基于Xposed Hook实现的Android App的协议算法分析小工具-CryptoFucker

本文博客地址：https://blog.csdn.net/QQ1084283172/article/details/80962121

在进行Android应用的网络协议分析的时候，不可避免涉及到网络传输数据的加密算法的分析，这里分享一下作者无名侠写的一个小工具 CryptoFucker，看雪论坛的原帖子《[推荐]【Tools】CryptoFucker》.

CryptoFucker工具的github地址:https://github.com/Chenyuxin/CryptoFucker

CryptoFucker工具的使用说明:

Xposed Hook的结果日志存放路径为 /sdcard/ydsec/packgeName.txt，日志文件的格式如下图所示：

关键代码 TestHook.java 的注释和学习：

package com.example.a14473.xp;

import android.os.Bundle;
import android.support.annotation.NonNull;
import android.util.Log;

import java.io.File;
import java.io.FileWriter;
import java.io.IOException;
import java.lang.reflect.Array;
import java.util.HashMap;
import java.nio.ByteBuffer;
import java.security.Key;
import java.security.MessageDigest;
import java.security.SecureRandom;
import java.security.cert.Certificate;
import java.security.spec.KeySpec;
import java.util.Map.Entry;
import java.util.HashMap;
import java.util.Objects;

import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.spec.DESKeySpec;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.SecretKeySpec;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;

import static de.robv.android.xposed.XposedHelpers.findAndHookConstructor;
import static de.robv.android.xposed.XposedHelpers.findAndHookMethod;

import com.example.a14473.xp.HexDumper;

/**
 * Created by 14473 on 2017/7/2.
 */
public class TestHook implements IXposedHookLoadPackage {

    @Override
    public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {

    	// 打印当前Android应用的进程的名字和包名
        String logstr  = " W:" + loadPackageParam.processName + "-"+loadPackageParam.packageName;
        XposedBridge.log(logstr);
        // 这里其实可以增加一下指定名称的Android应用程序的包名的过滤

        try {

        	// 先调用函数XposedHelpers.findClass进行类的加载处理
        	// java Hook处理类javax.crypto.spec.DESKeySpec的所有构造函数
            XposedBridge.hookAllConstructors(XposedHelpers.findClass("javax.crypto.spec.DESKeySpec", loadPackageParam.classLoader),
            		new XC_MethodHook() {

                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                    super.beforeHookedMethod(param);

                    String keystr;
                    // 申请内存空间存放数据
                    byte[] keybyte = new byte[8];
                    int offset = 0;
                    // 如果有两个参数的构造函数，第二个参数是偏移
                    // param.args.length获取函数的传入参数的个数
                    if(param.args.length != 1)
                        offset = (int)param.args[1];
                    // 拷贝数据到申请的内存空间中
                    System.arraycopy((byte[])param.args[0], offset, keybyte, 0, 8);

                    // log日志文件中前置tag
                    keystr = "DES KEY";
                    // 打印数据到指定的log日志文件中
                    Util.MyLog(loadPackageParam.packageName, keystr, keybyte);
                }
            });

            // java Hook处理类"javax.crypto.spec.DESedeKeySpec"的所有构造函数
            XposedBridge.hookAllConstructors(XposedHelpers.findClass("javax.crypto.spec.DESedeKeySpec", loadPackageParam.classLoader),
            		new XC_MethodHook() {

                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                    super.beforeHookedMethod(param);

                    String keystr;
                    // 申请内存空间存放数据
                    byte[] keybyte = new byte[24];
                    int offset = 0;

                    // 如果有两个参数的构造函数，第二个参数是偏移
                    if(param.args.length != 1)
                        offset = (int)param.args[1];
                    // 拷贝数据到申请的内存空间中
                    System.arraycopy((byte[])param.args[0], offset, keybyte, 0, 24);

                    // log日志文件中前置tag
                    keystr = "3DES KEY";
                    // 打印数据到指定的log日志文件中
                    Util.MyLog(loadPackageParam.packageName,keystr,keybyte);
                }
            });

