IOS - 某驾宝典篇

淩亂°似流年 2023-09-26 18:39 131阅读 0赞

首先挂上代理抓个登陆包，结果发现抓不到包，我们直接换个思路，采用vpn转发方式进行抓包；

![在这里插入图片描述][ad125850b658456aa040aadc1bfe71c9.png]

![在这里插入图片描述][50376d9c75144cdbacbf90b02425d17c.png]

sign, hsign，hext-union 三个参数加密；

hsign长度为32，可能为MD5 ， 其他两个未确定；

直接上我们的url定位：我直接附加吧

frida-trace -UF -m "+[NSURL URLWithString:]"

![在这里插入图片描述][b3ab2391d5b2433b958fdd939acdf07a.png]

是搞出来点东西，看样子有这个MD5, 先个堆栈追踪；

打开提示目录中的，URLWithString\_.js 文件

C:\Users\Codeooo\__handlers__

把咱们万能堆栈加上去；

log('堆栈 from:\n' +Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\n') + '\n');

![在这里插入图片描述][4e66578684d64bda85d36b90c90b1fde.png]

记录下堆栈，砸壳分析一波：

砸壳我这里用的是 CrackerXI ，[https://blog.csdn.net/weixin\_38927522/article/details/129497173][https_blog.csdn.net_weixin_38927522_article_details_129497173]

0x1024da038 /var/containers/Bundle/Application/82E81B77-8825-4ABC-A91F-EABC37E3408D/Driver.app/Driver!-[AFHTTPRequestSerializer requestBySerializingRequest:withParameters:error:]
    0x1024d9380 /var/containers/Bundle/Application/82E81B77-8825-4ABC-A91F-EABC37E3408D/Driver.app/Driver!-[AFHTTPRequestSerializer requestWithMethod:URLString:parameters:error:]
    0x1038de2a0 /var/containers/Bundle/Application/82E81B77-8825-4ABC-A91F-EABC37E3408D/Driver.app/Driver!-[XYNetworkProxy dataTaskWithHTTPMethod:sessionManager:requestSerializer:URLString:parameters:uploadProgress:downloadProgress:constructingBodyWithBlock:error:]
    0x1038de1a4 /var/containers/Bundle/Application/82E81B77-8825-4ABC-A91F-EABC37E3408D/Driver.app/Driver!-[XYNetworkProxy dataTaskWithHTTPMethod:sessionManager:requestSerializer:URLString:parameters:uploadProgress:downloadProgress:error:]
    0x1038de118 /var/containers/Bundle/Application/82E81B77-8825-4ABC-A91F-EABC37E3408D/Driver.app/Driver!-[XYNetworkProxy sessionTaskForRequest:error:]
    0x1038dd6a8 /var/containers/Bundle/Application/82E81B77-8825-4ABC-A91F-EABC37E3408D/Driver.app/Driver!-[XYNetworkProxy addRequest:]
    0x1038d89e8 /var/containers/Bundle/Application/82E81B77-8825-4ABC-A91F-EABC37E3408D/Driver.app/Driver!-[XYBaseRequest start]
    0x1038dc8f8 /var/containers/Bundle/Application/82E81B77-8825-4ABC-A91F-EABC37E3408D/Driver.app/Driver!-[XYNetworkManager getWithUrl:param:header:progress:completion:]
    0x1024ed940 /var/containers/Bundle/Application/82E81B77-8825-4ABC-A91F-EABC37E3408D/Driver.app/Driver!+[DrLogin58NetworkManager request:withMethod:parameters:withTimeoutInterval:resultClassType:withSuccess:withFail:]
    0x1024ee8c8 /var/containers/Bundle/Application/82E81B77-8825-4ABC-A91F-EABC37E3408D/Driver.app/Driver!+[DrLogin58RequestManager login:success:Failure:]
    0x10250f07c /var/containers/Bundle/Application/82E81B77-8825-4ABC-A91F-EABC37E3408D/Driver.app/Driver!-[DrUserLoginViewController passwordLoginRequestByPhone:ThePassword:]
    0x102510b68 /var/containers/Bundle/Application/82E81B77-8825-4ABC-A91F-EABC37E3408D/Driver.app/Driver!-[DrUserLoginViewController verifyLoginButtonClicked:]
    0x1b2169300 UIKitCore!-[UIApplication sendAction:to:from:forEvent:]
    0x1b1c12424 UIKitCore!-[UIControl sendAction:to:forEvent:]
    0x1b1c12744 UIKitCore!-[UIControl _sendActionsForEvents:withEvent:]
    0x1b1c117b0 UIKitCore!-[UIControl touchesEnded:withEvent:]
    
