文章总结： 本文介绍了使用frida工具hookAndroid应用中Java底层加密类的方法，重点演示了如何hookCipher类捕获AES加密的密钥和IV参数，以及如何hookMessageDigest类获取MD5签名生成过程。作者通过这种方法成功破解了某应用的加密通信和签名验证机制，发现签名是由Noncestr、Timestamp和固定密钥拼接后进行MD5计算得到的。文章提供了详细的操作步骤和frida脚本代码，展示了Android逆向工程中破解加密签名的实用技术。
综合评分： 89
文章分类： 逆向分析,移动安全,二进制安全,漏洞分析

【Android逆向】逆向加密签名之frida hook java底层类Cipher和MessageDigest

原创

挖个洞先

挖个洞先

2025年9月26日 09:59
北京

“ 世界上所有的不利因素，都是因为当事人的能力不足而导致的。——《东京喰种》S1E12 ”

01

—

环境版本

环境：

电脑，Windows 11 专业版 23H2

https://github.com/JiaoSuInfoSec/JiaoSuInfoSec_T00ls_Win11

软件：

mumu模拟器，5.3.4

https://mumu.163.com/

burpsuite，v2025.1

https://portswigger.net/burp/releases

charles，5.0.2

https://www.charlesproxy.com/download/

brook，v20230606.5

https://github.com/txthinking/brook

frida，16.1.8

https://github.com/frida/frida/releases/download/16.1.8/frida-server-16.1.8-android-x86_64.xz

02

—

操作步骤

1、使用adb推送frida-server到mumu模拟器中的tmp目录

adb push .\frida-server-16.1.8-android-x86_64 /data/local/tmp

2、进入shell，fridaserver给权限，启动

adb shellsucd /data/local/tmplschmod 777 frida-server-16.1.8-android-x86_64./frida-server-16.1.8-android-x86_64

3、查看运行的软件，最新版本1.1.6

frida-ps -Ua

4、电脑端安装burpsuite+Charles，移动端安装brook，转发socket到burpsuite实现抓包

安卓APP抓包解决方案(教程)

https://xz.aliyun.com/news/11263

5、转换burpsuite证书格式，推送到系统证书目录

adb push .\9bc4b260.0 /data/local/tmpadb shellmount -o remount,rw /systemmv /data/local/tmp/9bc4b260.0 /system/etc/security/cacerts/

