• APP逆向案例之（一）过 app 更新提示

    案例：某APP打开时提示更新

     思路：想这是查壳看看有没有加壳，没有就去反编译按照提示搜索下，结果却是没有加壳反编译了下搜索，搜索不到，后来想到是不是网络传过来的，那这样是不是就要先获取本身APP的版本号，然后传输后发现版本过低发送过来这么一句话弹出个窗口，想到这里我就去抓了个包看看是不是确实有也确实传输了信息，所以我下了他们最新版本的APP看了下版本，对比了下去把旧版本里面涉及到版本地方全部改成和新版本一样，从新编译打包安装想着你就是那这些对比的我给了最新的版本号不该提示了吧，打开发现还是会提示晕了，没办法搜索有搜索不了看源代码一点点找如大海捞针。

    唯一的线索就是这个弹窗了从一个开发者角度去想问题，这个弹窗用了安卓那个弹窗的类，那就hook去吧，先利用objection 内存搜索以加载类看看用了那个弹窗类。

    objection -g com.xx.xx.xx explore (注入)

    android heap search instances android.app.AlertDialog （存在）

     最后确定有这个 AlertDialog 那就去hook这个类吧

    android hooking watch class android.app.AlertDialog

     这个读取顺序是从下往上，所以看到了 on.Create 走喽去创建他的地方看一看，由于啊她这个是一开APP就显示了所以要以swpan注入

    直接用objection：objection -g com.xxx.xxx explore -s "android hooking watch class_method android.app.AlertDialog.onCreate --dump-args --dump-backtrace --dump-return"

     前3个都是弹窗类的实现看着也不太像 我们直接从NativeUIFeatureImpl.a 开始看

    objection -g com.xxx.xxx explore -s "android hooking watch class_method io.dcloud.feature.ui.nativeui.NativeUIFeatureImpl.a --dump-args --dump-backtrace --dump-return"

     哦吼出来了，去反编译看看源码 有兴趣的自己看下 反正就是说 第一个switch 判断到了 str.equals("alert") 这个去给执行了这个 c2 = '\r'; ，然后 第二个switch 又判断了c2 = ‘\r’ 去调用方法a：a((byte) 0, JSONUtil.getString(createJSONArray, 2), null, JSONUtil.getString(createJSONArray, 0), new String[]{JSONUtil.getString(createJSONArray, 3)}, null, iWebview, JSONUtil.getString(createJSONArray, 1));

    看了看 a 方法里面是坐窗口创建展示文字的，具体的就不展示了，接下来你可以 hook 这个 execute 方法判断 str 等不等于 alert 然后嘛嘿嘿不用不说了，当然这里也有可能其他地方用到，你可以再往下追到 a 方法我看了看他也有个大判断 判断参数里面那个数字 是几操作哪里，也可以从这里做。

