Android逆向笔记-IDA Pro动态调试Android程序（真机）

﹏ヽ暗。殇╰゛Y 2022-09-07 14:47 299阅读 0赞

这里的安卓版本是：

Android 5.1.1（Lollipop, API 22）

LGE Google Nexus 5

arm

使用的IDA为：IDA Pro 6.8

将android\_server送到/data/local/tmp

adb push android_server /data/local/tmp
    adb shell
    su
    mv android_server android_server6.8
    chmod 777 android_server6.8

将程序跑起来：

root@hammerhead:/data/local/tmp # ./android_server6.8
    ./android_server6.8
    IDA Android 32-bit remote debug server(ST) v1.19. Hex-Rays (c) 2004-2015
    Listening on port #23946...

进行adb端口转发：

adb forward tcp:23946 tcp:23946

运行monitor.exe

D:\AndroidStudioIDE\sdk\tools>monitor.bat

将apk改成debug版：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70][]

<?xml version="1.0" encoding="utf-8" standalone="no"?><manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.yaotong.crackme">
        <application android:allowBackup="true" android:icon="@drawable/creakme2_logo" android:label="@string/app_name" android:debuggable="true">
            <activity android:label="@string/app_name" android:name="com.yaotong.crackme.MainActivity">
                <intent-filter>
                    <action android:name="android.intent.action.MAIN"/>
                    <category android:name="android.intent.category.LAUNCHER"/>
                </intent-filter>
            </activity>
            <activity android:name="com.yaotong.crackme.ResultActivity"/>
        </application>
    </manifest>

Android手机安装好后，启动：

adb shell am start -D -n com.yaotong.crackme/.MainActivity

此时手机上会出现Waiting For Degbugger

Android Device Monitor选中：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 1][]

IDA打开选中此lib库

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 2][]

在此处下好断点；

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 3][]

再Debugger->Select debugger

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 4][]

再Debugger->Process options

![20210824084441424.png][]

输入127.0.0.1，然后ok

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 5][]

再选择附加的进程：

![20210824084501616.png][]

选中，点击OK

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 6][]

让其跑起来：

jdb -connect com.sun.jdi.SocketAttach:port=8700,hostname=localhost

此时点击这个运行：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 7][]

命令行提示：

D:\AndroidStudioIDE\sdk\tools>jdb -connect com.sun.jdi.SocketAttach:port=8700,hostname=localhost
    设置未捕获的java.lang.Throwable
    设置延迟的未捕获的java.lang.Throwable
    正在初始化jdb...
    >
    >

IDA断点成功：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 8][]

这个就是单步调试：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 9][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70]: /images/20220829/a425ea6307f84774bb957368318fa97c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 1]: /images/20220829/5c4a2c7085e945969cd31fbfb44e5a6a.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 2]: /images/20220829/7eed517f694f482f97fcb96e473259db.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 3]: /images/20220829/bbcb876d3be94a72a6d0d15baec17060.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 4]: /images/20220829/4b17e8a0caae43149c3e7853e4583738.png
[20210824084441424.png]: /images/20220829/e217882b3ef54d16beca759dcc4d24ff.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 5]: /images/20220829/6f17fd235c67458ba49d44bc0541ee4e.png
[20210824084501616.png]: /images/20220829/3b3928ee22124d569d78bf87d27470b9.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 6]: /images/20220829/772c1de3e6e245c7928ac57593aa703e.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 7]: /images/20220829/256969fe337e456b829443548e24c8e1.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 8]: /images/20220829/e53c490f1de24ec0b6ab4dc8c5e25be2.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxNzg0NDI3NjE_size_16_color_FFFFFF_t_70 9]: /images/20220829/b2a17459dd014334a854a708a7a58950.png