Dump 腾讯乐加固问题

xiaokanghub commented 6 years ago

MacBookPro:unpack $ frida -R -f com.yesebo -l unpack.js

/ _  |   Frida 12.0.8 - A world-class dynamic instrumentation toolkit

| (_| |

| Commands: // |_| help -> Displays the help system . . . . object? -> Display information about 'object' . . . . exit/quit -> Exit . . . . . . . . More info at http://www.frida.re/docs/home/ Spawning com.yesebo...
openmemory at0xb3574012 Spawned com.yesebo. Use %resume to let the main thread start executing! [Remote::com.yesebo]-> %resume [Remote::com.yesebo]-> files dir: /data/user/0/com.yesebo/files code cache dir: /data/user/0/com.yesebo/code_cache write dex to /data/user/0/com.yesebo/files/emmm.dex dalvik.system.DexClassLoader[DexPathList[[dex file "/data/user/0/com.yesebo/files/emmm.dex"],nativeLibraryDirectories=[/data/user/0/com.yesebo/code_cache, /vendor/lib, /system/lib]]] getClassNameList getClassNameListArray getObjectField loadAllClass find loadAllClass loadAllClass: public static void com.smartdone.EnumerateClass.loadAllClass(java.lang.ClassLoader) start dump dex /data/user/0/com.yesebo/files/76f17c.dex write file to /data/user/0/com.yesebo/files/76f17c.dex Process terminated [Remote::com.yesebo]->

Thank you for using Frida!

虽然dump了一个dex 但是是乐加固的不是APK的dex，写入后进程直接终止了

smartdone commented 6 years ago

你试试这个https://github.com/dstmath/frida-unpack，乐固的用这个应该可以，我的这个会把所有的类加载一遍，有可能在这过程中程序崩了

xiaokanghub commented 6 years ago

好的谢了

xiaokanghub commented 6 years ago

libshella-2.9.so 失败了打开提示错误 Error: failed to open file (No such file or directory) at repl1.js:22[Android Emulator 5554::com.yesebo]->

smartdone commented 6 years ago

你能把apk发我一个看下吗，smartdone@163.com

xiaokanghub commented 6 years ago

ok hmmm 你要把持住 = =

xiaokanghub commented 6 years ago

发送了

smartdone commented 6 years ago

脱好发你了，我的手机没问题的，你Android什么版本

smartdone / Frida-Scripts

Dump 腾讯乐加固问题 #2