    1. public String execute(IWebview iWebview, String str, String[] strArr) {
    2.     char c2;
    3.     String[] strArr2;
    4.  
    5.     boolean z;
    6.     IActivityHandler iActivityHandler;
    7.  
    8.     String optString;
    9.     c cVar;
    10.  
    11.     String[] strArr3;
    12.  
    13.     IActivityHandler iActivityHandler2;
    14.  
    15.     a remove;
    16.  
    17.     c remove2;
    18.  
    19.     IApp obtainApp = iWebview.obtainApp();
    20.  
    21.     int i2 = 0;
    22.  
    23.     String str2 = strArr.length >= 1 ? strArr[0] : null;
    24.  
    25.     JSONArray createJSONArray = strArr.length >= 2 ? JSONUtil.createJSONArray(strArr[1]) : null;
    26.  
    27.     str.hashCode();
    28.     
    29.     switch (str.hashCode()) {
    30.         case -2071870705:
    31.             if (str.equals("closeToast")) {
    32.                 c2 = 0;
    33.                 break;
    34.             }
    35.             c2 = 65535;
    36.             break;
    37.         case -1774127679:
    38.             if (str.equals("hideMenu")) {
    39.                 c2 = 1;
    40.                 break;
    41.             }
    42.             c2 = 65535;
    43.             break;
    44.         case -1727401845:
    45.             if (str.equals("closePreviewImage")) {
    46.                 c2 = 2;
    47.                 break;
    48.             }
    49.             c2 = 65535;
    50.             break;
    51.         case -1383206285:
    52.             if (str.equals("previewImage")) {
    53.                 c2 = 3;
    54.                 break;
    55.             }
    56.             c2 = 65535;
    57.             break;
    58.         case -1055312317:
    59.             if (str.equals("WaitingView_setTitle")) {
    60.                 c2 = 4;
    61.                 break;
    62.             }
    63.             c2 = 65535;
    64.             break;
    65.         case -979805852:
    66.             if (str.equals("prompt")) {
    67.                 c2 = 5;
    68.                 break;
    69.             }
    70.             c2 = 65535;
    71.             break;
    72.         case -739906705:
    73.             if (str.equals("pickDate")) {
    74.                 c2 = 6;
    75.                 break;
    76.             }
    77.             c2 = 65535;
    78.             break;
    79.         case -739422578:
    80.             if (str.equals("pickTime")) {
    81.                 c2 = 7;
    82.                 break;
    83.             }
    84.             c2 = 65535;
    85.             break;
    86.         case -339042820:
    87.             if (str.equals("showMenu")) {
    88.                 c2 = '\b';
    89.                 break;
    90.             }
    91.             c2 = 65535;
    92.             break;
    93.         case -228775627:
    94.             if (str.equals("closeWaiting")) {
    95.                 c2 = '\t';
    96.                 break;
    97.             }
    98.             c2 = 65535;
    99.             break;
    100.         case -160355144:
    101.             if (str.equals("getTitlebarHeight")) {
    102.                 c2 = '\n';
    103.                 break;
    104.             }
    105.             c2 = 65535;
    106.             break;
    107.         case -92053387:
    108.             if (str.equals("setTitlebarVisible")) {
    109.                 c2 = 11;
    110.                 break;
    111.             }
    112.             c2 = 65535;
    113.             break;
    114.         case -49471494:
    115.             if (str.equals("_NativeObj_close")) {
    116.                 c2 = '\f';
    117.                 break;
    118.             }
    119.             c2 = 65535;
    120.             break;
    121.         case 92899676:
    122.             if (str.equals("alert")) {
    123.                 c2 = '\r';
    124.                 break;
    125.             }
    126.             c2 = 65535;
    127.             break;
    128.         case 110532135:
    129.             if (str.equals("toast")) {
    130.                 c2 = 14;
    131.                 break;
    132.             }
    133.             c2 = 65535;
    134.             break;
    135.         case 235955885:
    136.             if (str.equals("isTitlebarVisible")) {
    137.                 c2 = 15;
    138.                 break;
    139.             }
    140.             c2 = 65535;
    141.             break;
    142.         case 951117504:
    143.             if (str.equals("confirm")) {
    144.                 c2 = 16;
    145.                 break;
    146.             }