      8966 ms  +[NSURL URLWithString:]https://user.ksedt.com/api/login/v2?sign=314CEEC4B7FF8F7097990FA5FC412E635A31D4FA5760ECBBD3085C5C6F8C5E54A62F92A824DAF5C87E6708F21547BBCA09362643C2FFF4504B87EDC5247FA102

我们通过frida hook也是一样的：

![在这里插入图片描述][a5629309c4694e5d9af8df92a91744da.png]  
hook第一个堆栈函数，看一下：

![在这里插入图片描述][f1dd23ab8d9c45efba3a20aba5458c54.png]

![在这里插入图片描述][a85de916dfa846229742fc849d4a30f6.png]  
继续往上找吧；

找到这个堆栈：

> // 0x1038dc8f8  
> /var/containers/Bundle/Application/82E81B77-8825-4ABC-A91F-EABC37E3408D/Driver.app/Driver!-\[XYNetworkManager  
> getWithUrl:param:header:progress:completion:\]

![在这里插入图片描述][66638d43c84e49ee8a6dac1c15331aef.png]  
![在这里插入图片描述][c1601eb1668f42edb2344a746a72c25c.png]

![在这里插入图片描述][d5d59496bbb745ab82c2ff279528acec.png]

![在这里插入图片描述][d2698919d1b246019e9efd9822a28986.png]  
看来还是不对，再继续往上找：

> 找到： // 0x1024ed940  
> /var/containers/Bundle/Application/82E81B77-8825-4ABC-A91F-EABC37E3408D/Driver.app/Driver!+\[DrLogin58NetworkManager  
> request:withMethod:parameters:withTimeoutInterval:resultClassType:withSuccess:withFail:\]

![在这里插入图片描述][54d3dfbe9bd64dc6b5ae5cf104493a53.png]  
这里有个方法比较特殊 记录下：  
![在这里插入图片描述][0d8b6ed66dc5438795122d7eceb77655.png]  
有个类似于MD5的调用，再点进去看看  
![在这里插入图片描述][4e3b18b1361f4adf922dff40690a1f48.png]  
也是个cc\_md5；  
再往上找：

> // 0x10250f07c  
> /var/containers/Bundle/Application/82E81B77-8825-4ABC-A91F-EABC37E3408D/Driver.app/Driver!-\[DrUserLoginViewController  
> passwordLoginRequestByPhone:ThePassword:\]  
> ![在这里插入图片描述][a88327d084054ec0b3bbc511003e8ee0.png]  
> 看到这个函数，我们搞一下：

\+\[DrGenerateLoginRequestSign generateLoginRequestSignByParamDict:\]

![在这里插入图片描述][20174fb9b5954736ac70b7095ce8f247.png]

![在这里插入图片描述][ff362bbdcb384a7d82cea564d82de227.png]  
这里面东西不少；

![在这里插入图片描述][e7a7b36be27149269ee1d43dc766ad1d.png]  
retval:则是 314CEEC4B7FF8F7097990FA5FC412E635A31D4FA5760ECBBD3085C5C6F8C5E54A62F92A824DAF5C87E6708F21547BBCA09362643C2FFF4504B87EDC5247FA102

那我们aes的key找到了 ， iv是 nil，那就是ecb模式，无需iv；  
再看下data明文，62376363 37386263 31346130 37356639 34353462 62643733 33663564 62626164 7c70686f 6e653d31 38383838 38383838 38382670 77643d31 32333435 36  
![在这里插入图片描述][316c27a0c91a449a9fb1e8d588918ef2.png]

b7cc78bc14a075f9454bbd733f5dbbad|phone=18888888888&pwd=123456  
![在这里插入图片描述][b7de8aab02054d328192d0ad00aef834.png]  
b7cc78bc14a075f9454bbd733f5dbbad 哪里来？

![在这里插入图片描述][fbab7f4ba1a74c8da45e391a18df7b42.png]  
这里就说看出来 b7cc78bc14a075f9454bbd733f5dbbad 这里来；

### **sign逆向完毕！** ###

![在这里插入图片描述][e3fe5351953b4aed809613f8a0e6df9e.png]  
hsign值得到了，其他参数都在请求里，30319502d66d31a4779bf67a54588c4ec572b3b5 这个值哪里来的：固定的吗？固定盐？

