`
xidajiancun
  • 浏览: 449344 次
文章分类
社区版块
存档分类
最新评论

iOS安全攻防(六):使用class-dump-z分析支付宝app

 
阅读更多

使用class-dump-z分析支付宝app



为了了解支付宝app的源码结构,我们可以使用class-dump-z工具来分析支付宝二进制。


1.下载配置class_dump_z


前往 https://code.google.com/p/networkpx/wiki/class_dump_z ,下载tar包,然后解压配置到本地环境

$ tar -zxvf class-dump-z_0.2a.tar.gz
$ sudo cp mac_x86/class-dump-z /usr/bin/



2.class_dump支付宝app


$ class-dump-z Portal > Portal-dump.txt

@protocol XXEncryptedProtocol_10764b0
-(?)XXEncryptedMethod_d109df;
-(?)XXEncryptedMethod_d109d3;
-(?)XXEncryptedMethod_d109c7;
-(?)XXEncryptedMethod_d109bf;
-(?)XXEncryptedMethod_d109b8;
-(?)XXEncryptedMethod_d109a4;
-(?)XXEncryptedMethod_d10990;
-(?)XXEncryptedMethod_d1097f;
-(?)XXEncryptedMethod_d10970;
-(?)XXEncryptedMethod_d10968;
-(?)XXEncryptedMethod_d10941;
-(?)XXEncryptedMethod_d10925;
-(?)XXEncryptedMethod_d10914;
-(?)XXEncryptedMethod_d1090f;
-(?)XXEncryptedMethod_d1090a;
-(?)XXEncryptedMethod_d10904;
-(?)XXEncryptedMethod_d108f9;
-(?)XXEncryptedMethod_d108f4;
-(?)XXEncryptedMethod_d108eb;
@optional
-(?)XXEncryptedMethod_d109eb;
@end

查看得到的信息是加过密的,这个加密操作是苹果在部署到app store时做的,所以我们还需要做一步解密操作。



3.使用Clutch解密支付宝app


1)下载Clutch
iOS7越狱后的Cydia源里已经下载不到Clutch了,但是我们可以从网上下载好推进iPhone
地址:Clutch传送门


2)查看可解密的应用列表

root# ./Clutch 

Clutch-1.3.2
usage: ./Clutch [flags] [application name] [...]
Applications available: 9P_RetinaWallpapers breadtrip Chiizu CodecademyiPhone FisheyeFree food GirlsCamera IMDb InstaDaily InstaTextFree iOne ItsMe3 linecamera Moldiv MPCamera MYXJ NewsBoard Photo Blur Photo Editor PhotoWonder POCO相机 Portal QQPicShow smashbandits Spark tripcamera Tuding_vITC_01 wantu WaterMarkCamera WeiBo Weibo  


3)解密支付宝app

root# ./Clutch Portal

Clutch-1.3.2
Cracking Portal...
Creating working directory...
Performing initial analysis...
Performing cracking preflight...
dumping binary: analyzing load commands
dumping binary: obtaining ptrace handle
dumping binary: forking to begin tracing
dumping binary: successfully forked
dumping binary: obtaining mach port
dumping binary: preparing code resign
dumping binary: preparing to dump
dumping binary: ASLR enabled, identifying dump location dynamically
dumping binary: performing dump
dumping binary: patched cryptid
dumping binary: writing new checksum
Censoring iTunesMetadata.plist...
Packaging IPA file...

compression level: 0
	/var/root/Documents/Cracked/支付宝钱包-v8.0.0-(Clutch-1.3.2).ipa

elapsed time: 7473ms

Applications Cracked: 
Portal

Applications that Failed:

Total Success: 1 Total Failed: 0



4)导出已解密的支付宝app

从上一步骤得知,已解密的ipa位置为:/var/root/Documents/Cracked/支付宝钱包-v8.0.0-(Clutch-1.3.2).ipa
将其拷贝到本地去分析




4.class_dump已解密的支付宝app


解压.ipa后,到 支付宝钱包-v8.0.0-(Clutch-1.3.2)/Payload/Portal.app 目录下,class_dump已解密的二进制文件

$ class-dump-z Portal > ~/Portal-classdump.txt

这回就可以得到对应的信息了:

@protocol ALPNumPwdInputViewDelegate <NSObject>
-(void)onPasswordDidChange:(id)onPassword;
@end

