XhstormR


On a dark desert highway Cool wind in my hair


逆向 MyBatis plugin

Updated on 2018-07-15

https://plugins.jetbrains.com/plugin/7293-mybatis-plugin

  • 两个模块:
    • 本地端:使用 C 和 Rust 语言混合编写,主要用于与服务器验证激活。
    • 插件端:使用 Java 和 Kotlin 语言混合编写,用于与 IDEA 进行交互。
  • 使用 ZKM 进行代码混淆。
  • 使用 jni-rs 从本地端通过 JNI 反射直接调用 Java 方法。

反混淆器

java -jar deobfuscator-1.0.0.jar --config config.yml

config.yml
----
input: iMybatis-3.67.jar
output: output.jar
path:
 - C:\Program Files\Java\jdk1.8.0_152\jre\lib\rt.jar
 - C:\Program Files\Java\jdk1.8.0_152\jre\lib\jce.jar
 - C:\Program Files\Java\jdk1.8.0_152\jre\lib\ext\jfxrt.jar
 - C:\Program Files\Java\jdk1.8.0_152\lib\tools.jar
transformers:
 - com.javadeobfuscator.deobfuscator.transformers.zelix.string.SimpleStringEncryptionTransformer
 - com.javadeobfuscator.deobfuscator.transformers.zelix.string.EnhancedStringEncryptionTransformer

JDB 动态调试

Server:
javac -g Main
java -agentlib:jdwp=transport=dt_socket,server=y,suspend=y,address=8000 Main

Client:
jdb -connect com.sun.jdi.SocketAttach:hostname=localhost,port=8000
stop in java.lang.String.length
run
clear java.lang.String.length
where
list
locals
print new com.a.a.h.d.r().a(365)
exit

AspectJ 拦截方法

Tracing.aj

import org.aspectj.lang.JoinPoint;
import org.aspectj.lang.reflect.MethodSignature;

import java.io.IOException;
import java.io.PrintWriter;
import java.lang.reflect.Modifier;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.nio.file.StandardOpenOption;
import java.time.LocalDateTime;
import java.time.format.DateTimeFormatter;
import java.util.Arrays;

public aspect Tracing {
    private static final String STR = "    ";
    private static final Path LOG_FILE;
    /*call 最好只用于 static、native 方法,以免编织时发生异常*/
    private static final pointcut p1():
            execution(* com.a.a.h.d.r.*(..)) ||
            call(native * com.a..*(..)) ||
            (call(static String com.a..*(..)) && !call(static String com.a.a.h.a.c.a(int, int)));

    static {
        LocalDateTime now = LocalDateTime.now();
        DateTimeFormatter formatter = DateTimeFormatter.ofPattern("yyyy-MM-dd_HH.mm.ss");
        LOG_FILE = Paths.get("D:/Download", String.format("Tracing_%s.log", now.format(formatter)));
    }

    private static boolean isNative(JoinPoint.StaticPart jpsp) {
        int modifiers = jpsp.getSignature().getModifiers();
        return Modifier.isNative(modifiers);
    }

    private static boolean isReturnVoid(JoinPoint.StaticPart jpsp) {
        Class returnType = ((MethodSignature) jpsp.getSignature()).getReturnType();
        return returnType == Void.TYPE;
    }

    private static PrintWriter getLogWriter() throws IOException {
        return new PrintWriter(Files.newBufferedWriter(LOG_FILE,
                StandardCharsets.UTF_8,
                StandardOpenOption.CREATE,
                StandardOpenOption.APPEND));
    }

    Object around(): p1() {
        try (PrintWriter writer = getLogWriter()) {
            writer.println(thisJoinPoint.toLongString());

            writer.println(STR + "args: " + Arrays.toString(thisJoinPoint.getArgs())); //输出参数

            Object result = proceed(); //执行原有方法体
            writer.println(STR + "return: " + result); //输出原有返回值

            return result; //指定返回值
        } catch (IOException e) {
            e.printStackTrace();
            return null;
        }
    }

//    before(): p2() {
//        try (PrintWriter writer = getLogWriter()) {
//            writer.println(thisJoinPoint.toLongString());
//
//            writer.println(STR + "args: " + Arrays.toString(thisJoinPoint.getArgs()));
//        } catch (IOException e) {
//            e.printStackTrace();
//        }
//    }
//
//    after() returning(Object result): p2() {
//        try (PrintWriter writer = getLogWriter()) {
//            writer.println(thisJoinPoint.toLongString());
//
//            writer.println(STR + "return: " + result);
//        } catch (IOException e) {
//            e.printStackTrace();
//        }
//    }
}

aop-ajc.xml

<aspectj>
    <aspects>
        <aspect name="Tracing"/>
    </aspects>

    <weaver options="-Xlint:ignore -showWeaveInfo">
        <include within="com.a..*"/>
    </weaver>
</aspectj>

编译

java -cp aspectjtools-1.9.1.jar;aspectjrt-1.9.1.jar; org.aspectj.tools.ajc.Main -outjar 123.jar -outxml -1.8 -Xlint:ignore Tracing.aj

运行

ideaIU-2018.1\bin\idea64.exe.vmoptions
----
-javaagent:D:\Download\aspectjweaver-1.9.1.jar

.IntelliJIdea2018.1\config\plugins\MyBatis\lib
----
123.jar
TOP