Link to this headingRadare2

Redare2 Book
https://github.com/radareorg/awesome-radare2

Plugins:
Diaphora, a Free and Open Source program diffing tool
Use a local instance of retdec to decompile functions in radare2
Snowman Decompiler for r2

Link to this headingOptions

e emu.str=true;

Link to this headingCommands

Get all function addresses from file:

>>> radare2 -A -q -c "afl ~[0]" ./libMMProtocalJni.so r_config_set: variable 'asm.relsub' not found 0x00031200 0x00044ecc 0x0005205c 0x00052040 0x0005200c 0x00051f54 0x0005204c 0x0005203c 0x00051f44 0x00051f50 0x00051fbc 0x00052048 0x00052050 0x00052038 0x00051fe0 0x00051f90

Get all Exported Functions:

>>> radare2 -A -q -c "iE ~[1,6]" ./libMMProtocalJni.so r_config_set: variable 'asm.relsub' not found paddr lib 0x0005205c Java_com_tencent_mm_protocal_MMProtocalJni_genSignature 0x00052040 Java_com_tencent_mm_protocal_MMProtocalJni_rsaPublicEncrypt 0x0005200c Java_com_tencent_mm_protocal_MMProtocalJni_unpack 0x00051f54 Java_com_tencent_mm_protocal_MMProtocalJni_pack 0x0005204c Java_com_tencent_mm_protocal_MMProtocalJni_computerKeyWithAllStr 0x0005203c Java_com_tencent_mm_protocal_MMProtocalJni_aesDecryptFile 0x00051f44 Java_com_tencent_mm_protocal_MMProtocalJni_mergeSyncKey 0x00051f50 Java_com_tencent_mm_protocal_MMProtocalJni_setIsLite 0x00051fbc Java_com_tencent_mm_protocal_MMProtocalJni_packHybridEcdh 0x00052048 Java_com_tencent_mm_protocal_MMProtocalJni_generateECKey 0x00052050 Java_com_tencent_mm_protocal_MMProtocalJni_genClientCheckKVRes 0x00052038 Java_com_tencent_mm_protocal_MMProtocalJni_aesEncrypt 0x00051fe0 Java_com_tencent_mm_protocal_MMProtocalJni_packDoubleHybrid 0x00051f90 Java_com_tencent_mm_protocal_MMProtocalJni_packHybrid 0x00000107 WX_BUILD_INFO 0x00051f4c Java_com_tencent_mm_protocal_MMProtocalJni_setClientPackVersion 0x00051f3c Java_com_tencent_mm_protocal_MMProtocalJni_setProtocalJniLogLevel 0x00052034 Java_com_tencent_mm_protocal_MMProtocalJni_aesDecrypt 0x00052018 Java_com_tencent_mm_protocal_MMProtocalJni_decodeSecureNotifyData 0x00052044 Java_com_tencent_mm_protocal_MMProtocalJni_rsaPublicEncryptPemkey 0x00051f48 Java_com_tencent_mm_protocal_MMProtocalJni_verifySyncKey

Get Linked Libraries:

il [Linked libraries] libc++_shared.so libwechatxlog.so libz.so libwechatnormsg.so libc.so libm.so libdl.so 7 libraries

List strings:

>>> radare2 -A -q -c "iz" /bin/ls Warning: run r2 with -e bin.cache=true to fix relocations in disassembly [Strings] nth paddr vaddr len size section type string ――――――――――――――――――――――――――――――――――――――――――――――――――――――― 0 0x00019650 0x00019650 11 12 .rodata ascii dev_ino_pop 1 0x000196c8 0x000196c8 10 11 .rodata ascii sort_files 2 0x000196d3 0x000196d3 6 7 .rodata ascii posix- 3 0x000196da 0x000196da 4 5 .rodata ascii main 4 0x00019790 0x00019790 10 11 .rodata ascii ?pcdb-lswd 5 0x000197a0 0x000197a0 65 66 .rodata ascii # Configuration file for dircolors, a utility to help you set the 6 0x000197e2 0x000197e2 72 73 .rodata ascii # LS_COLORS environment variable used by GNU ls with the --color option.