![在这里插入图片描述][880c388c53d04d3390c14c36ef3500c7.png]  
MD5的时候，同时又把 hsign 直接给勾出来了；

### hsign 逆向完毕！ ###

![在这里插入图片描述][80acc1f656854e0c842cb8122d3fe102.png]  
继续看下，hext-union，直接shift + F12, 老话说的好，直接ida搜字符串；  
![在这里插入图片描述][0cf98ccb37b2456ca22f5eba76b2d2e7.png]  
![在这里插入图片描述][61326a2d7b9a418ea73468559ab1b6df.png]  
![在这里插入图片描述][d207168f98a64cc5b9e8784781a89101.png]  
![在这里插入图片描述][62358c6c7abf4349b9bfdcebd182c8b8.png]  
再通过上面hook aes脚本，仔细观察看下：

![在这里插入图片描述][a3e60a5f01684831bd8aa2457725426a.png]

![在这里插入图片描述][44e1b3d20b284824bec7395481cb1dc8.png]  
这个是跟设备一些关联；

args\[2\]: <3338387a 7a683770 77346961 67307039>  
args\[3\]: <336b796c 77676c6d 63376d7a 66783265>

![在这里插入图片描述][a7fc2803459d4272a18475416bc77278.png]  
![在这里插入图片描述][976028a4d6104b4299f373d1f08e8fb3.png]  
说明秘钥没问题；  
![在这里插入图片描述][2c3e6d2549004f9ba69c45fdd8f37e5a.png]  
![在这里插入图片描述][df1ebcaae8db4b7e9a9b96dadcda27a1.png]  
对比下确实是没问题，只不过他的base64将/ + 号等都做了替换；  
我们去ida看下是不是码表也有变化，方便我们在页面调整：

![在这里插入图片描述][f250e5d67d5d4349975d8a04353eb680.png]  
码表搞出来，替换上来：  
![在这里插入图片描述][677ef14636cb46d2a3843133525ca6db.png]  
对比完美结束。

### hext-union完毕！ ###

所以说这个CyberChef是真的好用！！！

![在这里插入图片描述][a314483c5a6e42b989e83a98cb1eb4f4.png]

[https://gchq.github.io/CyberChef/\#recipe=To\_Hex(‘Space’,0)AES\_Encrypt(%7B’option’:‘Hex’,‘string’:‘3338387a%207a683770%2077346961%2067307039’%7D,%7B’option’:‘Hex’,‘string’:‘336b796c%2077676c6d%2063376d7a%2066783265’%7D,‘CBC’,‘Hex’,‘Raw’,%7B’option’:‘Hex’,‘string’:‘’%7D)To\_Base64(‘A-Za-z0-9-\_’)&input=eyJoY2l0eWlkIjoiMSIsImhpbWVpIjoiMzAzMTk1MDJkNjZkMzFhNDc3OWJmNjdhNTQ1ODhjNGVjNTcyYjNiNSIsInp4YWlkIjoiQTAxLU9zVmdZN2pcL0dYMmZwMXc1WDVkN1BaYVwvem00THBNUVgiLCJoZGV2aWNlaWQiOiI4MGQ3MWE3MmY4MDU0ZDIyODMzNTA0NWRjZjE5Zjk1OSIsImhvc3ZlciI6IjEyLjUuNyIsInp4aWQiOiJaMDEtMTY4MTI0ODkzNi15RjE2ZXdET3VmZzQxZG9DLUQ4OUEifQ][https_gchq.github.io_CyberChef_recipe_To_Hex_Space_0_AES_Encrypt_7B_option_Hex_string_3338387a_207a683770_2077346961_2067307039_7D_7B_option_Hex_string_336b796c_2077676c6d_2063376d7a_2066783265_7D_CBC_Hex_Raw_7B_option_Hex_string_7D_To_Base64_A-Za-z0-9-_input_eyJoY2l0eWlkIjoiMSIsImhpbWVpIjoiMzAzMTk1MDJkNjZkMzFhNDc3OWJmNjdhNTQ1ODhjNGVjNTcyYjNiNSIsInp4YWlkIjoiQTAxLU9zVmdZN2pcL0dYMmZwMXc1WDVkN1BaYVwvem00THBNUVgiLCJoZGV2aWNlaWQiOiI4MGQ3MWE3MmY4MDU0ZDIyODMzNTA0NWRjZjE5Zjk1OSIsImhvc3ZlciI6IjEyLjUuNyIsInp4aWQiOiJaMDEtMTY4MTI0ODkzNi15RjE2ZXdET3VmZzQxZG9DLUQ4OUEifQ]