            // java Hook处理类"javax.crypto.spec.SecretKeySpec"的所有构造函数
            XposedBridge.hookAllConstructors(XposedHelpers.findClass("javax.crypto.spec.SecretKeySpec", loadPackageParam.classLoader),
            		new XC_MethodHook() {

                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                    super.beforeHookedMethod(param);

                    int offset = 0;
                    int size = 0;
                    String Algorithm;

                    if(param.args.length != 2)
                    {
                        offset = (int)param.args[1];
                        size = (int)param.args[2];
                        Algorithm = (String)param.args[3];
                    }else {
                        Algorithm = (String) param.args[1];
                        size = ((byte[])param.args[0]).length;
                    }

                    byte[] data = new byte[size];
                    System.arraycopy((byte[])param.args[0], offset, data, 0, size);

                    String str ;
                    // log日志文件中前置tag
                    str = Algorithm + " Key";
                    Util.MyLog(loadPackageParam.packageName,str,data);
                }
            });

            // IV 向量
            // java Hook处理类"javax.crypto.spec.IvParameterSpec"的所有构造函数
            XposedBridge.hookAllConstructors(XposedHelpers.findClass("javax.crypto.spec.IvParameterSpec", loadPackageParam.classLoader),
            		new XC_MethodHook() {

                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                    super.beforeHookedMethod(param);

                    String keystr;
                    byte[] IVByte;
                    byte[] tmp;
                    int offset = 0;
                    int size;
                    tmp = (byte[])param.args[0];
                    size = tmp.length;

                    // 如果有两个参数的构造函数，第二个参数是偏移
                    if(param.args.length != 1)
                    {
                        offset = (int)param.args[1];
                        size = (int)param.args[2];
                    }
                    IVByte = new byte[size];
                    System.arraycopy(tmp, offset, IVByte, 0, size);

                    // log日志文件中前置tag
                    keystr = "Iv";
                    Util.MyLog(loadPackageParam.packageName,keystr,IVByte);
                }
            });

            // java Hook处理类"javax.crypto.Cipher"中所有名称为"doFinal"的类方法
            XposedBridge.hookAllMethods(XposedHelpers.findClass("javax.crypto.Cipher", loadPackageParam.classLoader),
                    "doFinal", new XC_MethodHook() {

                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                        super.afterHookedMethod(param);

                        Cipher cip = (Cipher)param.thisObject;
                        if(param.args.length >= 1)
                        {
                            // log日志文件中前置tag
                            String str = cip.getAlgorithm() + " Data:";
                            Util.MyLog(loadPackageParam.packageName,str,(byte[])param.args[0]);

                            // log日志文件中前置tag
                            str = cip.getAlgorithm() + "  result:";
                            Util.MyLog(loadPackageParam.packageName, str, (byte[])param.getResult());
                        }
                    }
            });

            // java Hook处理类"java.security.MessageDigest"中所有名称为"update"的类方法
            XposedBridge.hookAllMethods(XposedHelpers.findClass("java.security.MessageDigest", loadPackageParam.classLoader), "update",
            		new XC_MethodHook() {

                @Override
                protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
                    super.beforeHookedMethod(param);

                    MessageDigest md = (MessageDigest)param.thisObject;
                    String str = md.getAlgorithm() + " update data:";
                    Util.MyLog(loadPackageParam.packageName, str, (byte[])param.args[0]);
                }
            });

            // java Hook处理类"java.security.MessageDigest"中所有名称"digest"的类方法
            XposedBridge.hookAllMethods(XposedHelpers.findClass("java.security.MessageDigest", loadPackageParam.classLoader), "digest",
            		new XC_MethodHook() {

                @Override
                protected void afterHookedMethod(MethodHookParam param) throws Throwable {
                    super.afterHookedMethod(param);
                    if (param.args.length >= 1)
                    {
                        MessageDigest md = (MessageDigest)param.thisObject;

                        String str;
                        str = md.getAlgorithm() + "  data:";
                        Util.MyLog(loadPackageParam.packageName,str,(byte[])param.args[0]);

                        str = md.getAlgorithm() + "  result:";
                        Util.MyLog(loadPackageParam.packageName,str,(byte[])param.getResult());
                    }
                }
            });
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

class Util {

	// 将字节数组数据转换为16进制的大写字符串
    @NonNull
    public static String byteArrayToString(byte[] bytes) {