List strings and what function they are referenced:

>>> radare2 -A -q -c "axt @ @ str.*" /bin/ls Warning: run r2 with -e bin.cache=true to fix relocations in disassembly main 0x5b76 [DATA] lea rcx, str.dev_ino_pop fcn.000080a0 0x828c [DATA] lea rcx, str.sort_files main 0x4e58 [DATA] lea rbp, str.posix_ (nofunc) 0x5aa6 [DATA] lea rcx, str.main (nofunc) 0x5b32 [DATA] lea rcx, str.main fcn.0000b930 0xbbd6 [DATA] lea rdx, str._pcdb_lswd main 0x566b [DATA] lea r12, str._Configuration_file_for_dircolors__a_utility_to_help_you_set_the main 0x5690 [DATA] lea rsi, str._Configuration_file_for_dircolors__a_utility_to_help_you_set_the (nofunc) 0x19a05 [CODE] jb str.TERM_gnome (nofunc) 0x19adc [CODE] jns str.TERM_rxvt fcn.0000ac90 0xae4f [DATA] mov rax, qword [str..t7z_01_31]

Ghidra C Decomplation:

[0x000040d0]> pdg Do you want to print 1247 lines? (y/N) [...] (*_reloc.error)(2, 0, uVar7, uVar8); code_r0x00005afb: *(undefined4 *)(puVar22 + -4) = 0x5b04; fcn.000160c0((int64_t)piVar6); *(undefined8 *)(puVar22 + -4) = 0x5b1b; uVar8 = (*_reloc.dcgettext)(0, "ignoring invalid value of environment variable QUOTING_STYLE: %s", 5); *(undefined8 *)(puVar22 + -4) = 0x5b2d; (*_reloc.error)(0, 0, uVar8); puVar18 = puVar22 + 4; code_r0x0000558e: puVar11 = (undefined4 *)puVar18; *(undefined4 *)((int64_t)puVar11 + 8) = 7; if (*(uint32_t *)0x241e0 != 1) goto code_r0x000042ec; *(undefined8 *)((int64_t)puVar11 + -8) = 0x55a8; cVar2 = fcn.000060a0(); if (cVar2 != '\0') goto code_r0x000055b0; goto code_r0x000042f8; code_r0x000055b0: *(undefined4 *)((int64_t)puVar11 + 8) = 3; goto code_r0x000042ec; }

Ghidra ASM Decomplation:

[0x000040d0]> pdd [...] label_115: rax = fcn_000160c0 (r12); edx = 5; r12 = rax; rax = dcgettext (0, "invalid time style format %s"); rcx = r12; esi = 0; edi = 2; rdx = rax; eax = 0; error (); label_109: rax = fcn_000160c0 (rbp); edx = 5; r12 = rax; rax = dcgettext (0, "ignoring invalid value of environment variable QUOTING_STYLE: %s"); rcx = r12; esi = 0; edi = 0; rdx = rax; eax = 0; eax = error (); goto label_49; label_82: r8 = optarg; fcn_000171d0 (eax, var_40h, 0, r12); label_68: fcn_00016f40 (rdi); label_76: rcx = "dev_ino_pop"; edx = 0x41d; rsi = "src/ls.c"; rdi = "dev_ino_size <= obstack_object_size (&dev_ino_obstack)"; assert_fail ();

Bypass Ptrace:

(hooker, dr rax=0, dc);db $$+5 @@=`axt sym.imp.ptrace~CALL~call[1]`;dbc $$+5 .(hooker) @@=`axt sym.imp.ptrace~CALL~call[1]` #bypass ptrace debugging detection

Link to this headingAndroid Frida

Connect to App through Frida:

r2 frida://usb//sg.vantagepoint.helloworldjni [0x00000000]> \i arch arm bits 64 os linux pid 13215 uid 10096 objc false runtime V8 java true cylang false pageSize 4096 pointerSize 8 codeSigningPolicy optional isDebuggerAttached false cwd / dataDir /data/user/0/sg.vantagepoint.helloworldjni codeCacheDir /data/user/0/sg.vantagepoint.helloworldjni/code_cache extCacheDir /storage/emulated/0/Android/data/sg.vantagepoint.helloworldjni/cache obbDir /storage/emulated/0/Android/obb/sg.vantagepoint.helloworldjni filesDir /data/user/0/sg.vantagepoint.helloworldjni/files noBackupDir /data/user/0/sg.vantagepoint.helloworldjni/no_backup codePath /data/app/sg.vantagepoint.helloworldjni-1/base.apk packageName sg.vantagepoint.helloworldjni androidId c92f43af46f5578d cacheDir /data/local/tmp jniEnv 0x7d30a43c60

Searching for Strings through Memory:

[0x00000000]> \/ Hello Searching 5 bytes: 48 65 6c 6c 6f ... hits: 11 0x13125398 hit0_0 HelloWorldJNI 0x13126b90 hit0_1 Hello World! 0x1312e220 hit0_2 Hello from C++ 0x70654ec5 hit0_3 Hello 0x7d1c499560 hit0_4 Hello from C++ 0x7d1c4a9560 hit0_5 Hello from C++ 0x7d1c51cef9 hit0_6 HelloWorldJNI 0x7d30ba11bc hit0_7 Hello World! 0x7d39cd796b hit0_8 Hello.java 0x7d39d2024d hit0_9 Hello; 0x7d3aa4d274 hit0_10 Hello

Finding the location in memory:

