安卓逆向 -- 实现SO层签名验证

Posted 2021-11-21 web安全工具库

往期文章

安卓逆向 -- NDK开发实现MD5算法

安卓逆向 -- 调用其他APK的SO文件

源码获取方式：公众号回复20211024

0、前言

上节课我们演示了，如何调用别人的SO文件，从而达到某些效果，这节课我们给SO层加上验证，如果其他apk调用就会报错

1、java层声明校验签名函数

public static native void signatureversify(Context ctx);

2、java层获取包名

PackageInfo packageInfo=null;try {    packageInfo = getPackageManager().getPackageInfo(getPackageName(), PackageManager.GET_SIGNATURES);} catch (PackageManager.NameNotFoundException e) {    e.printStackTrace();}Signature[] signatures = packageInfo.signatures;Log.d("aiyou",signatures[0].toCharsString());运行结果：308202e4308201cc020101300d06092a864886f70d010105050030373116301406035504030c0d416e64726f69642044656275673110300e060355040a0c07416e64726f6964310b30090603550406130255533020170d3230313031393030333633315a180f32303530313031323030333633315a30373116301406035504030c0d416e64726f69642044656275673110300e060355040a0c07416e64726f6964310b300906035504061302555330820122300d06092a864886f70d01010105000382010f003082010a0282010100d6e4f2c430ce9ae14f70845f709f8ce07e0cbd1a87f747ebc6e9b8530ebcd3eb71dc86f21e72975c9e2a8836c2c7f7c8714625a0f06f6e4988c99184a6c1d04a23bdb31dd634f410fd9c8cc912816bfac6cb077c07190965e9667b4be942723fe1d5aa3ce589218ecca5830e22e45785532aac801244d2675da8d8bf66ef88fa02140bd73b49264b5b026c8a98bd19daa06e616d32da093b4cffb679327d58c95dc296417015a7d63f0854b6c4645bc8427dd0c9c9a4fb786ec20102c7b0bea91f27d613baf628277da85d2f00a0a0b1a5f76affad01c54d1d225b12f7806ab2554f9a369f0910f116f5662c87066886209c7568e4a02b6153ac7bf5db5ebc010203010001300d06092a864886f70d01010505000382010100cc32524989096d80392a276933ec4952ec6a569ef14039bcd71d7687d9b5d3acfcbb0715e1cddf149e6e3f6cfb5d8f74ab6cc6724ec9cfc0ff0696ed4aac8661550bf5710a3a30bfe2d42ecb513aadd3232c1e4c098c6b8ff2c706cc05f58011709bbfea7a9099adc3a930c6b3848620e164dca12e25cd75cf8a4aa4dcb9de0672fd8ba3a991af67a05792fa760454bdbca0a9cfe4afaddfb4d48f9f66bd722c6cca9b6844c529ff036791c856ae2b4d5b505a393e6267d764bd1e11f5387bfce08175d46dfb0ff9518fc5ea6437e987337e21c1a528c9b925e4503ef42877791f443afc4780d30e90f66f5eb1d0619cd6caf40b0197721a53ff8efb3ed8ac2d

3、C层实现校验

static int is_veify=0;static char* pname="com.bucuo.ndk20211010";static char* sign="308202e4308201cc020101300d06092a864886f70d010105050030373116301406035504030c0d416e64726f69642044656275673110300e060355040a0c07416e64726f6964310b30090603550406130255533020170d3230313031393030333633315a180f32303530313031323030333633315a30373116301406035504030c0d416e64726f69642044656275673110300e060355040a0c07416e64726f6964310b300906035504061302555330820122300d06092a864886f70d01010105000382010f003082010a0282010100d6e4f2c430ce9ae14f70845f709f8ce07e0cbd1a87f747ebc6e9b8530ebcd3eb71dc86f21e72975c9e2a8836c2c7f7c8714625a0f06f6e4988c99184a6c1d04a23bdb31dd634f410fd9c8cc912816bfac6cb077c07190965e9667b4be942723fe1d5aa3ce589218ecca5830e22e45785532aac801244d2675da8d8bf66ef88fa02140bd73b49264b5b026c8a98bd19daa06e616d32da093b4cffb679327d58c95dc296417015a7d63f0854b6c4645bc8427dd0c9c9a4fb786ec20102c7b0bea91f27d613baf628277da85d2f00a0a0b1a5f76affad01c54d1d225b12f7806ab2554f9a369f0910f116f5662c87066886209c7568e4a02b6153ac7bf5db5ebc010203010001300d06092a864886f70d01010505000382010100cc32524989096d80392a276933ec4952ec6a569ef14039bcd71d7687d9b5d3acfcbb0715e1cddf149e6e3f6cfb5d8f74ab6cc6724ec9cfc0ff0696ed4aac8661550bf5710a3a30bfe2d42ecb513aadd3232c1e4c098c6b8ff2c706cc05f58011709bbfea7a9099adc3a930c6b3848620e164dca12e25cd75cf8a4aa4dcb9de0672fd8ba3a991af67a05792fa760454bdbca0a9cfe4afaddfb4d48f9f66bd722c6cca9b6844c529ff036791c856ae2b4d5b505a393e6267d764bd1e11f5387bfce08175d46dfb0ff9518fc5ea6437e987337e21c1a528c9b925e4503ef42877791f443afc4780d30e90f66f5eb1d0619cd6caf40b0197721a53ff8efb3ed8ac2d";/*获取签名值*  PackageInfo packageInfo=null;    packageInfo = getPackageManager().getPackageInfo(getPackageName(), PackageManager.GET_SIGNATURES);    Signature[] signatures = packageInfo.signatures;* *///获取包名jclass jclazz=env->GetObjectClass(ctx);jmethodID methodid=env->GetMethodID(jclazz,"getPackageName", "()Ljava/lang/String;");jstring jpname= static_cast<jstring>(env->CallObjectMethod(ctx, methodid));//对比包名是否一样const char *cpname=env->GetStringUTFChars(jpname,NULL);if (strcmp(cpname,pname)!=0)    return;__android_log_print(ANDROID_LOG_ERROR,"aiyou","包名一致：%s",cpname);//获取签名methodid=env->GetMethodID(jclazz,"getPackageManager", "()Landroid/content/pm/PackageManager;");jobject pmanager=env->CallObjectMethod(ctx,methodid);jclazz=env->GetObjectClass(pmanager);methodid=env->GetMethodID(jclazz,"getPackageInfo", "(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;");jobject packinfoobj=env->CallObjectMethod(pmanager,methodid,jpname,64);jclazz=env->GetObjectClass(packinfoobj);jfieldID signfid=env->GetFieldID(jclazz,"signatures", "[Landroid/content/pm/Signature;");jobjectArray signarray= static_cast<jobjectArray>(env->GetObjectField(packinfoobj, signfid));jobject sign0=env->GetObjectArrayElement(signarray,0);//signatures[0]jclazz=env->GetObjectClass(sign0);methodid=env->GetMethodID(jclazz,"toCharsString", "()Ljava/lang/String;");jstring jsignstr= static_cast<jstring>(env->CallObjectMethod(sign0, methodid));const char* csignstr=env->GetStringUTFChars(jsignstr,NULL);if(strcmp(csignstr,sign)!=0){    return;}is_veify=1;

禁止非法，后果自负

欢迎关注公众号：逆向有你

欢迎关注视频号：之乎者也吧