[ad125850b658456aa040aadc1bfe71c9.png]: https://img-blog.csdnimg.cn/ad125850b658456aa040aadc1bfe71c9.png
[50376d9c75144cdbacbf90b02425d17c.png]: https://img-blog.csdnimg.cn/50376d9c75144cdbacbf90b02425d17c.png
[b3ab2391d5b2433b958fdd939acdf07a.png]: https://img-blog.csdnimg.cn/b3ab2391d5b2433b958fdd939acdf07a.png
[4e66578684d64bda85d36b90c90b1fde.png]: https://img-blog.csdnimg.cn/4e66578684d64bda85d36b90c90b1fde.png
[https_blog.csdn.net_weixin_38927522_article_details_129497173]: https://blog.csdn.net/weixin_38927522/article/details/129497173
[a5629309c4694e5d9af8df92a91744da.png]: https://img-blog.csdnimg.cn/a5629309c4694e5d9af8df92a91744da.png
[f1dd23ab8d9c45efba3a20aba5458c54.png]: https://img-blog.csdnimg.cn/f1dd23ab8d9c45efba3a20aba5458c54.png
[a85de916dfa846229742fc849d4a30f6.png]: https://img-blog.csdnimg.cn/a85de916dfa846229742fc849d4a30f6.png
[66638d43c84e49ee8a6dac1c15331aef.png]: https://img-blog.csdnimg.cn/66638d43c84e49ee8a6dac1c15331aef.png
[c1601eb1668f42edb2344a746a72c25c.png]: https://img-blog.csdnimg.cn/c1601eb1668f42edb2344a746a72c25c.png
[d5d59496bbb745ab82c2ff279528acec.png]: https://img-blog.csdnimg.cn/d5d59496bbb745ab82c2ff279528acec.png
[d2698919d1b246019e9efd9822a28986.png]: https://img-blog.csdnimg.cn/d2698919d1b246019e9efd9822a28986.png
[54d3dfbe9bd64dc6b5ae5cf104493a53.png]: https://img-blog.csdnimg.cn/54d3dfbe9bd64dc6b5ae5cf104493a53.png
[0d8b6ed66dc5438795122d7eceb77655.png]: https://img-blog.csdnimg.cn/0d8b6ed66dc5438795122d7eceb77655.png
[4e3b18b1361f4adf922dff40690a1f48.png]: https://img-blog.csdnimg.cn/4e3b18b1361f4adf922dff40690a1f48.png
[a88327d084054ec0b3bbc511003e8ee0.png]: https://img-blog.csdnimg.cn/a88327d084054ec0b3bbc511003e8ee0.png
[20174fb9b5954736ac70b7095ce8f247.png]: https://img-blog.csdnimg.cn/20174fb9b5954736ac70b7095ce8f247.png
[ff362bbdcb384a7d82cea564d82de227.png]: https://img-blog.csdnimg.cn/ff362bbdcb384a7d82cea564d82de227.png
[e7a7b36be27149269ee1d43dc766ad1d.png]: https://img-blog.csdnimg.cn/e7a7b36be27149269ee1d43dc766ad1d.png
[316c27a0c91a449a9fb1e8d588918ef2.png]: https://img-blog.csdnimg.cn/316c27a0c91a449a9fb1e8d588918ef2.png
[b7de8aab02054d328192d0ad00aef834.png]: https://img-blog.csdnimg.cn/b7de8aab02054d328192d0ad00aef834.png
[fbab7f4ba1a74c8da45e391a18df7b42.png]: https://img-blog.csdnimg.cn/fbab7f4ba1a74c8da45e391a18df7b42.png
[e3fe5351953b4aed809613f8a0e6df9e.png]: https://img-blog.csdnimg.cn/e3fe5351953b4aed809613f8a0e6df9e.png
[880c388c53d04d3390c14c36ef3500c7.png]: https://img-blog.csdnimg.cn/880c388c53d04d3390c14c36ef3500c7.png
[80acc1f656854e0c842cb8122d3fe102.png]: https://img-blog.csdnimg.cn/80acc1f656854e0c842cb8122d3fe102.png