[0x00000000]> \dm.@@ hit0_* 0x0000000013100000 - 0x0000000013140000 rw- /dev/ashmem/dalvik-main space (region space) (deleted) 0x0000000013100000 - 0x0000000013140000 rw- /dev/ashmem/dalvik-main space (region space) (deleted) 0x0000000013100000 - 0x0000000013140000 rw- /dev/ashmem/dalvik-main space (region space) (deleted) 0x00000000703c2000 - 0x00000000709b5000 rw- /data/dalvik-cache/arm64/system@[email protected] 0x0000007d1c499000 - 0x0000007d1c49a000 r-x /data/app/sg.vantagepoint.helloworldjni-1/lib/arm64/libnative-lib.so 0x0000007d1c4a9000 - 0x0000007d1c4aa000 r-- /data/app/sg.vantagepoint.helloworldjni-1/lib/arm64/libnative-lib.so 0x0000007d1c516000 - 0x0000007d1c54d000 r-- /data/app/sg.vantagepoint.helloworldjni-1/base.apk 0x0000007d30a00000 - 0x0000007d30c00000 rw- 0x0000007d396bc000 - 0x0000007d3a998000 r-- /system/framework/arm64/boot-framework.vdex 0x0000007d396bc000 - 0x0000007d3a998000 r-- /system/framework/arm64/boot-framework.vdex 0x0000007d3a998000 - 0x0000007d3aa9c000 r-- /system/framework/arm64/boot-ext.vdex

Searching for Wide strings through Memory:

[0x00000000]> \/w Hello Searching 10 bytes: 48 00 65 00 6c 00 6c 00 6f 00 hits: 6 0x13102acc hit1_0 480065006c006c006f00 0x13102b9c hit1_1 480065006c006c006f00 0x7d30a53aa0 hit1_2 480065006c006c006f00 0x7d30a872b0 hit1_3 480065006c006c006f00 0x7d30bb9568 hit1_4 480065006c006c006f00 0x7d30bb9a68 hit1_5 480065006c006c006f00 [0x00000000]> \dm.@@ hit1_* 0x0000000013100000 - 0x0000000013140000 rw- /dev/ashmem/dalvik-main space (region space) (deleted) 0x0000000013100000 - 0x0000000013140000 rw- /dev/ashmem/dalvik-main space (region space) (deleted) 0x0000007d30a00000 - 0x0000007d30c00000 rw- 0x0000007d30a00000 - 0x0000007d30c00000 rw- 0x0000007d30a00000 - 0x0000007d30c00000 rw- 0x0000007d30a00000 - 0x0000007d30c00000 rw-

Find Symbols in Libraries:

[0x00000000]> \is libnative-lib.so [0x00000000]>

Find what other libraries are loaded:

[0x00000000]> \ii libnative-lib.so 0x7dbe1159d0 f __cxa_finalize /system/lib64/libc.so 0x7dbe115868 f __cxa_atexit /system/lib64/libc.so

List all exports:

[0x00000000]> \iE libnative-lib.so 0x7d1c49954c f Java_sg_vantagepoint_helloworldjni_MainActivity_stringFromJNI

View Currently loaded classes:

[0x00000000]> \ic~sg.vantagepoint.helloworldjni sg.vantagepoint.helloworldjni.MainActivity

Display Classloader Information:

[0x00000000]> \icL dalvik.system.PathClassLoader[ DexPathList[ [ directory "."] , nativeLibraryDirectories=[ /system/lib64, /vendor/lib64, /system/lib64, /vendor/lib64] ] ] [email protected][ DexPathList[ [ zip file "/data/app/sg.vantagepoint.helloworldjni-1/base.apk"] , nativeLibraryDirectories=[ /data/app/sg.vantagepoint.helloworldjni-1/lib/arm64, /data/app/sg.vantagepoint.helloworldjni-1/base.apk!/lib/arm64-v8a, /system/lib64, /vendor/lib64] ] ]

Link to this headingDebugging

Show local Variables:

:> afvd arg arg1 = : rdi : 0x7ffd134f1e31 var s2 = 0x7ffd134f1e18 = "Q\x1eO\x13\xfd\x7f" var var_8h = 0x7ffd134f1e38 = (qword)0x040bc5301d6d4a00 var s1 = 0x7ffd134f1e31 = "joshua" var var_bh = 0x7ffd134f1e35 = (qword)0x301d6d4a00006175 var var_9h = 0x7ffd134f1e37 = (qword)0x0bc5301d6d4a0000 var var_14h = 0x7ffd134f1e2c = 22050

Patch File:

[0x00001070]> s 0x000011c9 [0x000011c9]> pd 1 │ ┌─< 0x000011c9 750c jne 0x11d7 [0x000011c9]> wx 74 [0x000011c9]> pd 1 │ ┌─< 0x000011c9 740c je 0x11d