6、浏览器访问百度测试

7、测试目标软件发现存在请求响应加密，请求header存在sign签名

8、响应加密

9、使用frida hook对称/非对称Java底层加密类Cipher，保存输出到1.txt

frida -U -f com.xxx -l password.js -o 1.txt

Java.perform(function() {&nbsp; &nbsp;&nbsp;console.log("[*] 启动加密监控脚本");&nbsp; &nbsp;&nbsp;// --- 1. 获取所需Java类的句柄 ---&nbsp; &nbsp;&nbsp;var&nbsp;Cipher&nbsp;=&nbsp;Java.use('javax.crypto.Cipher');&nbsp; &nbsp;&nbsp;var&nbsp;IvParameterSpec&nbsp;=&nbsp;Java.use('javax.crypto.spec.IvParameterSpec');&nbsp; &nbsp;&nbsp;var&nbsp;Base64&nbsp;=&nbsp;Java.use('android.util.Base64');&nbsp; &nbsp;&nbsp;var&nbsp;StandardCharsets&nbsp;=&nbsp;Java.use('java.nio.charset.StandardCharsets');&nbsp; &nbsp;&nbsp;var&nbsp;StringClass&nbsp;=&nbsp;Java.use('java.lang.String');&nbsp; &nbsp;&nbsp;var&nbsp;Arrays&nbsp;=&nbsp;Java.use('java.util.Arrays');&nbsp; &nbsp;&nbsp;// --- 全局变量，用于存储上下文信息 ---&nbsp; &nbsp;&nbsp;var&nbsp;cipherContexts = {};&nbsp; &nbsp;&nbsp;// ==============================================================================================&nbsp; &nbsp;&nbsp;// &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;第一部分: 辅助函数&nbsp; &nbsp;&nbsp;// ==============================================================================================&nbsp; &nbsp;&nbsp;/**&nbsp; &nbsp; &nbsp;* 将Java的 byte[] 字节数组转换为人眼可读的十六进制字符串。&nbsp; &nbsp; &nbsp;*/&nbsp; &nbsp;&nbsp;function&nbsp;bytesToHex(arr) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(!arr)&nbsp;return&nbsp;"[null]";&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;hex =&nbsp;'';&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;(var&nbsp;i =&nbsp;0; i < arr.length; i++) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;n = arr[i];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(n <&nbsp;0) n +=&nbsp;256;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;h = n.toString(16);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(h.length&nbsp;===&nbsp;1) h =&nbsp;'0'&nbsp;+ h;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; hex += h;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;hex;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;/**&nbsp; &nbsp; &nbsp;* 打印当前的Java调用栈。&nbsp; &nbsp; &nbsp;*/&nbsp; &nbsp;&nbsp;function&nbsp;printStackTrace() {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;stack =&nbsp;Java.use('android.util.Log').getStackTraceString(Java.use('java.lang.Throwable').$new());&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;|> 调用栈:\n"&nbsp;+ stack.split('\n').slice(2).join('\n'));&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(e) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;|> 调用栈: <获取失败>");&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;// ==============================================================================================&nbsp; &nbsp;&nbsp;// &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;第二部分: Hook Cipher.init()&nbsp; &nbsp;&nbsp;// ==============================================================================================&nbsp; &nbsp;&nbsp;var&nbsp;initOverloads =&nbsp;Cipher.init.overloads;&nbsp; &nbsp; initOverloads.forEach(function(overload) {&nbsp; &nbsp; &nbsp; &nbsp; overload.implementation&nbsp;=&nbsp;function() {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;opmode =&nbsp;arguments[0], key =&nbsp;arguments[1], params = (arguments.length&nbsp;>&nbsp;2) ?&nbsp;arguments[2] :&nbsp;null;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;cipherId =&nbsp;this.hashCode();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;opmodeStr = (opmode ==&nbsp;1) ?&nbsp;"ENCRYPT_MODE (加密)"&nbsp;: (opmode ==&nbsp;2) ?&nbsp;"DECRYPT_MODE (解密)"&nbsp;:&nbsp;"UNKNOWN";&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log("\n[+] Cipher.init() 被调用! [实例ID: "&nbsp;+ cipherId +&nbsp;"]");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;|> 操作模式: "&nbsp;+ opmodeStr);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;keyBytes = key.getEncoded();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;keyHex =&nbsp;bytesToHex(keyBytes);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;|> 密钥 (Hex): "&nbsp;+ keyHex);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;ivHex =&nbsp;null;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(params) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;ivBytes =&nbsp;Java.cast(params,&nbsp;IvParameterSpec).getIV();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ivHex =&nbsp;bytesToHex(ivBytes);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;|> IV (Hex): "&nbsp;+ ivHex);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(e) {&nbsp;console.log(" &nbsp;|> IV: 存在但无法解析为IvParameterSpec."); }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp;console.log(" &nbsp;|> IV: null"); }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cipherContexts[cipherId] = {&nbsp;opmode: opmodeStr,&nbsp;algorithm:&nbsp;this.getAlgorithm(),&nbsp;key: keyHex,&nbsp;iv: ivHex };&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;printStackTrace();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(e) {&nbsp;console.log("[!] Cipher.init hook 发生错误: "&nbsp;+ e); }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;overload.apply(this,&nbsp;arguments);&nbsp; &nbsp; &nbsp; &nbsp; };&nbsp; &nbsp; });&nbsp; &nbsp;&nbsp;// ==============================================================================================&nbsp; &nbsp;&nbsp;// &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;第三部分: Hook Cipher.doFinal()&nbsp; &nbsp;&nbsp;// ==============================================================================================&nbsp; &nbsp;&nbsp;/**&nbsp; &nbsp; &nbsp;* 这是一个统一的日志记录函数，用于打印 doFinal 的输入和输出。&nbsp; &nbsp; &nbsp;*&nbsp;@param&nbsp;{object}&nbsp;context&nbsp;- 从cipherContexts中获取的上下文信息。&nbsp; &nbsp; &nbsp;*&nbsp;@param&nbsp;{byte[]}&nbsp;inputData&nbsp;- doFinal的输入数据。&nbsp; &nbsp; &nbsp;*&nbsp;@param&nbsp;{byte[]}&nbsp;outputData&nbsp;- doFinal的输出数据。