书接上回对可视对讲设备的分析，当时说可以去实现一下远程开门，今天正好有空就把这个坑填上了
http://aq.mk/index.php/archives/113.html
效果
分析
太细节的分析就不说了，根据上次定位到的函数最后发现实际其所有的串口通讯都封装在了jni library里面，就不整那么复杂的二进制逆向了，直接frida hook一把梭。
不知道是机器配置太低还是他的包有问题，导致直接frida或objection无法自动注入，一旦注入就会导致设备重启，所以这次采用frida-gadget的方式进行注入。
frida-gadget
就不详细展开说了,简单的描述就是找一个他本身就调用的so文件，然后通过给原始的so添加一个外部引用，这个引用就是我们的gadget，然后对apk重新打包安装即可。
操作如下：
# patchelf
# libzzz.so就是gadget 这个直接去官方的github下载然后随便改个名字就行
# 后面是apk自带的的so文件
patchelf --add-needed libzzz.so libjniandroidrkmojing.so
# 生成证书
keytool -genkey -v -keystore myApp.keystore -alias myApp.keystore -keyalg RSA -validity 30000
# 签名
uber-apk-signer -a ml/ml.apk --ks myApp.keystore --ksAlias myApp.keystore
# 安装
adb install -r android-release-signed.apk
我在这里出现了个问题，因为该软件是系统内置的，无法卸载，重新安装的话会因为签名不同导致安装
我的解决方案是找到其路径，然后直接替换他已经释放的so文件
# 查询路径
adb shell pm path com.mili.smarthome.snj
一般是这样的路径，这个图是随便找了个app截的
替换之后在重启app就可以发现注入成功了
方法调用
根据之前找到他的调用逻辑大概如下
# 初始化门禁, 参数是类型
Called com.android.client.InterCommClient.InterMonitorStart(int, int)
# 解锁
Called com.android.client.InterCommClient.InterMonitorUnlock()
# 关闭监听
Called com.android.client.InterCommClient.InterMonitorStop()
# 释放程序
Called com.android.client.InterCommClient.StopInterCommClient()
先写一个js验证一下
setTimeout(function() {
Java.perform(function() {
var InterCommClient = Java.use('com.android.client.InterCommClient');
var InterCommClientInstance = InterCommClient.$new();
console.log(InterCommClientInstance.InterMonitorStart(49,1));
console.log(InterCommClientInstance.InterMonitorUnlock());
})
})
调用成功之后就去实现一下rpc远程调用
hook.js
var InterCommClient =""
var InterCommClientInstance =""
function opendoor(a,b){
return new Promise(resolve => {
Java.perform(function () {
var ua="";
// 需要context
var Context = Java.use('android.content.Context');
var ctx = Java.cast(Java.use('android.app.ActivityThread').currentApplication().getApplicationContext(), Context);
InterCommClient = Java.use('com.android.client.InterCommClient');
InterCommClientInstance = InterCommClient.$new(ctx);
var initRet = InterCommClientInstance.InterMonitorStart(a,b)
var unlockRet = InterCommClientInstance.InterMonitorUnlock();
var stopRet = InterCommClientInstance.InterMonitorStop()
var closeRet = InterCommClientInstance.StopInterCommClient()
ua=initRet + " - " + unlockRet + " - " + stopRet + " - " + closeRet
console.log(ua)
resolve(ua)
})
})
}
rpc.exports={
opendoor:opendoor
}
在用flask写一个api
import os
from flask import Flask, escape, request,make_response
import frida
JS_CODE = open("hook.js").read()
app = Flask(__name__)
doorList = {
"1":[49,0],
"2":[49,1],
"3":[48,1],
"4":[48,2]
}
def message_header(message, payload):
message_type = message['type']
if message_type == 'send':
print('[* message]', message['payload'])
elif message_type == 'error':
stack = message['stack']
print('[* error]', stack)
else:
print(message)
os.system("adb forward tcp:27042 tcp:27042")
device = frida.get_usb_device(30)
session = device.attach("Gadget")
script = session.create_script(JS_CODE, runtime='v8')
script.on('message', message_header)
script.load()
@app.errorhandler(500)
def page_not_found(e):
return 'error'
@app.route("/")
def index():
data = open("index.html").read()
return str(data)
@app.route("/open")
def opendoor():
door=request.args.get("door")
doors=doorList.get(door)
script.exports.OpenDoor(doors[0],doors[1])
return "success"
app.run(
host='0.0.0.0',
port=65511,
debug=True
)
参考资料
https://www.bilibili.com/read/cv13148752
https://windysha.github.io/2020/05/28/%E9%9D%9ERoot%E7%8E%AF%E5%A2%83%E4%B8%8B%E4%BD%BF%E7%94%A8Frida%E7%9A%84%E4%B8%80%E7%A7%8D%E6%96%B9%E6%A1%88/
https://www.cnblogs.com/xiaoshen666/p/11008255.html
https://www.cnblogs.com/xiaoshen666/p/11008255.html
https://fadeevab.com/frida-gadget-injection-on-android-no-root-2-methods/
https://www.cnblogs.com/xiaoweigege/p/14976108.html
