app逆向-ratel框架-sekiro框架的安装使用

我是花臂不花

已于 2024-03-10 05:27:13 修改

阅读量1.7k

点赞数 7

分类专栏： app逆向随笔文章标签： java android studio android

于 2024-03-09 04:04:32 首次发布

本文链接：https://blog.youkuaiyun.com/u010226586/article/details/136575220

版权

app逆向随笔专栏收录该内容

19 篇文章

订阅专栏

文章目录

一、前言

sekiro主要支持多节点的程序调用，所以他归属于RPC（Remote Procedure Call）框架：API管理、鉴权、分布式、负载均衡、跨语言

开源文档：https://sekiro.iinti.cn/sekiro-doc/

二、初次尝试

demoServer 是 sekiro 商业版的一个分支，他和商业版本的 server 保持相同的协议，但是拥有更少的功能。

在 Linux 或者 mac 上，执行脚本 build_demo_server.sh ,之后得到产出发布压缩包：sekiro-service-demo/target/sekiro-release-demo.zip

如果是 windows，或者不想自己构建，可以在这里直接下载 https://oss.iinti.cn/sekiro/sekiro-demo

安装 java（自行安装）

运行启动脚本:

bin/SekiroMain.sh :mac or linux
bin/SekiroMain.bat :windows

启动效果
在这里插入图片描述
浏览器请求测试：http://127.0.0.1:5612/business/groupList

展示当前系统有那些注册过的group
在这里插入图片描述

三、原⽣APP的使⽤

build.gradle 添加依赖

// 依赖
implementation 'com.virjar.sekiro.business:sekiro-business-api:1.4'

每个handler都必须有action，使用注解方式设置action

package com.example.myapplication.handlers;

import com.virjar.sekiro.business.api.interfaze.Action;
import com.virjar.sekiro.business.api.interfaze.RequestHandler;
import com.virjar.sekiro.business.api.interfaze.SekiroRequest;
import com.virjar.sekiro.business.api.interfaze.SekiroResponse;

@Action("clientTime")
public class ClientTimeHandler implements RequestHandler {

    @Override
    public void handleRequest(SekiroRequest sekiroRequest, SekiroResponse sekiroResponse) {
        // 根据业务逻辑来写，此处以获取时间戳作为例子
        // 当rpc调用时获取手机当前时间戳返回
        sekiroResponse.success("当前时间：" + System.currentTimeMillis());
    }
}

handler处理程序 MainActivity002.java

package com.example.myapplication;

import android.os.Build;
import android.os.Bundle;
import android.util.Log;

import androidx.appcompat.app.AppCompatActivity;

import com.example.myapplication.handlers.ClientTimeHandler;
import com.virjar.sekiro.business.api.SekiroClient;
import com.virjar.sekiro.business.api.interfaze.HandlerRegistry;
import com.virjar.sekiro.business.api.interfaze.SekiroRequest;
import com.virjar.sekiro.business.api.interfaze.SekiroRequestInitializer;

public class MainActivity002 extends AppCompatActivity {
    private static final String TAG = "myapplication->";
    // Build类获取系统信息
    private final String client_id = Build.BOARD + " " + Build.MODEL.replace("", "");

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main002);

        // 创建客户端
        Log.d(TAG, "手机品牌和手机型号: " + client_id);
        SekiroClient sekiroClient = new SekiroClient("demo", client_id, "192.168.10.9", 5612);
        sekiroClient.setupSekiroRequestInitializer(new SekiroRequestInitializer() {
            @Override
            public void onSekiroRequest(SekiroRequest sekiroRequest, HandlerRegistry handlerRegistry) {
                handlerRegistry.registerSekiroHandler(new ClientTimeHandler());
            }
        });
        sekiroClient.start();
    }
}

打包运行app，并请求rpc接口http://127.0.0.1:5612/business/groupList显示效果：
在这里插入图片描述
浏览器效果：

查看队列状态

http://127.0.0.1:5612/business/clientQueue?group=demo

浏览器效果：
在这里插入图片描述
调用转发相关文档：地址

http://127.0.0.1:5612/business/invoke?group=demo&action=clientTime

浏览器效果：
在这里插入图片描述
注册多个action， ClipboardHandler.java

package com.example.myapplication.handlers;

import com.blankj.utilcode.util.ClipboardUtils;
import com.virjar.sekiro.business.api.interfaze.Action;
import com.virjar.sekiro.business.api.interfaze.RequestHandler;
import com.virjar.sekiro.business.api.interfaze.SekiroRequest;
import com.virjar.sekiro.business.api.interfaze.SekiroResponse;

@Action("clipboard")
public class ClipboardHandler implements RequestHandler {

    @Override
    public void handleRequest(SekiroRequest sekiroRequest, SekiroResponse sekiroResponse) {
        sekiroResponse.send(ClipboardUtils.getText().toString());
    }
}