&nbsp; &nbsp; &nbsp;*/&nbsp; &nbsp;&nbsp;function&nbsp;logDoFinalData(context, inputData, outputData) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(context.opmode.includes("ENCRYPT")) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log("\n[+] Cipher.doFinal() 操作完成! (加密) [实例ID: "&nbsp;+ context.cipherId&nbsp;+&nbsp;"]");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;|> 算法: "&nbsp;+ context.algorithm);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;|> 输入明文 (Hex): "&nbsp;+&nbsp;bytesToHex(inputData));&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(inputData) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp;console.log(" &nbsp;|> 输入明文 (String): "&nbsp;+&nbsp;StringClass.$new(inputData,&nbsp;StandardCharsets.UTF_8)); }&nbsp;catch(e){}&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(outputData) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;b64Result =&nbsp;Base64.encodeToString(outputData,&nbsp;2);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;|> 输出密文 (Hex): "&nbsp;+&nbsp;bytesToHex(outputData));&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;|> 输出密文 (Base64): "&nbsp;+ b64Result);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;|> 输出密文: null");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp;// 解密模式&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log("\n[+] Cipher.doFinal() 操作完成! (解密) [实例ID: "&nbsp;+ context.cipherId&nbsp;+&nbsp;"]");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;|> 算法: "&nbsp;+ context.algorithm);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;|> 输入密文 (Hex): "&nbsp;+&nbsp;bytesToHex(inputData));&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(outputData) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;|> 输出明文 (Hex): "&nbsp;+&nbsp;bytesToHex(outputData));&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp;console.log(" &nbsp;|> 输出明文 (String): "&nbsp;+&nbsp;StringClass.$new(outputData,&nbsp;StandardCharsets.UTF_8)); }&nbsp;catch(e){}&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;|> 输出明文: null");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;// --- 专门Hook那些返回 byte[] 的 doFinal 版本 ---&nbsp; &nbsp; ['doFinal',&nbsp;'doFinal',&nbsp;'doFinal'].forEach(function(methodName, index) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;overload;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(index ===&nbsp;0) overload =&nbsp;Cipher[methodName].overload();&nbsp;// doFinal()&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else&nbsp;if&nbsp;(index ===&nbsp;1) overload =&nbsp;Cipher[methodName].overload('[B');&nbsp;// doFinal(byte[])&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else&nbsp;if&nbsp;(index ===&nbsp;2) overload =&nbsp;Cipher[methodName].overload('[B',&nbsp;'int',&nbsp;'int');&nbsp;// doFinal(byte[], int, int)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(overload) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; overload.implementation&nbsp;=&nbsp;function() {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;cipherId =&nbsp;this.hashCode();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;context = cipherContexts[cipherId];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; context.cipherId&nbsp;= cipherId;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;inputData =&nbsp;null;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(arguments.length&nbsp;>&nbsp;0) inputData =&nbsp;arguments[0];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;result = overload.apply(this,&nbsp;arguments);&nbsp;// result 是 byte[]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;logDoFinalData(context, inputData, result);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;result;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; };&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; });&nbsp; &nbsp;&nbsp;// --- 专门Hook那些返回 int 的 doFinal 版本 ---&nbsp; &nbsp; ['doFinal',&nbsp;'doFinal'].forEach(function(methodName, index) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;overload;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(index ===&nbsp;0) overload =&nbsp;Cipher[methodName].overload('[B',&nbsp;'int',&nbsp;'int',&nbsp;'[B');&nbsp;// doFinal(byte[], int, int, byte[])&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else&nbsp;if&nbsp;(index ===&nbsp;1) overload =&nbsp;Cipher[methodName].overload('[B',&nbsp;'int',&nbsp;'int',&nbsp;'[B',&nbsp;'int');&nbsp;// doFinal(byte[], int, int, byte[], int)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(overload) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; overload.implementation&nbsp;=&nbsp;function() {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;cipherId =&nbsp;this.hashCode();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;context = cipherContexts[cipherId];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; context.cipherId&nbsp;= cipherId;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;inputData =&nbsp;arguments[0];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;outputBuffer;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 在返回int的重载中，输出缓冲区的位置是固定的&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if(arguments.length&nbsp;===&nbsp;4) outputBuffer =&nbsp;arguments[3];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if(arguments.length&nbsp;===&nbsp;5) outputBuffer =&nbsp;arguments[3];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;bytesWritten = overload.apply(this,&nbsp;arguments);&nbsp;// result 是 int&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 从输出缓冲区中截取实际写入的数据&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;outputData =&nbsp;Arrays.copyOfRange(outputBuffer,&nbsp;0, bytesWritten);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;logDoFinalData(context, inputData, outputData);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;bytesWritten;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; };&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; });&nbsp; &nbsp;&nbsp;console.log("[*] 加密监控脚本已激活。");});