        String hs = "";
        String tmp = "";
        for (int n = 0; n < bytes.length; n++) {

            //整数转成十六进制表示
            tmp = (java.lang.Integer.toHexString(bytes[n] & 0XFF));
            if (tmp.length() == 1) {

                hs = hs + "0" + tmp;
            } else {

                hs = hs + tmp;
            }
        }
        tmp = null;

        //转成大写
        return hs.toUpperCase();
    }

    // 获取类方法堆栈调用的信息字符串
    public static String GetStack()
    {
        String result = "";
        Throwable ex = new Throwable();
        StackTraceElement[] stackElements = ex.getStackTrace();
        if (stackElements != null) {

            int range_start = 3;
            int range_end = Math.min(stackElements.length, 7);
            if(range_end < range_start)
                return  "";
            // 获取合理调用层次的堆栈信息
            for (int i = range_start; i < range_end; i++) {

                result = result + (stackElements[i].getClassName()+"->"); 	// 类的名称
                result = result + (stackElements[i].getMethodName())+"  ";	// 类方法的名称
                result = result + (stackElements[i].getFileName()+"(");		// 源码文件的名称
                result = result + (stackElements[i].getLineNumber()+")\n");	// 源码在文件中的行号
                result = result + ("----------------------------------\n");
            }
        }
        return result;
    }

    // 打印的log日志文件的名称格式为/sdcard/ydsec/packgeName.txt
    // ++++++ 注意是否有对sdcard文件目录的写操作权限 +++++++++++
    public  static void MyLog(String packname, String info, byte[] data)
    {
    	// 创建文件目录"/sdcard/ydsec/"
        String path = "/sdcard/ydsec/";
        File pather = new File(path);
        if(!pather.exists())
             pather.mkdir();
        // 拼接字符串得到log日志文件的路径
        String filename = path + packname+".txt";
        if(data.length >= 256)
            return;

        try
        {
        	// 1.前置tag显示字符串
            info = info + "\n";
            // 2.类方法调用堆栈的信息
            info = info + GetStack() + "\n";
            // 3.需要打印的关键加密算法的数据信息
            info = info + HexDumper.dumpHexString(data) + "\n-------------------------------------------------\n\n";

            // 创建保存Log日志的文件/sdcard/ydsec/packgeName.txt
            FileWriter fw = new FileWriter(filename, true);
            // 将需要保存的数据信息写入到Log日志文件/sdcard/ydsec/packgeName.txt中
            fw.write(info);
            fw.close();

            // 打印log日志
            Log.d("q_"+packname,info);
            XposedBridge.log("["+ packname+"]"+info);

        } catch(IOException e)
        {
            e.printStackTrace();
        }
    }
}

格式化打印Log日志的代码文件 HexDumper.java 的注释和学习：

package com.example.a14473.xp;

public class HexDumper
{

    private final static char[] HEX_DIGITS = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
    	'A', 'B', 'C', 'D', 'E', 'F' };

    // 将字节数组的数据转换为16进制的字符串数据
    public static String dumpHexString(byte[] array)
    {
        if (array.equals(null))
            return "null";
        // 申请内存空间
        byte[] byte2 = new byte[array.length + 0x10];
        // 内存空间清零
        for(int i = 0; i < byte2.length; i++)
        {
            byte2[i] = 0;
        }

        // 将传入的字节数组中的数据拷贝到新数组中
        for(int i = 0; i < array.length; i++)
        {
            byte2[i] = array[i];
        }

        // 将字节数组数据转换为16进制的字符串数据
        return dumpHexString(byte2, 0, byte2.length);
    }

    // 将字节数组数据转换为16进制的字符串数据
    public static String dumpHexString(byte[] array, int offset, int length)
    {
        StringBuilder result = new StringBuilder();
        byte[] line = new byte[16];
        int lineIndex = 0;