    147.             c2 = 65535;
    148.             break;
    149.         case 988815851:
    150.             if (str.equals("WaitingView_close")) {
    151.                 c2 = 17;
    152.                 break;
    153.             }
    154.             c2 = 65535;
    155.             break;
    156.         case 1572298953:
    157.             if (str.equals("actionSheet")) {
    158.                 c2 = 18;
    159.                 break;
    160.             }
    161.             c2 = 65535;
    162.             break;
    163.         case 2141060722:
    164.             if (str.equals("WaitingView")) {
    165.                 c2 = 19;
    166.                 break;
    167.             }
    168.             c2 = 65535;
    169.             break;
    170.         default:
    171.             c2 = 65535;
    172.             break;
    173.     }
    174.     switch (c2) {
    175.         case 0:
    176.             b.a(obtainApp.obtainAppId());
    177.             break;
    178.         case 1:
    179.             PlatformUtil.invokeMethod("io.dcloud.appstream.actionbar.StreamAppActionBarUtil", "hideMenu", null, new Class[]{Activity.class, String.class}, new Object[]{iWebview.getActivity(), iWebview.obtainApp().obtainAppId()});
    180.             if (!(iWebview == null || iWebview.getActivity() == null || (iActivityHandler = DCloudAdapterUtil.getIActivityHandler(iWebview.getActivity())) == null)) {
    181.                 iActivityHandler.sideBarHideMenu();
    182.                 break;
    183.             }
    184.             break;
    185.         case 2:
    186.             Activity activity = RuningAcitvityUtil.getActivity("io.dcloud.feature.nativeObj.photoview.PhotoActivity");
    187.             if (activity != null) {
    188.                 activity.onBackPressed();
    189.                 break;
    190.             }
    191.             break;
    192.         case 3:
    193.             JSONArray jSONArray = JSONUtil.getJSONArray(createJSONArray, 0);
    194.             JSONObject jSONObject = JSONUtil.getJSONObject(createJSONArray, 1);
    195.             if (jSONArray != null) {
    196.                 ArrayList arrayList = new ArrayList();
    197.                 ArrayList arrayList2 = new ArrayList();
    198.                 for (int i3 = 0; i3 < jSONArray.length(); i3++) {
    199.                     try {
    200.                         String string = jSONArray.getString(i3);
    201.                         arrayList.add(!PdrUtil.isNetPath(string) ? iWebview.obtainApp().convert2AbsFullPath(iWebview.obtainFullUrl(), string) : string);
    202.                         arrayList2.add(string);
    203.                     } catch (JSONException e2) {
    204.                         e2.printStackTrace();
    205.                     }
    206.                 }
    207.                 Intent intent = new Intent();
    208.                 intent.setClassName(obtainApp.getActivity().getPackageName(), "io.dcloud.feature.nativeObj.photoview.PhotoActivity");
    209.                 intent.putExtra("image_urlList", arrayList);
    210.                 intent.putExtra("original_image_urlArray", arrayList2);
    211.                 if (jSONObject != null) {
    212.                     intent.putExtra("image_current_index", jSONObject.optInt("current", 0));
    213.                     if (jSONObject.has("background")) {
    214.                         intent.putExtra("image_backgroud_color", PdrUtil.stringToColor(jSONObject.optString("background")));
    215.                     }
    216.                     if (jSONObject.has("loop")) {
    217.                         intent.putExtra("image_loop", jSONObject.optBoolean("loop"));
    218.                     }
    219.                     if (jSONObject.has(WXBasicComponentType.INDICATOR)) {
    220.                         intent.putExtra("image_indicator", jSONObject.optString(WXBasicComponentType.INDICATOR));
    221.                     }
    222.                 }
    223.                 intent.putExtra("image_photo", true);
    224.                 if (!(createJSONArray == null || createJSONArray.length() <= 2 || (optString = createJSONArray.optString(2)) == null)) {
    225.                     intent.putExtra("preview_callback", optString);
    226.                     LongClickEventManager.getInstance().addOnlongClickListener(optString, new c(this, iWebview, optString));
    227.                 }
    228.                 intent.putExtra("screen_orientation", obtainApp.getRequestedOrientation());
    229.                 obtainApp.getActivity().startActivity(intent);
