1
 2
 3
 4
 5
 6
 7
 8
 9
10

app.apk
  ├── lib/
  │   ├── armeabi-v7a/
  │   │   └── libnative.so      <-- 32-bit ARM
  │   ├── arm64-v8a/
  │   │   └── libnative.so      <-- 64-bit ARM (推荐分析此版本)
  │   └── x86_64/
  │       └── libnative.so      <-- x86_64 (模拟器用)
  ├── classes.dex
  └── AndroidManifest.xml

1
2
3
4
5
6

JNI 函数命名规则：Java_包名_类名_方法名

示例：
Java_com_example_app_NativeLib_encrypt
Java_com_example_app_NativeLib_verify
Java_com_example_app_NativeLib_getSign

1
2
3
4
5
6
7

常见有价值的字符串：
- "AES", "RSA", "MD5", "SHA"        -> 加密算法线索
- "key", "secret", "token"          -> 密钥相关
- "verify", "sign", "check"         -> 签名验证
- "http", "https", "api"            -> 网络请求
- "/proc/self/maps"                 -> 反调试检测
- "su", "magisk", "frida"           -> Root/Hook 检测

1
2
3
4
5

typedef struct {
    const char* name;       // Java 方法名
    const char* signature;  // 方法签名
    void*       fnPtr;      // Native 函数指针 <-- 真正的实现函数
} JNINativeMethod;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

// 重命名前（几乎不可读）
int __fastcall sub_12A0(int a1, int a2, int a3)
{
    int v4 = *(_DWORD *)(a1 + 16);
    void *v5 = malloc(a3 + 1);
    memcpy(v5, *(void **)(a1 + 24), a3);
    return sub_1400(v5, a3, v4);
}

// 重命名后（逻辑清晰）
int __fastcall decrypt_data(JNIEnv *env, jbyteArray input, int length)
{
    int key_len = *(_DWORD *)(env + 16);
    void *buffer = malloc(length + 1);
    memcpy(buffer, *(void **)(env + 24), length);
    return aes_decrypt(buffer, length, key_len);
}

1
2
3
4
5

// 修正前：IDA 将 JNIEnv* 识别为 int
int __fastcall Java_com_example_encrypt(int a1, int a2, int a3)

// 修正后：设置正确的 JNI 类型
jbyteArray __fastcall Java_com_example_encrypt(JNIEnv *env, jobject thiz, jstring input)

1
2
3
4

// 定义前                           // 定义后
v3 = *(_DWORD *)(a1 + 0);          v3 = ctx->buffer;
v4 = *(_DWORD *)(a1 + 4);          v4 = ctx->buffer_size;
v5 = *(_DWORD *)(a1 + 8);          v5 = ctx->key;

1
2
3
4
5
6

import idautils
import idc

for func_ea in idautils.Functions():
    func_name = idc.get_func_name(func_ea)
    print(f"{func_name} at {hex(func_ea)}")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

import idc

# 格式：{ 地址: "新函数名" }
rename_map = {
    0x12A0: "aes_encrypt",
    0x1400: "aes_decrypt",
    0x1580: "md5_init",
    0x16C0: "md5_update",
    0x1800: "md5_final",
    0x1A00: "base64_encode",
    0x1B40: "hmac_sha256",
}

for addr, name in rename_map.items():
    if idc.set_name(addr, name, idc.SN_FORCE):
        print(f"[+] Renamed {hex(addr)} -> {name}")
    else:
        print(f"[-] Failed to rename {hex(addr)}")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

import idautils, idc, ida_bytes

CRYPTO_CONSTANTS = {
    "MD5":      [0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476],
    "SHA-256":  [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a],
    "AES-Te0":  [0xc66363a5, 0xf87c7c84, 0xee777799, 0xf67b7b8d],
    "CRC32":    [0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA],
    "Blowfish": [0x243F6A88, 0x85A308D3, 0x13198A2E, 0x03707344],
}

for algo_name, constants in CRYPTO_CONSTANTS.items():
    for const in constants:
        ea = 0
        while True:
            ea = ida_bytes.find_dword(ea, idc.BADADDR, const)
            if ea == idc.BADADDR:
                break
            func_ea = idc.get_func_attr(ea, idc.FUNCATTR_START)
            func_name = idc.get_func_name(func_ea) if func_ea != idc.BADADDR else "N/A"
            print(f"[{algo_name}] {hex(const)} at {hex(ea)} (func: {func_name})")
            ea += 4