@protocol ALPContactBaseTableViewCellDelegate <NSObject>
-(void)shareClicked:(id)clicked sender:(id)sender;
@end

@interface MMPPayWayViewController : XXUnknownSuperclass <SubChannelSelectDelegate, UITableViewDataSource, UITableViewDelegate, CellDelegate, UIAlertViewDelegate> {
@private
	Item* channelSelected;
	BOOL _bCheck;
	BOOL _bOpenMiniPay;
	BOOL _bNeedPwd;
	BOOL _bSimplePwd;
	BOOL _bAutopayon;
	BOOL _bHasSub;
	BOOL _bFirstChannel;
	BOOL _bChangeSub;
	BOOL _bClickBack;
	UITableView* _channelListTableView;
	NSMutableArray* _channelListArray;
	NSMutableArray* _subChanneSelectedlList;
	NSMutableArray* _unCheckArray;
	UIButton* _saveButton;
	UILabel* _tipLabel;
	MMPPasswordSwichView* _payWaySwitch;
	MMPPopupAlertView* _alertView;
	UIView* _setView;
	int _originalSelectedRow;
	int _currentSelectedRow;
	NSString* _statusCode;
	ChannelListModel* _defaultChannelList;
}
@property(assign, nonatomic) BOOL bClickBack;
@property(retain, nonatomic) ChannelListModel* defaultChannelList;
@property(retain, nonatomic) NSString* statusCode;
@property(assign, nonatomic) int currentSelectedRow;
@property(assign, nonatomic) int originalSelectedRow;
@property(retain, nonatomic) UIView* setView;
@property(retain, nonatomic) MMPPopupAlertView* alertView;
@property(retain, nonatomic) MMPPasswordSwichView* payWaySwitch;
@property(assign, nonatomic, getter=isSubChannelChanged) BOOL bChangeSub;
@property(assign, nonatomic) BOOL bFirstChannel;
@property(assign, nonatomic) BOOL bHasSub;
@property(assign, nonatomic) BOOL bAutopayon;
@property(assign, nonatomic) BOOL bSimplePwd;
@property(assign, nonatomic) BOOL bNeedPwd;
@property(assign, nonatomic) BOOL bOpenMiniPay;
@property(assign, nonatomic) BOOL bCheck;
@property(retain, nonatomic) UILabel* tipLabel;
@property(retain, nonatomic) UIButton* saveButton;
@property(retain, nonatomic) NSMutableArray* unCheckArray;
@property(retain, nonatomic) NSMutableArray* subChanneSelectedlList;
@property(retain, nonatomic) NSMutableArray* channelListArray;
@property(retain, nonatomic) UITableView* channelListTableView;
-(void).cxx_destruct;
-(void)subChannelDidSelected:(id)subChannel;
-(void)switchCheckButtonClicked:(id)clicked;
-(void)checkboxButtonClicked:(id)clicked;
-(void)onCellClick:(id)click;
-(void)showSubChannels;
-(void)tableView:(id)view didSelectRowAtIndexPath:(id)indexPath;
-(id)tableView:(id)view cellForRowAtIndexPath:(id)indexPath;
-(int)tableView:(id)view numberOfRowsInSection:(int)section;
-(float)tableView:(id)view heightForRowAtIndexPath:(id)indexPath;
-(int)numberOfSectionsInTableView:(id)tableView;
-(void)setTableViewFootView:(id)view;
-(void)setTableViewHeaderView:(id)view;
-(id)tableView:(id)view viewForHeaderInSection:(int)section;
-(id)tableView:(id)view viewForFooterInSection:(int)section;
-(float)tableView:(id)view heightForHeaderInSection:(int)section;
-(float)tableView:(id)view heightForFooterInSection:(int)section;
-(void)alertView:(id)view clickedButtonAtIndex:(int)index;
-(void)clickSave;
-(void)netWorkRequestWithPwd:(id)pwd;
-(void)setPayWaySwitchStates:(id)states;
-(void)changePayWaySwitch:(id)aSwitch;
-(void)scrollToSelectedRow;
-(void)didReceiveMemoryWarning;
-(void)viewDidLoad;
-(void)applicationEnterBackground:(id)background;
-(void)dealloc;
-(void)goBack;
-(BOOL)isChannelsSetChanged;
-(id)subChannelCode:(int)code;
-(id)subChannelDesc:(int)desc;
-(id)initWithDefaultData:(id)defaultData;
-(id)initWithNibName:(id)nibName bundle:(id)bundle;
-(void)commonInit:(id)init;
@end



5.分析支付宝源码片段


1)使用了@private关键字限制成员访问权限
但是实际上,在Objective-C编程中,使用@private连Keypath访问都拦不住的


2)抛出了冗长的成员对象
这非常有利分析程序结构




6.进一步思考


1)如何利用 class-dump 结果,结合 cycript 进行攻击呢?
2)class-dump-z 如此强大,有什么方法可以减少暴露的信息吗?


