接上节课

安卓逆向 -- Frida环境搭建(HOOK实例)

安卓逆向 -- FridaHook某车udid的加密值

一、上节课分析到一个encode3Des函数，看到CBC模式，首先要找iv和key的值

public static String encode3Des(Context context, String str) {        String desKey = AHAPIHelper.getDesKey(context);        byte[] bArr = null;        if (TextUtils.isEmpty(desKey)) {            return null;        }        try {            SecretKey generateSecret = SecretKeyFactory.getInstance("desede").generateSecret(new DESedeKeySpec(desKey.getBytes()));            Cipher cipher = Cipher.getInstance("desede/CBC/PKCS5Padding");            cipher.init(1, generateSecret, new IvParameterSpec(f882iv.getBytes()));            bArr = cipher.doFinal(str.getBytes("UTF-8"));        } catch (Exception unused) {        }        return encode(bArr).toString();    }

二、通过上下文，直接可以看到iv的值，常量：appapich

三、通过下面代码，我们进入getDeskey函数，查看key

 String desKey = AHAPIHelper.getDesKey(context);

四、getdesk又来自于getSigndeskey，继续进入该函数查看

private static void getSignDesKey(Context context) {        mDesKey = CheckSignUtil.get3desKey(context);    }

五、继续进入get3desKey函数查看，来自于原生函数

六、分析so有点难度，所以直接hook getDesKey函数，获取key

let AHAPIHelper = Java.use("com.autohome.ahkit.AHAPIHelper");AHAPIHelper["getDesKey"].implementation = function (context) {    console.log(`AHAPIHelper.getDesKey is called: context=${context}`);    let result = this["getDesKey"](context);    console.log(`AHAPIHelper.getDesKey result=${result}`);    return result;};运行结果：AHAPIHelper.getDesKey result=appapiche168comappapiche168comapencode3Des ret value is Emf/VNnohOKgDGg18QXBQF8lIyfQHAikW7L132/afUxHsE0uu7TFiA==

七、实现3DES

1、安装需要的库文件

pip install pycryptodome注意....\Python\Python310\Lib\site-packages将里面Crypto文件夹的C改为大写C

2、代码实现

import base64from Crypto.Cipher import DES3BS = 8pad = lambda s: s + (BS - len(s) % BS) * chr(BS - len(s) % BS)#des加密看前8位，3des加密看前24位key = b'appapiche168comappapiche168comap'[0:24]iv = b'appapich'加密数据='869394024096718|233068977599|357590'plaintext = pad(加密数据).encode("utf-8")cipher = DES3.new(key, DES3.MODE_CBC, iv)result = cipher.encrypt(plaintext)print(base64.b64encode(result).decode('utf-8'))