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

import idc, ida_bytes

def parse_jni_native_methods(methods_ptr, count):
    """解析 JNINativeMethod 数组 (64-bit: 每项 24 字节)"""
    for i in range(count):
        base = methods_ptr + i * 24
        name_ptr = ida_bytes.get_qword(base)
        sig_ptr  = ida_bytes.get_qword(base + 8)
        fn_ptr   = ida_bytes.get_qword(base + 16)

        name = idc.get_strlit_contents(name_ptr, -1, idc.STRTYPE_C)
        sig  = idc.get_strlit_contents(sig_ptr, -1, idc.STRTYPE_C)
        if name and sig:
            name = name.decode() if isinstance(name, bytes) else name
            sig  = sig.decode() if isinstance(sig, bytes) else sig
            idc.set_name(fn_ptr, f"jni_{name}", idc.SN_FORCE)
            print(f"  {name} {sig} -> {hex(fn_ptr)}")

# 用法: 在 RegisterNatives 调用处确定 methods 地址和 count
# parse_jni_native_methods(0xABCD1234, 5)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

import idc, idautils

def dump_all_strings(min_length=4):
    strings = idautils.Strings()
    with open("/tmp/ida_strings.txt", "w") as f:
        for s in strings:
            if s.length >= min_length:
                content = idc.get_strlit_contents(s.ea, -1, s.strtype)
                if content:
                    text = content.decode('utf-8', errors='replace')
                    f.write(f"{hex(s.ea)}: {text}\n")
    print("[+] 字符串已导出到 /tmp/ida_strings.txt")

dump_all_strings()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

import idc, idautils

def xor_decrypt(data, key):
    if isinstance(key, int):
        return bytes([b ^ key for b in data])
    return bytes([b ^ key[i % len(key)] for i, b in enumerate(data)])

def find_decrypt_calls(decrypt_func_addr):
    for xref in idautils.XrefsTo(decrypt_func_addr):
        print(f"[*] 解密函数被调用于: {hex(xref.frm)}")

1
2
3
4
5
6
7
8
9

# 推送到设备（以 arm64 为例）
adb push /path/to/ida/dbgsrv/android_server64 /data/local/tmp/
adb shell chmod 755 /data/local/tmp/android_server64

# 启动 android_server（需要 root 权限）
adb shell su -c "/data/local/tmp/android_server64 -p 23946"

# 设置端口转发
adb forward tcp:23946 tcp:23946

1
2

# 以调试模式启动应用，应用会暂停等待调试器连接
adb shell am start -D -n com.example.app/.MainActivity

1
2
3
4

import idautils
for mod in idautils.Modules():
    if "libnative.so" in mod.name:
        print(f"Base: {hex(mod.base)}, Size: {hex(mod.size)}")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

// Frida 脚本：Hook IDA 中发现的函数
var baseAddr = Module.findBaseAddress("libnative.so");
var targetFunc = baseAddr.add(0x1A2C);  // IDA 中看到的函数偏移

Interceptor.attach(targetFunc, {
    onEnter: function(args) {
        console.log("[*] sub_1A2C called!");
        console.log("    arg0 (buffer): " + args[0]);
        console.log("    arg1 (length): " + args[1].toInt32());
        if (args[1].toInt32() > 0 && args[1].toInt32() < 1024) {
            console.log("    input: " + hexdump(args[0], { length: args[1].toInt32() }));
        }
        this.buf = args[0];
        this.len = args[1].toInt32();
    },
    onLeave: function(retval) {
        console.log("    return: " + retval);
        if (this.len > 0 && this.len < 1024) {
            console.log("    output: " + hexdump(this.buf, { length: this.len }));
        }
    }
});

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# IDAPython: 为所有已命名的非库函数生成 Frida Hook 模板
import idautils, idc, ida_funcs

output = ['var base = Module.findBaseAddress("libnative.so");', ""]

for func_ea in idautils.Functions():
    name = idc.get_func_name(func_ea)
    if name.startswith("sub_") or name.startswith("."):
        continue
    func = ida_funcs.get_func(func_ea)
    if not func:
        continue
    offset = hex(func_ea)
    output.append(f'// {name}')
    output.append(f'Interceptor.attach(base.add({offset}), {{')
    output.append(f'    onEnter: function(args) {{ console.log("[{name}] called"); }},')
    output.append(f'    onLeave: function(retval) {{ console.log("[{name}] ret: " + retval); }}')
    output.append(f'}});')

with open("/tmp/frida_hooks.js", "w") as f:
    f.write("\n".join(output))
print("[+] Frida Hook 模板已导出到 /tmp/frida_hooks.js")

1
2
3
4

# 使用 IDA FLAIR 工具集：pelf 生成 PAT，sigmake 生成 SIG
./pelf $ANDROID_NDK/.../sysroot/usr/lib/aarch64-linux-android/libc.a libc_ndk.pat
./sigmake -n"Android NDK r25 libc (arm64)" libc_ndk.pat libc_ndk.sig
cp libc_ndk.sig /path/to/ida/sig/arm64/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

// my_types.h
struct aes_context {
    unsigned int round_key[60];
    int nr;                  // 轮数
    unsigned char iv[16];    // 初始化向量
    int mode;                // 0=ECB, 1=CBC, 2=CTR
};

struct JNINativeMethod {
    const char* name;
    const char* signature;
    void* fnPtr;
};