[0cf98ccb37b2456ca22f5eba76b2d2e7.png]: https://img-blog.csdnimg.cn/0cf98ccb37b2456ca22f5eba76b2d2e7.png
[61326a2d7b9a418ea73468559ab1b6df.png]: https://img-blog.csdnimg.cn/61326a2d7b9a418ea73468559ab1b6df.png
[d207168f98a64cc5b9e8784781a89101.png]: https://img-blog.csdnimg.cn/d207168f98a64cc5b9e8784781a89101.png
[62358c6c7abf4349b9bfdcebd182c8b8.png]: https://img-blog.csdnimg.cn/62358c6c7abf4349b9bfdcebd182c8b8.png
[a3e60a5f01684831bd8aa2457725426a.png]: https://img-blog.csdnimg.cn/a3e60a5f01684831bd8aa2457725426a.png
[44e1b3d20b284824bec7395481cb1dc8.png]: https://img-blog.csdnimg.cn/44e1b3d20b284824bec7395481cb1dc8.png
[a7fc2803459d4272a18475416bc77278.png]: https://img-blog.csdnimg.cn/a7fc2803459d4272a18475416bc77278.png
[976028a4d6104b4299f373d1f08e8fb3.png]: https://img-blog.csdnimg.cn/976028a4d6104b4299f373d1f08e8fb3.png
[2c3e6d2549004f9ba69c45fdd8f37e5a.png]: https://img-blog.csdnimg.cn/2c3e6d2549004f9ba69c45fdd8f37e5a.png
[df1ebcaae8db4b7e9a9b96dadcda27a1.png]: https://img-blog.csdnimg.cn/df1ebcaae8db4b7e9a9b96dadcda27a1.png
[f250e5d67d5d4349975d8a04353eb680.png]: https://img-blog.csdnimg.cn/f250e5d67d5d4349975d8a04353eb680.png
[677ef14636cb46d2a3843133525ca6db.png]: https://img-blog.csdnimg.cn/677ef14636cb46d2a3843133525ca6db.png
[a314483c5a6e42b989e83a98cb1eb4f4.png]: https://img-blog.csdnimg.cn/a314483c5a6e42b989e83a98cb1eb4f4.png
[https_gchq.github.io_CyberChef_recipe_To_Hex_Space_0_AES_Encrypt_7B_option_Hex_string_3338387a_207a683770_2077346961_2067307039_7D_7B_option_Hex_string_336b796c_2077676c6d_2063376d7a_2066783265_7D_CBC_Hex_Raw_7B_option_Hex_string_7D_To_Base64_A-Za-z0-9-_input_eyJoY2l0eWlkIjoiMSIsImhpbWVpIjoiMzAzMTk1MDJkNjZkMzFhNDc3OWJmNjdhNTQ1ODhjNGVjNTcyYjNiNSIsInp4YWlkIjoiQTAxLU9zVmdZN2pcL0dYMmZwMXc1WDVkN1BaYVwvem00THBNUVgiLCJoZGV2aWNlaWQiOiI4MGQ3MWE3MmY4MDU0ZDIyODMzNTA0NWRjZjE5Zjk1OSIsImhvc3ZlciI6IjEyLjUuNyIsInp4aWQiOiJaMDEtMTY4MTI0ODkzNi15RjE2ZXdET3VmZzQxZG9DLUQ4OUEifQ]: https://gchq.github.io/CyberChef/#recipe=To_Hex%28%27Space%27,0%29AES_Encrypt%28%7B%27option%27:%27Hex%27,%27string%27:%273338387a%207a683770%2077346961%2067307039%27%7D,%7B%27option%27:%27Hex%27,%27string%27:%27336b796c%2077676c6d%2063376d7a%2066783265%27%7D,%27CBC%27,%27Hex%27,%27Raw%27,%7B%27option%27:%27Hex%27,%27string%27:%27%27%7D%29To_Base64%28%27A-Za-z0-9-_%27%29&input=eyJoY2l0eWlkIjoiMSIsImhpbWVpIjoiMzAzMTk1MDJkNjZkMzFhNDc3OWJmNjdhNTQ1ODhjNGVjNTcyYjNiNSIsInp4YWlkIjoiQTAxLU9zVmdZN2pcL0dYMmZwMXc1WDVkN1BaYVwvem00THBNUVgiLCJoZGV2aWNlaWQiOiI4MGQ3MWE3MmY4MDU0ZDIyODMzNTA0NWRjZjE5Zjk1OSIsImhvc3ZlciI6IjEyLjUuNyIsInp4aWQiOiJaMDEtMTY4MTI0ODkzNi15RjE2ZXdET3VmZzQxZG9DLUQ4OUEifQ