertificateEncodingException; {:try_start_61 .. :try_end_72} :catch_7c

    move-result-object v0

    goto :goto_24

    .line 121
    :catch_74
    move-exception v0

    .line 122
    const-string v2, "SignCheckTool"

    invoke-static {v2, v0}, Lcom/hpplay/happyplay/ent/util/i;->b(Ljava/lang/String;Ljava/lang/Throwable;)V

    move-object v0, v1

转成 java看一下
[Java] 纯文本查看 复制代码
method private d()Ljava/lang/String;
    .registers 5

    .prologue
    const/4 v1, 0x0

    .line 54
    invoke-static {}, Lcom/hpplay/happyplay/ent/util/p;->k()Landroid/content/Context;

    move-result-object v0

    invoke-virtual {v0}, Landroid/content/Context;->getPackageManager()Landroid/content/pm/PackageManager;

    move-result-object v0

    .line 58
    invoke-static {}, Lcom/hpplay/happyplay/ent/util/p;->k()Landroid/content/Context;

    move-result-object v2

    invoke-virtual {v2}, Landroid/content/Context;->getPackageName()Ljava/lang/String;

    move-result-object v2

    .line 61
    const/16 v3, 0x40

    .line 67
    :try_start_13
    invoke-virtual {v0, v2, v3}, Landroid/content/pm/PackageManager;->getPackageInfo(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;
    :try_end_16
    .catch Landroid/content/pm/PackageManager$NameNotFoundException; {:try_start_13 .. :try_end_16} :catch_25

    move-result-object v0

    .line 72
    :goto_17
    if-eqz v0, :cond_22

    iget-object v2, v0, Landroid/content/pm/PackageInfo;->signatures:[Landroid/content/pm/Signature;

    if-eqz v2, :cond_22

    iget-object v2, v0, Landroid/content/pm/PackageInfo;->signatures:[Landroid/content/pm/Signature;

    array-length v2, v2

    if-nez v2, :cond_2d

    .line 73
    :cond_22
    const-string v0, ""

    .line 126
    :goto_24
    return-object v0

    .line 68
    :catch_25
    move-exception v0

    .line 69
    const-string v2, "SignCheckTool"

    invoke-static {v2, v0}, Lcom/hpplay/happyplay/ent/util/i;->b(Ljava/lang/String;Ljava/lang/Throwable;)V

    move-object v0, v1

    goto :goto_17

    .line 77
    :cond_2d
    iget-object v0, v0, Landroid/content/pm/PackageInfo;->signatures:[Landroid/content/pm/Signature;

    .line 78
    const/4 v2, 0x0

    aget-object v0, v0, v2

    invoke-virtual {v0}, Landroid/content/pm/Signature;->toByteArray()[B

    move-result-object v0

    .line 81
    new-instance v2, Ljava/io/ByteArrayInputStream;

    invoke-direct {v2, v0}, Ljava/io/ByteArrayInputStream;-><init>([B)V

    .line 87
    :try_start_3b
    const-string v0, "X509"

    invoke-static {v0}, Ljava/security/cert/CertificateFactory;->getInstance(Ljava/lang/String;)Ljava/security/cert/CertificateFactory;
    :try_end_40
    .catch Ljava/lang/Exception; {:try_start_3b .. :try_end_40} :catch_46

    move-result-object v0

    .line 92
    :goto_41
    if-nez v0, :cond_4e

    .line 93
    const-string v0, ""

    goto :goto_24

    .line 88
    :catch_46
    move-exception v0

    .line 89
    const-string v3, "SignCheckTool"

    invoke-static {v3, v0}, Lcom/hpplay/happyplay/ent/util/i;->b(Ljava/lang/String;Ljava/lang/Throwable;)V

    move-object v0, v1

    goto :goto_41

    .line 100
    :cond_4e
    :try_start_4e
    invoke-virtual {v0, v2}, Ljava/security/cert/CertificateFactory;->generateCertificate(Ljava/io/InputStream;)Ljava/security/cert/Certificate;

    move-result-object v0

    check-cast v0, Ljava/security/cert/X509Certificate;
    :try_end_54
    .catch Ljava/lang/Exception; {:try_start_4e .. :try_end_54} :catch_59