        // 打印数据的偏移
        result.append("\n0x");
        // 将整型字节数组偏移转换为16进制字符串数据
        result.append(toHexString(offset));

        for (int i = offset; i < offset + length; i++)
        {
            if (lineIndex == 16)
            {
                result.append(" ");

                for (int j = 0 ; j < 16 ; j++)
                {
                    if (line[j] > ' ' && line[j] < '~')
                    {
                        result.append(new String(line, j, 1));
                    }
                    else
                    {
                        result.append(".");
                    }
                }
                // 打印数据的偏移
                result.append("\n0x");
                result.append(toHexString(i));
                lineIndex = 0;
            }

            byte b = array[i];
            result.append(" ");
            result.append(HEX_DIGITS[(b >>> 4) & 0x0F]);
            result.append(HEX_DIGITS[b & 0x0F]);

            line[lineIndex++] = b;
        }

        if (lineIndex != 16)
        {
            int count = (16 - lineIndex) * 3;
            count++;
            for (int i = 0 ; i < count ; i++)
            {
                result.append(" ");
            }

            for (int i = 0 ; i < lineIndex ; i++)
            {
                if (line[i] > ' ' && line[i] < '~')
                {
                    result.append(new String(line, i, 1));
                }
                else
                {
                    result.append(".");
                }
            }
        }
        return result.toString();
    }

    // 将单字节数组转化为16进制的字符串
    public static String toHexString(byte b)
    {
    	// 将字节数组转换为16进制的字符串数据
        return toHexString(toByteArray(b));
    }

    // 将字节数组转换为16进制的字符串数据
    public static String toHexString(byte[] array)
    {
    	// 将指定字节数组的指定偏移位置指定长度的字节数据转换为16进制字符串进行显示
        return toHexString(array, 0, array.length);
    }

    // 将指定字节数组的指定偏移位置指定长度的字节数据转换为16进制字符串进行显示
    public static String toHexString(byte[] array, int offset, int length)
    {
    	// 申请内存空间存放字符数组
        char[] buf = new char[length * 2];
        int bufIndex = 0;

        for (int i = offset ; i < offset + length; i++)
        {
        	// 取传入数组中的1字节数据
            byte b = array[i];
            // 取字节数据中高4位的数据转换为16进制字符串
            buf[bufIndex++] = HEX_DIGITS[(b >>> 4) & 0x0F];
            // 取字节数据中低4位的数据转换为16进制字符串
            buf[bufIndex++] = HEX_DIGITS[b & 0x0F];
        }
        // 返回最终转换成功的字符串
        return new String(buf);
    }

    // 将int整型数组转换为16进制的字符串进行显示
    public static String toHexString(int i)
    {
        // 将字节数组转换为16进制的字符串数据
        return toHexString(toByteArray(i));
    }

    // 将单字节数组转化为字节数组进行存储
    public static byte[] toByteArray(byte b)
    {
        byte[] array = new byte[1];
        array[0] = b;

        return array;
    }

    // 将int整型数转换为4字节的字节数组
    public static byte[] toByteArray(int i)
    {
        byte[] array = new byte[4];
        array[3] = (byte)(i & 0xFF);
        array[2] = (byte)((i >> 8) & 0xFF);
        array[1] = (byte)((i >> 16) & 0xFF);
        array[0] = (byte)((i >> 24) & 0xFF);

        return array;
    }

    // 将单个字符转换为整型
    private static int toByte(char c)
    {
        if (c >= '0' && c <= '9') return (c - '0');
        if (c >= 'A' && c <= 'F') return (c - 'A' + 10);
        if (c >= 'a' && c <= 'f') return (c - 'a' + 10);

        throw new RuntimeException ("Invalid hex char '" + c + "'");
    }

    // 将字符串数据转换为相应的字节数组数据进行存储
    public static byte[] hexStringToByteArray(String hexString)
    {
        int length = hexString.length();
        byte[] buffer = new byte[length / 2];
        // 每次处理2个字符的字符串
        for (int i = 0 ; i < length ; i += 2)
        {
        	// 例如将"23"转换为0x23
            buffer[i / 2] = (byte)((toByte(hexString.charAt(i)) << 4) | toByte(hexString.charAt(i+1)));
        }
        return buffer;
    }
}

后面我会再写个类似的简单小工具~