Coco2d-x引擎是相对于Unity3D的又一实力派引擎,虽然随着3D游戏的热门,更多的厂商偏向于Unity3D,但是Coco2d-x的普及量也不容小觑,特别是一些比较大的手游公司,比如触控科技仍然一直沿用着Coco2d-x的东西。我们从三个热门游戏来说说Coco2d-x游戏的一般文件验证方法。 |
竟然闪退那必然会在主Activity的oncreate中启动相关代码。下面是流程:
- 该种方法最早见于:http://bbs.csdn.net/topics/390598569?page=2#post-395954285
注意:class A extends B 表示A类承接B类,即B是A的相对父类。从而知 Cocos2dxActivity 是程序启动时的根类,查看 oncreate 方法:
- public class FishingJoy extends FishingJoyWrapper-->public class FishingJoyWrapper extends Cocos2dxActivity-->public abstract class Cocos2dxActivity extends Activity;
又转向至 Cocos2dxHelper 类的 init 方法中,下面是其主要的smali代码:
- protected void onCreate(Bundle paramBundle)
- {
- super.onCreate(paramBundle);
- init();
- Cocos2dxHelper.init(this,this);
- }
- <pre name="code" class="javascript"> //“参考文章:http://android.tgbus.com/Android/tutorial/201108/362210.shtml”
- //通过ApplicationInfo类中的packageName方法获取程序名称并保存在sPackageName字符串中
- iget-object v1,v0,Landroid/content/pm/ApplicationInfo;->packageName:Ljava/lang/String;
- sput-object v1,Lorg/cocos2dx/lib/Cocos2dxHelper;->sPackageName:Ljava/lang/String;
- //通过ApplicationInfo类中的sourceDir方法获取APK程序的路径,并传递给native层
- iget-object v1,Landroid/content/pm/ApplicationInfo;->sourceDir:Ljava/lang/String;
- invoke-static {v1},Lorg/cocos2dx/lib/Cocos2dxHelper;->nativeSetApkPath(Ljava/lang/String;)V
通过以上分析我们很容易得出,只需将获取APK路径的v1转向原版的APK即可绕过程序的校验。代码修改为:
需要的操作是将原版apk更名为buyudaren.apk放在sdcard的根目录即可。
- iget-object v1,Landroid/content/pm/ApplicationInfo;->sourceDir:Ljava/lang/String;
- const-string v1,"/sdcard/buyudaren.apk"
- invoke-static {v1},Lorg/cocos2dx/lib/Cocos2dxHelper;->nativeSetApkPath(Ljava/lang/String;)V
分析的流程是于捕鱼达人2一样的,知道这样我们可以直接搜索关键词“->sourceDir:”,出现两个结果,如下图:
这个游戏整体反编译apk的时候 会出现错误,貌似是资源文件的问题,但是我们可以直接拖出dex反编译。
- 3、保卫萝卜 Ver1.2.0:
同样是直接搜索“->sourceDir:”,然后将路径指定就行。
总结
就像以前在博客中说的,如果不对apk进行加壳或者利用第三方进行防护的话,apk本身的校验貌似真的只有签名校验和对文件的合法性进行验证。
无论是在smali、so还是dll,签名关键词“signature”或者“publickey”,pubkey 关键词的会获取一串MD5的值;
- .method public static getSign(Landroid/content/Context;)Ljava/lang/String;
- .locals 6
- .param p0,"context" # Landroid/content/Context;
- //########################下面是签名校验的部分###########################
- .prologue
- .line 374
- //初始化v4为空
- const-string v4,""
- //读取com/txbnx/torrentsearcher/Utils方法中的mPublicKey字符串 赋给v5
- sget-object v5,Lcom/txbnx/torrentsearcher/Utils;->mPublicKey:Ljava/lang/String;
- //判断v4,v5是否相等 并返回为v4布尔值
- invoke-virtual {v4,v5},Ljava/lang/String;->equals(Ljava/lang/Object;)Z
- move-result v4
- if-nez v4,:cond_0
- .line 375
- sget-object v4,Lcom/txbnx/torrentsearcher/Utils;->mPublicKey:Ljava/lang/String;
- .line 385
- :goto_0
- return-object v4
- .line 376
- :cond_0
- //引用获取已安装包信息的方法getPackageManager()
- invoke-virtual {p0},Landroid/content/Context;->getPackageManager()Landroid/content/pm/PackageManager;
- move-result-object v2
- .line 378
- .local v2,"pm":Landroid/content/pm/PackageManager;
- :try_start_0
- //获取包名字符串并保存在v4中
- invoke-virtual {p0},Landroid/content/Context;->getPackageName()Ljava/lang/String;
- move-result-object v4
- const/16 v5,0x40
- invoke-virtual {v2,v4,Landroid/content/pm/PackageManager;->getPackageInfo(Ljava/lang/String;I)Landroid/content/pm/PackageInfo;
- move-result-object v1
- .line 380
- .local v1,"packageinfo":Landroid/content/pm/PackageInfo;
- //获取包信息里面的签名
- iget-object v4,v1,Landroid/content/pm/PackageInfo;->signatures:[Landroid/content/pm/Signature;
- const/4 v5,0x0
- aget-object v3,v5
- .line 382
- .local v3,"sign":Landroid/content/pm/Signature;
- //将签名信息转换为字符串 并保存在v4寄存器中
- invoke-virtual {v3},Landroid/content/pm/Signature;->tochaRSString()Ljava/lang/String;
- move-result-object v4
- sput-object v4,Lcom/txbnx/torrentsearcher/Utils;->mPublicKey:Ljava/lang/String;
- .line 383
- sget-object v4,Lcom/txbnx/torrentsearcher/Utils;->mPublicKey:Ljava/lang/String;
- :try_end_0
- .catch Ljava/lang/Exception; {:try_start_0 .. :try_end_0} :catch_0
- goto :goto_0
- .line 384
- .end local v1 # "packageinfo":Landroid/content/pm/PackageInfo;
- .end local v3 # "sign":Landroid/content/pm/Signature;
- :catch_0
- move-exception v0
- .line 385
- .local v0,"e":Ljava/lang/Exception;
- const/4 v4,0x0
- goto :goto_0
- .end method
文件检验首先是获取文件的路径,或者直接文件名,关键词“classes.dex”或者“->sourceDir:”,后者获取路径以后会传入其他的方法进行验证,如so方法。
- .local v0,"pubkeyMd5":Ljava/lang/String;
- const-string v1,"SigntureUtil"
- //##########################################下面是利用pubkey关键词校验的代码########################################
- new-instance v2,Ljava/lang/StringBuilder;
- invoke-direct {v2},Ljava/lang/StringBuilder;-><init>()V
- const-string v3,"pubkeyMd5:"
- invoke-virtual {v2,v3},Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
- move-result-object v2
- invoke-virtual {v2,v0},Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;
- move-result-object v2
- invoke-virtual {v2},Ljava/lang/StringBuilder;->toString()Ljava/lang/String;
- move-result-object v2
- invoke-static {v1,v2},Lcn/com/cmbc/mbank/Log;->i(Ljava/lang/String;Ljava/lang/String;)V
- .line 68
- if-eqz v0,:cond_0
- const-string v1,"e6a81c9a3c88040678ae615f063d14d0"
- invoke-virtual {v1,Ljava/lang/String;->equals(Ljava/lang/Object;)Z
- move-result v1
- const/4 v1,0x1
里面里面会有很多的错误之处,望大牛们不吝指出啊!不让让我以讹传讹啊 我要进步..