    .line 105
    :goto_54
    if-nez v0, :cond_61

    .line 106
    const-string v0, ""

    goto :goto_24

    .line 101
    :catch_59
    move-exception v0

    .line 102
    const-string v2, "SignCheckTool"

    invoke-static {v2, v0}, Lcom/hpplay/happyplay/ent/util/i;->b(Ljava/lang/String;Ljava/lang/Throwable;)V

    move-object v0, v1

    goto :goto_54

    .line 113
    :cond_61
    :try_start_61
    const-string v2, "SHA1"

    invoke-static {v2}, Ljava/security/MessageDigest;->getInstance(Ljava/lang/String;)Ljava/security/MessageDigest;

    move-result-object v2

    .line 116
    invoke-virtual {v0}, Ljava/security/cert/X509Certificate;->getEncoded()[B

    move-result-object v0

    invoke-virtual {v2, v0}, Ljava/security/MessageDigest;->digest([B)[B

    move-result-object v0

    .line 119
    invoke-direct {p0, v0}, Lcom/hpplay/happyplay/ent/util/l;->a([B)Ljava/lang/String;
    :try_end_72
    .catch Ljava/security/NoSuchAlgorithmException; {:try_start_61 .. :try_end_72} :catch_74
    .catch Ljava/security/cert/CertificateEncodingException; {:try_start_61 .. :try_end_72} :catch_7c

    move-result-object v0

    goto :goto_24

    .line 121
    :catch_74
    move-exception v0

    .line 122
    const-string v2, "SignCheckTool"

    invoke-static {v2, v0}, Lcom/hpplay/happyplay/ent/util/i;->b(Ljava/lang/String;Ljava/lang/Throwable;)V

    move-object v0, v1

我去，满眼全是 SignCheckTool ，我眼都花了。
再往下一段看
[Asm] 纯文本查看 复制代码
.method public b()Z
    .registers 5

    .prologue
    const/4 v0, 0x1

    .line 152
    iget-object v1, p0, Lcom/hpplay/happyplay/ent/util/l;->d:Ljava/lang/String;     这里发现1个d: 我就想是不是这里调用上一段呢？

    invoke-static {v1}, Landroid/text/TextUtils;->isEmpty(Ljava/lang/CharSequence;)Z

    move-result v1

    if-nez v1, :cond_36

    .line 153
    iget-object v1, p0, Lcom/hpplay/happyplay/ent/util/l;->d:Ljava/lang/String;

    invoke-virtual {v1}, Ljava/lang/String;->trim()Ljava/lang/String;

    move-result-object v1

    iput-object v1, p0, Lcom/hpplay/happyplay/ent/util/l;->d:Ljava/lang/String;

    .line 154
    iget-object v1, p0, Lcom/hpplay/happyplay/ent/util/l;->d:Ljava/lang/String;

    const-string v2, "EC:72:2B:2E:41:17:24:ED:5C:7C:A5:28:E8:67:2C:D1:1C:33:72:A8"

    invoke-virtual {v1, v2}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z

    move-result v1

    if-eqz v1, :cond_1c

    .line 166
    :cond_1b
    :goto_1b
    return v0

    .line 157
    :cond_1c
    const-string v1, "SignCheckTool"

    new-instance v2, Ljava/lang/StringBuilder;

    invoke-direct {v2}, Ljava/lang/StringBuilder;-><init>()V

    const-string v3, "cer: "

    invoke-virtual {v2, v3}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v2

    iget-object v3, p0, Lcom/hpplay/happyplay/ent/util/l;->d:Ljava/lang/String;

    invoke-virtual {v2, v3}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v2

    invoke-virtual {v2}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v2

    invoke-static {v1, v2}, Lcom/hpplay/happyplay/ent/util/i;->f(Ljava/lang/String;Ljava/lang/String;)V

