实战操作——一次简单的逆向分析破解锁机软件

事情的起因是这样的，群里有位小朋友的手机被锁了，问及原因，原来是下载了一个名叫“cf外挂助手激活版”的这么一个软件，我收到了这份软件之后看到他是这样的...

emmm....才二百多kb，看来这是个不折不扣的小白了

从大小上来分析，只有二百多kb的“外挂”肯定是有猫腻的

从名字上来看，也很有问题，接下来我果断百度了下这个名字

emmmmm...........这样一来便更加深了我对他小白的印象

接下来我将这个文件上传到哈勃分析系统（https://habo.qq.com/）

得出文件MD5值：703b33a0def90c8d689881017878ae2d 百度搜索没有任何有关此MD5的信息，接下来进行逆向工作

工具：Android killer

将.apk文件放入Android killer中，发现入口M，查看代码信息：

.class public Lcom/h/M;
.super Landroid/app/Activity;
.source "M.java"

# direct methods
.method public constructor <init>()V
    .locals 3

    .prologue
    .line 25
    move-object v0, p0

    move-object v2, v0

    invoke-direct {v2}, Landroid/app/Activity;-><init>()V

    return-void
.end method

.method private activiteDevice()V
    .locals 13
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "()V"
        }
    .end annotation

    .prologue
    .line 19
    move-object v0, p0

    new-instance v5, Landroid/content/Intent;

    move-object v12, v5

    move-object v5, v12

    move-object v6, v12

    const-string v7, "android.app.action.ADD_DEVICE_ADMIN"

    invoke-direct {v6, v7}, Landroid/content/Intent;-><init>(Ljava/lang/String;)V

    move-object v1, v5

    .line 20
    new-instance v5, Landroid/content/ComponentName;

    move-object v12, v5

    move-object v5, v12

    move-object v6, v12

    move-object v7, v0

    :try_start_0
    const-string v8, "com.h.MyAdmin"

    invoke-static {v8}, Ljava/lang/Class;->forName(Ljava/lang/String;)Ljava/lang/Class;
    :try_end_0
    .catch Ljava/lang/ClassNotFoundException; {:try_start_0 .. :try_end_0} :catch_0

    move-result-object v8

    invoke-direct {v6, v7, v8}, Landroid/content/ComponentName;-><init>(Landroid/content/Context;Ljava/lang/Class;)V

    move-object v2, v5

    .line 21
    move-object v5, v1

    const-string v6, "android.app.extra.DEVICE_ADMIN"

    move-object v7, v2

    invoke-virtual {v5, v6, v7}, Landroid/content/Intent;->putExtra(Ljava/lang/String;Landroid/os/Parcelable;)Landroid/content/Intent;

    move-result-object v5

    .line 24
    move-object v5, v0

    move-object v6, v1

    const/4 v7, 0x0

    invoke-virtual {v5, v6, v7}, Lcom/h/M;->startActivityForResult(Landroid/content/Intent;I)V

    return-void

    .line 20
    :catch_0
    move-exception v5

    move-object v3, v5

    new-instance v5, Ljava/lang/NoClassDefFoundError;

    move-object v12, v5

    move-object v5, v12

    move-object v6, v12

    move-object v7, v3

    invoke-virtual {v7}, Ljava/lang/Throwable;->getMessage()Ljava/lang/String;

    move-result-object v7

    invoke-direct {v6, v7}, Ljava/lang/NoClassDefFoundError;-><init>(Ljava/lang/String;)V

    throw v5
.end method

# virtual methods
.method public onCreate(Landroid/os/Bundle;)V
    .locals 5
    .annotation system Ldalvik/annotation/Signature;
        value = {
            "(",
            "Landroid/os/Bundle;",
            ")V"
        }
    .end annotation

    .annotation runtime Ljava/lang/Override;
    .end annotation

    .prologue
    move-object v0, p0

    move-object v1, p1

    move-object v3, v0

    invoke-static {v3}, LLogCatBroadcaster;->start(Landroid/content/Context;)V

    .line 13
    move-object v3, v0

    move-object v4, v1

    invoke-super {v3, v4}, Landroid/app/Activity;->onCreate(Landroid/os/Bundle;)V

    .line 14
    move-object v3, v0

    invoke-direct {v3}, Lcom/h/M;->activiteDevice()V

    return-void
.end method

未发现有意义的线索，接下来尝试搜索“序列号”

bingo!!只有一个搜索结果,嗅到了成功的味道

nice，成功找到密码：beautifulflower，前提是得使得序列号为0，这里就需要手机进行双清操作了，没办法，谁让贪小便宜呢

顺便挂下传播勒索软件人的qq:543892683，相信这也不是他本人做的，应该是网上找的一键生成程序

顺便告诫下大家，莫贪小便宜，不要随便下群里所谓的“黑客工具”“盗号软件”“辅助外挂”之类的东西，十有八九都是有病毒的

实战操作——一次简单的逆向分析破解锁机软件

猜你喜欢