    230.                 obtainApp.getActivity().overridePendingTransition(17432576, 17432577);
    231.                 break;
    232.             }
    233.             break;
    234.         case 4:
    235.             HashMap hashMap = this.a;
    236.             if (!(hashMap == null || (cVar = hashMap.get(str2)) == null)) {
    237.                 cVar.b(JSONUtil.getString(createJSONArray, 0));
    238.                 break;
    239.             }
    240.             break;
    241.         case 5:
    242.             String string2 = JSONUtil.getString(createJSONArray, 0);
    243.             String string3 = JSONUtil.getString(createJSONArray, 1);
    244.             String string4 = JSONUtil.getString(createJSONArray, 2);
    245.             String string5 = JSONUtil.getString(createJSONArray, 3);
    246.             JSONArray jSONArray2 = JSONUtil.getJSONArray(createJSONArray, 4);
    247.             if (jSONArray2 != null) {
    248.                 int length = jSONArray2.length();
    249.                 String[] strArr4 = new String[length];
    250.                 while (i2 < length) {
    251.                     strArr4[i2] = JSONUtil.getString(jSONArray2, i2);
    252.                     i2++;
    253.                 }
    254.                 strArr3 = strArr4;
    255.             } else {
    256.                 strArr3 = null;
    257.             }
    258.             a((byte) 2, string4, null, string2, strArr3, string5, iWebview, string3);
    259.             break;
    260.         case 6:
    261.             a(iWebview, JSONUtil.getString(createJSONArray, 0), JSONUtil.getJSONObject(createJSONArray, 1));
    262.             break;
    263.         case 7:
    264.             b(iWebview, JSONUtil.getString(createJSONArray, 0), JSONUtil.getJSONObject(createJSONArray, 1));
    265.             break;
    266.         case '\b':
    267.             PlatformUtil.invokeMethod("io.dcloud.appstream.actionbar.StreamAppActionBarUtil", "showMenu", null, new Class[]{Activity.class, String.class, String.class, String.class, IWebview.class, String.class}, new Object[]{iWebview.getActivity(), iWebview.obtainApp().obtainAppId(), JSONUtil.getString(createJSONArray, 0), JSONUtil.getString(createJSONArray, 1), iWebview, JSONUtil.getString(createJSONArray, 2)});
    268.             if (!(iWebview == null || iWebview.getActivity() == null || (iActivityHandler2 = DCloudAdapterUtil.getIActivityHandler(iWebview.getActivity())) == null)) {
    269.                 iActivityHandler2.sideBarShowMenu(JSONUtil.getString(createJSONArray, 0), JSONUtil.getString(createJSONArray, 1), iWebview, JSONUtil.getString(createJSONArray, 2));
    270.                 break;
    271.             }
    272.             break;
    273.         case '\t':
    274.             HashMap hashMap2 = this.a;
    275.             if (hashMap2 != null) {
    276.                 for (c cVar2 : hashMap2.values()) {
    277.                     cVar2.a();
    278.                 }
    279.                 this.a.clear();
    280.                 break;
    281.             }
    282.             break;
    283.         case '\n':
    284.             Object invokeMethod = PlatformUtil.invokeMethod("io.dcloud.appstream.actionbar.StreamAppActionBarUtil", "getTitlebarHeight", null, new Class[]{Activity.class}, new Object[]{iWebview.getActivity()});
    285.             return Deprecated_JSUtil.wrapJsVar(String.valueOf(invokeMethod instanceof Integer ? Integer.valueOf(invokeMethod.toString()).intValue() : 0), false);
    286.         case 11:
    287.             try {
    288.                 z = createJSONArray.getBoolean(0);
    289.             } catch (Exception e3) {
    290.                 e3.printStackTrace();
    291.                 z = true;
    292.             }
    293.             PlatformUtil.invokeMethod("io.dcloud.appstream.actionbar.StreamAppActionBarUtil", "setTitlebarVisible", null, new Class[]{Activity.class, String.class, Boolean.TYPE}, new Object[]{iWebview.getActivity(), iWebview.obtainApp().obtainAppId(), Boolean.valueOf(z)});
    294.             return null;
    295.         case '\f':
    296.             HashMap hashMap3 = this.b;
    297.             if (!(hashMap3 == null || (remove = hashMap3.remove(str2)) == null)) {
    298.                 remove.a(-1);
    299.                 remove.b.onItemClick(-1);
    300.                 break;
    301.             }
    302.             break;
    303.         case '\r':
    304.             a((byte) 0, JSONUtil.getString(createJSONArray, 2), null, JSONUtil.getString(createJSONArray, 0), new String[]{JSONUtil.getString(createJSONArray, 3)}, null, iWebview, JSONUtil.getString(createJSONArray, 1));