    .line 160
    :cond_36
    invoke-static {}, Lcom/hpplay/happyplay/ent/util/m;->m()Z

    move-result v1

    if-nez v1, :cond_1b

    .line 166
    const/4 v0, 0x0

    goto :goto_1b
.end method
再转java看一下

[Java] 纯文本查看 复制代码
    public boolean b() {
        if (!TextUtils.isEmpty(this.d)) {
            this.d = this.d.trim();
            if (this.d.equals("EC:72:2B:2E:41:17:24:ED:5C:7C:A5:28:E8:67:2C:D1:1C:33:72:A8")) {
                return true;
            }
            i.f("SignCheckTool", "cer: " + this.d);
        }
        if (!m.m()) {
            return false;      这有一个返回假
        }
        return true;       这有一个返回真
    }
}


无论如何，程序都会执行到
:goto_1b
========《=====我在这里加上一句const v0, 1会不会成功呢？
return v0
image.png
最终革命胜利了。为今后的过签名检测提高了信心和折腾动力。

免费评分

参与人数 1吾爱币 +1 收起 理由
caowei1 + 1 我很赞同！

查看全部评分

本帖被以下淘专辑推荐:

发帖前要善用【论坛搜索】功能，那里可能会有你要找的答案或者已经有人发布过相同内容了，请勿重复发帖。
回复

举报

芽衣
芽衣 发表于 2020-9-3 21:30
本帖最后由 417788939 于 2020-9-4 09:19 编辑

这跟我之前发的几个过签名校验一样的套路。

const-string v2, "EC:72:2B:2E:41:17:24:ED:5C:7C:A5:28:E8:67:2C:D1:1C:33:72:A8"

这明显就是签名的MD5值，还有对比字符串的代码。直接把这串改成你的签名MD5，如果别人二改了就会报红字

补：是SHA1。之前我发的帖子是md5。用开发助手可以看签名值。

点评

涛之雨
口误吧？上一段清清楚楚的写了SHA1。。。  发表于 2020-9-4 09:13
【吾爱破解论坛总版规】 - [让你充分了解吾爱破解论坛行为规则]
回复 支持 2

举报

涛之雨
涛之雨 发表于 2020-9-3 16:29
吾爱破解论坛没有任何官方QQ群，禁止留联系方式，禁止任何商业交易。
话说我喜欢在0后面直接加上1
[Java] 纯文本查看 复制代码
    const/4 v0, 0x01
 
    goto :goto_1b
.end method
如何升级？如何获得积分？积分对应解释说明！
回复 支持

举报

heelihua
heelihua 发表于 2020-9-3 16:36
《站点帮助文档》有什么问题来这里看看吧，这里有你想知道的内容！
楼主是个小姐姐这么厉害……。
呼吁大家发布原创作品添加吾爱破解论坛标识！
回复 支持

举报

弗由
弗由 发表于 2020-9-3 16:45
动手能力真强。
如何快速判断一个文件是否为病毒！
回复 支持

举报

冥界3大法王
 楼主| 冥界3大法王 发表于 2020-9-3 16:58
涛之雨 发表于 2020-9-3 16:29
话说我喜欢在0后面直接加上1
[mw_shl_code=java,true]    const/4 v0, 0x01

沙发总能找到简单高效解决方法
回复 支持

举报

TopGreat
TopGreat 发表于 2020-9-3 20:25
java层的直接转成java代码，肉眼可见。
回复 支持

举报

19183311119
19183311119 发表于 2020-9-3 20:55
真是高手阿
回复 支持

举报

xyz星人
xyz星人 发表于 2020-9-4 00:06
这可真是太辛苦了！
回复 支持

举报

北辰没有林安
北辰没有林安 发表于 2020-9-4 00:35
是什么企业版
回复 支持

举报

下一页 »
12下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 注册[Register]

本版积分规则 警告：本版块禁止灌水或回复与主题无关内容，违者重罚！


免责声明：
吾爱破解所发布的一切破解补丁、注册机和注册信息及软件的解密分析文章仅限用于学习和研究目的；不得将上述内容用于商业或者非法用途，否则，一切后果请用户自负。本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑中彻底删除上述内容。如果您喜欢该程序，请支持正版软件，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。

Mail To:Service@52pojie.cn

快速回复 收藏帖子 返回列表 搜索

RSS订阅|小黑屋|处罚记录|联系我们|吾爱破解 - LCG - LSG ( 京ICP备16042023号 | 京公网安备 11010502030087号 )

GMT+8, 2024-4-18 12:47

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表