注册服务

package com.example.myapplication;

import android.os.Build;
import android.os.Bundle;
import android.util.Log;

import androidx.appcompat.app.AppCompatActivity;

import com.blankj.utilcode.util.ClipboardUtils;
import com.example.myapplication.handlers.ClientTimeHandler;
import com.example.myapplication.handlers.ClipboardHandler;
import com.virjar.sekiro.business.api.SekiroClient;
import com.virjar.sekiro.business.api.interfaze.HandlerRegistry;
import com.virjar.sekiro.business.api.interfaze.SekiroRequest;
import com.virjar.sekiro.business.api.interfaze.SekiroRequestInitializer;

public class MainActivity002 extends AppCompatActivity {
    private static final String TAG = "myapplication->";
    // Build类获取系统信息
    private final String client_id = Build.BOARD + " " + Build.MODEL.replace("", "");

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main002);
        // 写入粘贴版
        ClipboardUtils.copyText(client_id);

        // 创建客户端
        Log.d(TAG, "手机品牌和手机型号: " + client_id);
        // 这里的ip地址是宿主机的ip地址
        SekiroClient sekiroClient = new SekiroClient("demo", client_id, "192.168.10.9", 5612);
        sekiroClient.setupSekiroRequestInitializer(new SekiroRequestInitializer() {
            @Override
            public void onSekiroRequest(SekiroRequest sekiroRequest, HandlerRegistry handlerRegistry) {
                // 注册
                handlerRegistry.registerSekiroHandler(new ClientTimeHandler());
                handlerRegistry.registerSekiroHandler(new ClipboardHandler());
            }
        });
        sekiroClient.start();
    }
}

并请求rpc接口http://127.0.0.1:5612/business/invoke?group=demo&action=clipboard显示效果：
在这里插入图片描述

四、ratel框架结合sekiro框架使用

创建目标类代码 Sign

package com.example.myapplication;

import java.math.BigInteger;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

public class Sign {
    public static String getSign(Integer page) throws NoSuchAlgorithmException {
        return new BigInteger(MessageDigest.getInstance("MD5").digest((page+"").getBytes())).toString(16);
    }
}

编写ratel插件，先创建一个action

package com.example.plugintest.handlers;

import android.util.Log;

import com.virjar.ratel.api.rposed.RposedHelpers;
import com.virjar.sekiro.business.api.interfaze.Action;
import com.virjar.sekiro.business.api.interfaze.AutoBind;
import com.virjar.sekiro.business.api.interfaze.RequestHandler;
import com.virjar.sekiro.business.api.interfaze.SekiroRequest;
import com.virjar.sekiro.business.api.interfaze.SekiroResponse;


@Action("getSign")
public class SignHandler implements RequestHandler {
    private static final String TAG = "pluginTest->";

    @AutoBind
    private Integer page;
    private final ClassLoader mClassLoader;
    public SignHandler(ClassLoader classLoader){
        mClassLoader = classLoader;
    }

    @Override
    public void handleRequest(SekiroRequest sekiroRequest, SekiroResponse sekiroResponse) {
        Log.d(TAG, "handleRequest:" + page);
        String sign = (String) RposedHelpers.callStaticMethod(RposedHelpers.findClass("com.example.myapplication.Sign", this.mClassLoader), "getSign", page);
        sekiroResponse.success(sign);
    }
}

注册服务

package com.example.plugintest;

import android.os.Build;

import com.example.plugintest.handlers.SignHandler;
import com.virjar.ratel.api.rposed.IRposedHookLoadPackage;
import com.virjar.ratel.api.rposed.callbacks.RC_LoadPackage;
import com.virjar.sekiro.business.api.SekiroClient;
import com.virjar.sekiro.business.api.interfaze.HandlerRegistry;
import com.virjar.sekiro.business.api.interfaze.SekiroRequest;
import com.virjar.sekiro.business.api.interfaze.SekiroRequestInitializer;

public class sekiroEntry implements IRposedHookLoadPackage {
    // Build类获取系统信息
    private final String client_id = Build.BOARD + " " + Build.MODEL.replace("", "");
    public String TAG = "pluginTest->";

    @Override
    public void handleLoadPackage(RC_LoadPackage.LoadPackageParam lpparam) throws Throwable {
        System.out.println(TAG + " 包名是什么：" + lpparam.packageName);
        if (lpparam.packageName.equals("com.example.myapplication")){
            System.out.println(TAG + " hook成功：" + lpparam.packageName);

            // 这里的ip地址是宿主机的ip地址
            SekiroClient sekiroClient = new SekiroClient("demo", client_id, "192.168.10.9", 5612);
            sekiroClient.setupSekiroRequestInitializer(new SekiroRequestInitializer() {
                @Override
                public void onSekiroRequest(SekiroRequest sekiroRequest, HandlerRegistry handlerRegistry) {
                    // 注册
                    handlerRegistry.registerSekiroHandler(new SignHandler(lpparam.classLoader));
                }
            });
            sekiroClient.start();
        }
    }
}