    305.             break;
    306.         case 14:
    307.             a(obtainApp, iWebview, JSONUtil.getString(createJSONArray, 0), JSONUtil.getJSONObject(createJSONArray, 1));
    308.             break;
    309.         case 15:
    310.             Object invokeMethod2 = PlatformUtil.invokeMethod("io.dcloud.appstream.actionbar.StreamAppActionBarUtil", "isTitlebarVisible", null, new Class[]{Activity.class, String.class}, new Object[]{iWebview.getActivity(), iWebview.obtainApp().obtainAppId()});
    311.             return Deprecated_JSUtil.wrapJsVar(String.valueOf(invokeMethod2 instanceof Boolean ? Boolean.valueOf(invokeMethod2.toString()).booleanValue() : false), false);
    312.         case 16:
    313.             try {
    314.                 String string6 = JSONUtil.getString(createJSONArray, 0);
    315.                 String string7 = JSONUtil.getString(createJSONArray, 1);
    316.                 Object obj = createJSONArray.get(2);
    317.                 if (!(obj instanceof JSONObject)) {
    318.                     if (obj instanceof String) {
    319.                         String str3 = (String) obj;
    320.                         JSONArray jSONArray3 = JSONUtil.getJSONArray(createJSONArray, 3);
    321.                         if (jSONArray3 != null) {
    322.                             int length2 = jSONArray3.length();
    323.                             String[] strArr5 = new String[length2];
    324.                             while (i2 < length2) {
    325.                                 strArr5[i2] = JSONUtil.getString(jSONArray3, i2);
    326.                                 i2++;
    327.                             }
    328.                             strArr2 = strArr5;
    329.                         } else {
    330.                             strArr2 = null;
    331.                         }
    332.                         a((byte) 1, str3, null, string6, strArr2, null, iWebview, string7);
    333.                         break;
    334.                     } else {
    335.                         a((byte) 1, null, null, string6, null, null, iWebview, string7);
    336.                         break;
    337.                     }
    338.                 } else {
    339.                     a((byte) 1, string6, (JSONObject) obj, iWebview, string7);
    340.                     break;
    341.                 }
    342.             } catch (JSONException e4) {
    343.                 e4.printStackTrace();
    344.                 break;
    345.             }
    346.         case 17:
    347.             HashMap hashMap4 = this.a;
    348.             if (!(hashMap4 == null || (remove2 = hashMap4.remove(str2)) == null)) {
    349.                 remove2.a();
    350.                 break;
    351.             }
    352.             break;
    353.         case 18:
    354.             String string8 = JSONUtil.getString(createJSONArray, 2);
    355.             a a2 = a(string8, JSONUtil.getJSONObject(createJSONArray, 0), JSONUtil.getString(createJSONArray, 1), iWebview);
    356.             if (!PdrUtil.isEmpty(string8) && !PdrUtil.isEmpty(a2)) {
    357.                 if (this.b == null) {
    358.                     this.b = new HashMap<>();
    359.                 }
    360.                 this.b.put(string8, a2);
    361.                 break;
    362.             }
    363.             break;
    364.         case 19:
    365.             String string9 = JSONUtil.getString(createJSONArray, 0);
    366.             JSONObject jSONObject2 = JSONUtil.getJSONObject(createJSONArray, 1);
    367.             String string10 = JSONUtil.getString(createJSONArray, 2);
    368.             Activity topRuningActivity = RuningAcitvityUtil.getTopRuningActivity(iWebview.getActivity());
    369.             if (!topRuningActivity.isDestroyed()) {
    370.                 c cVar3 = new c(this, iWebview, string9, jSONObject2, string10, topRuningActivity);
    371.                 if (this.a == null) {
    372.                     this.a = new HashMap<>();
    373.                 }
    374.                 cVar3.f = str2;
    375.                 this.a.put(str2, cVar3);
    376.                 break;
    377.             }
    378.             break;
    379.     }
    380.     return null;
    381. }

  • 相关阅读:
    使用aliyun的registry上传下载镜像
    《牛客题霸-算法篇》刷题之NC111 最大数
    Redis 学习整理
    20221203使用python3处理Google翻译英文SRT格式字幕
    后台管理登录权限怎么实现的，token具体有什么作用
    linux c++ 开发 - 05- 使用CMake创建一个动态库
    【原创】java+swing+mysql鲜花购物商城设计与实现
    SSM框架快速搭建（一）
    16、JAVA入门——继承和方法重写
    基于非侵入式负荷检测与分解的电力数据挖掘
  • 原文地址：https://blog.csdn.net/zhaoxiaoba123/article/details/127883308