Automne's Shadow.

TAMU CTF 2019 LocalNews WriteUp

reverse frida
2019/03/14 Share

Android

拿到的apk丢到JEB里分析，从MainActivity看起

automne

代码很简洁，注册了一个本地的广播接收器，接收到本地广播后打印log

automne

this.getString(2131427361)里对应的内容在上图的R类里

public static final int flag = 2131427360;
public static final int hidden_action = 2131427361;

因为是本地广播（应用进程内）LocalBroadcastManager，所以无法通过普通权限甚至root权限发送action为hidden_action的广播带出日志数据

不可行： am broadcast -a hidden_action

那就跟到下面这个函数里：

Deobfuscator$app$Debug.getString(0)

函数比较复杂

automne

考虑使用frida hook该函数(设备需root)，拿到数据

根据函数特点，编写frida.js脚本，内容如下：

1
2
3
4
5
6
7
8
9
10

setImmediate(function() {
    Java.perform(function() {
		
    var mc = Java.use("io.michaelrocks.paranoid.Deobfuscator$app$Debug");
	var mc2 = mc.$new();
	console.log(mc2.getString(0))
    
	});
});

然后执行如下命令：

frida -U -f com.tamu.ctf.hidden -l frida.js

得到flag

automne

原文作者: Automne

原文链接: https://ce-automne.github.io/2019/03/14/TAMU-CTF-2019-LocalNews-WriteUp/

发表日期: March 14th 2019, 11:07:00 pm

版权声明: 本文采用知识共享署名-非商业性使用 4.0 国际许可协议进行许可

CATALOG
Total : 62
2021
2020
2019
2018
2017
lfsr z3 python reverse fat git broadcastreceiver sha-1 cbc sqli sqlite golang race condition luks hashcat photorec MAC sso oauth 2.0 padding oracle csp xss abe vdex ransomware frida ndk pwntools hashpumpy sourceleakhacker ecb socat fastjson JdbcRowsetImpl idea servlet volatility inet_aton boneh durfee lcg rabin egcd cipolla's algorithm spi snakeyaml ScriptEngineManager malware codereflect mysql yara plugin deserialization log4j rsa binary javascript prototype pollution nodejs shiro ysoserial primefac rsatool ssl AES tshark gmpy2 RsaCtfTool Hex flask ssti ecc Modular operation WebGoat8 order by tomcat nim game .iso gpg outguess sage google cloud sdk zsteg base58 fermat multi-primes prng rmi jndi Paillier Cryptosystem rsa lsb oracle SQL Injection ping delay xor CAS 单点登录 渗透测试 weblogic xxe reflect 010 editor gcd
Crypto Android Web Forensics Misc