某手sig3-ios算法 Chomper黑盒调用

原创

已于 2025-02-20 18:19:36 修改 · 1.9k 阅读

12 ·

CC 4.0 BY-SA版权

文章标签：

#frida #ios逆向 #objective-c #chomper

于 2025-02-20 17:42:29 首次发布

Chomper-iOS界的Unidbg

最近在学习中发现一个Chomper框架，Chomper 是一个模拟执行iOS可执行文件的框架，类似于安卓端大名鼎鼎的Unidbg。

这篇文章使用Chomper模拟执行某手的sig3算法，初步熟悉该框架。这里只熟悉模拟执行步骤以及一些常见的hook操作、读取操作等。

框架搭建

chomper 使用python开发，这里直接使用pip安装 pip install chomper (mac的m系列芯片，可能需要再自己电脑编译unicorn并安装)

下载chomper中rootfs 放在项目录下如下：

基础代码如下：

import os

from chomper import Chomper
from chomper.const import ARCH_ARM64, OS_IOS
from chomper.objc import ObjC
from chomper.utils import pyobj2nsobj
from chomper.os.ios.hooks import register_hook
from unicorn import arm64_const

base_path = os.path.abspath(os.path.dirname(__file__))


def trace_inst_callback(self, uc, address, size, user_data):
    for inst in self.cs.disasm_lite(uc.mem_read(address, size), 0):
        self.logger.info(
            f"Trace at {self.debug_symbol(address)}: {inst[-2]} {inst[-1]}"
        )

        message = ""
        for i in range(31):
            if message:
                message += ", "
            message += f"x{i}={hex(self.uc.reg_read(getattr(arm64_const, f'UC_ARM64_REG_X{i}')))}"
        self.logger.info(message)


Chomper.trace_inst_callback = trace_inst_callback #这里是用来trace代码
#加载ios基础库支持。
emu = Chomper(
    arch=ARCH_ARM64,
    os_type=OS_IOS,
    rootfs_path=os.path.join(base_path, "rootfs/ios"),
    enable_ui_kit=True, #开启ui_kit库支持，
)

objc = ObjC(emu)

某手核心算法调用

这里不再分析sig3怎么来的，以及如何构造的，如果需要请看兔哥公众号文章。https://mp.weixin.qq.com/s/JG56KxPC7s3oSvoGkQVBRQ

算法加载流程如下：根据frida-trace得

+[KWSecurity defaultInterface]
 22578 ms  -[KWSecurity atlasSign:/rest/app/square/home/mall/tab/dynamic/feed87fa757cb702565b6afa61de4f5f9617]
 22582 ms     | +[KWSecuritySignature atlasSignPlus:0x2852e18c0 isInner:0x0 sdkid:0x10eb67638 sdkName:0x10eb67638 ztconfigFilePath:0x10eb67638]
 22582 ms     |    | +[KWOpenSecurityGuardManager getInstance]
 22582 ms     |    | -[KWOpenSecurityGuardManager getSecureSignatureComp]
 22582 ms     |    |    | -[KWOpenSecurityGuardManager getComponent:0x0]
 22582 ms     |    |    |    | +[KWOpenComponentLibrary getInstance]
 22582 ms     |    |    |    | -[KWOpenComponentLibrary getComponent:0x0]
 22582 ms     |    |    |    |    | -[KWOpenComponentLibrary sdkDict]
 22582 ms     |    | +[KWOpenSecurityGuardParamContext createParamContextWithAppKey:d7b7d042-d4f2-4012-be60-d97ff2429c17 paramDict:nil requestType:0x1 input:{
   
   length = 75, bytes = 0x2f726573 742f6170 702f7371 75617265 ... 34663566 39363137 } wbindexKey:lD6We1E8i bInnerInvoke:0x0 sdkid: sdkName: ztconfigFilePath:]
 22589 ms     |    |    | -[KWOpenSecurityGuardParamContext setAppKey:0x100932dd8]
 22589 ms     |    |    | -[KWOpenSecurityGuardParamContext setWbindexKey:0x100932df8]
 22589 ms     |    |    | -[KWOpenSecurityGuardParamContext setParamDict:0x0]
 22590 ms     |    |    | -[KWOpenSecurityGuardParamContext setRequestType:0x1]
 22590 ms     |    |    | -[KWOpenSecurityGuardParamContext setInput:0x2876d4e70]
 22590 ms     |    |    | -[KWOpenSecurityGuardParamContext setOutput:nil