接下来的博文将针对上面的思考,继续总结~



分享到:
评论

相关推荐

    class-dump, class-dump-z.exe,class-dump-z win版本

    class-dump, class-dump-z.exe,class-dump-z win版本

    class-dump ios9

    解决ios sdk9 无法class-dump导出framework头文件 也可以自己重新编译一份https://github.com/nygard/class-dump

    class-dump-z全平台版本(linux、iPhone、Windows)

    class-dump-z全平台版本(linux、iPhone、Windows)

    class-dump-z.zip

    class-dump-z.zip资源包分享,支持win/linux/mac/iphone等,提供大家参考使用“使用class-dump-z分析支付宝app”,附链接:http://blog.csdn.net/yiyaaixuexi/article/details/18353423

    class-dump-z

    class-dump工具,针对iOS 导出头文件。

    class-dump-z_0.2-0.tar.gz

    生成非官方iphone ...class-dump -H Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator2.1.sdk/System/Library/CoreServices/SpringBoard.app/SpringBoard -o ~/Desktop/SpringBoard

    class-dump-z_0.2-0.tar

    (看到一哥们下载要5分。...class-dump -H Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator2.1.sdk/System/Library/CoreServices/SpringBoard.app/SpringBoard -o ~/Desktop/SpringBoard

    class-dump-z_0.2-0

    class-dump变种,官方文件下载。支持:iPhone_armv6、linux_x86、mac_x86、win_x86

    class-dump-3.5

    class-dump-3.5

    class-dump-3.3.3.dmg

    生成非官方iphone ...class-dump -H Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator4.1.sdk/System/Library/CoreServices/SpringBoard.app/SpringBoard -o ~/Desktop/SpringBoard

    Objective-C头文件导出工具class-dump

    Objective-C头文件导出工具class-dump 。 Current version: 3.4 (64 bit Intel) Requires Mac OS X 10.7 or later. class-dump 3.4 (64 bit) Usage: class-dump [options] &lt;mach-o-file&gt; where options are: -a ...

    class-dump 3.5 最新版本

    class-dump的3.5版本 ,主要用于ios程序反编译 查看源码 查看混淆效果

    class-dump for ios9

    https://github.com/nygard/class-dump编译出来的解决ios sdk9 无法class-dump导出framework头文件的问题

    class-dump:从Mach-O文件生成Objective-C标头

    class-dump是一个命令行实用程序,用于检查Mach-O文件的Objective-C段。 它为类,类别和协议生成声明。 这是使用'otool -ov'提供的相同信息,但以普通的Objective-C声明形式提供。 最新版本和信息可在以下位置获得...

    parallel-fastq-dump:并行fastq-dump包装器

    提示使用fastq-dump下载很慢,即使有多个线程,也建议在使用fastq-dump之前使用prefetch来下载目标fastq-dump文件,这样fastq-dump将只需要进行转储。 所有其他参数将直接传递给fastq-dump ,-- --gzip ,-- --split...

    class-dump3.5

    用于获取iOS 私有api,此版本目前可用,使用方法参考我博客

    Hikari-LLVM15.0.0.zip 支持Xcode14 混淆代码 防止破解

    启用反class-dump: -mllvm -enable-acdobf 启用基于寄存器的相对跳转,配合其他加固可以彻底破坏IDA/Hopper的伪代码(俗称F5): -mllvm -enable-indibran 启用字符串加密: -mllvm -enable-strcry 启用函数封装:...

    etcd-dump:命令行实用程序,用于dumprestoring etcd

    $ etcd-dump dump // outputs an etcd_dump.json 恢复中: $ etcd-dump restore Restored successfuly // Reads in the etcd_dump.json and restores it ' s values to the DB 帮助 : $ etcd-dump Usage: etcd-...

    class-dump-3.5.dmg.zip_iOS逆向_ios逆向工具

    class-dump是ios逆向工具必不可少的一款获取头文件的工具

Global site tag (gtag.js) - Google Analytics