10、再次登录，将抓包到的password值到1.txt中搜索得到AES的key和iv

11、解密请求成功

12、解密响应成功

13、使用frida hook哈希Java底层加密类MessageDigest，保存输出到2.txt

frida -U -f com.xxx -l md5.js -o 2.txt

Java.perform(function() {&nbsp; &nbsp;&nbsp;// 辅助函数：将 byte 数组转换为 Hex 字符串&nbsp; &nbsp;&nbsp;function&nbsp;bytesToHex(bytes) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;hex = [];&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;(var&nbsp;i =&nbsp;0; i < bytes.length; i++) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;val = bytes[i] &&nbsp;0xFF;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(val <&nbsp;16) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; hex.push("0");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; hex.push(val.toString(16));&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;hex.join("");&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;// 辅助函数：将 byte 数组转换为可读字符串 (UTF-8)&nbsp; &nbsp;&nbsp;function&nbsp;bytesToString(bytes) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;str =&nbsp;"";&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; str =&nbsp;new&nbsp;java.lang.String(bytes,&nbsp;"UTF-8");&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(e) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 如果转换失败，则返回原始字节信息&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;"[非UTF-8编码] "&nbsp;+ bytes.toString();&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;str;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;var&nbsp;MessageDigest&nbsp;=&nbsp;Java.use('java.security.MessageDigest');&nbsp; &nbsp;&nbsp;// Hook MessageDigest.getInstance 方法，确认算法类型&nbsp; &nbsp;&nbsp;MessageDigest.getInstance.overload('java.lang.String').implementation&nbsp;=&nbsp;function(algorithm) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log("\n[+] MessageDigest.getInstance('"&nbsp;+ algorithm +&nbsp;"') 被调用");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 打印调用堆栈，帮助定位代码位置&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;this.getInstance(algorithm);&nbsp; &nbsp; };&nbsp; &nbsp;&nbsp;// Hook update 方法，捕获输入数据&nbsp; &nbsp;&nbsp;MessageDigest.update.overload('[B').implementation&nbsp;=&nbsp;function(input) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 筛选出 MD5 实例的 update 调用&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(this.getAlgorithm() ===&nbsp;"MD5") {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log("\n[+] MD5.update() 被调用");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;[+] 输入数据 (String): "&nbsp;+&nbsp;bytesToString(input));&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;[+] 输入数据 (Hex) &nbsp; : "&nbsp;+&nbsp;bytesToHex(input));&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;this.update(input);&nbsp; &nbsp; };&nbsp; &nbsp;&nbsp;// Hook digest 方法，捕获最终的哈希结果&nbsp; &nbsp;&nbsp;MessageDigest.digest.overload().implementation&nbsp;=&nbsp;function() {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 筛选出 MD5 实例的 digest 调用&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(this.getAlgorithm() ===&nbsp;"MD5") {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log("\n[!] MD5.digest() 被调用，计算完成");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;result =&nbsp;this.digest();&nbsp;// 调用原始方法获取结果&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;var&nbsp;hexResult =&nbsp;bytesToHex(result);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;[!] MD5 哈希结果 (Hex): "&nbsp;+ hexResult);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 如果能找到这个 sign，说明我们成功捕获了正确的加密过程&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(hexResult ===&nbsp;'d41d8cd98f00b204e9800998ecf8427e') {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.warn(" &nbsp;[!] 警告：捕获到的 sign 是空字符串的MD5，请检查应用逻辑。");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log(" &nbsp;[*] 这个值可能就是你要找的 sign！");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;console.log("----------------------------------------------------");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;result;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 对于非 MD5 算法，正常返回&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;this.digest();&nbsp; &nbsp; };});

14、再次登录，将抓包到的sign值到1.txt中搜索得到十六进制的输入数据

15、解码十六进制得到字符串

16、分析字符串发现签名生成逻辑为拼接Noncestr+Timestamp+固定密钥然后MD5

Noncestr: huxxxTimestamp: 1758785723固定密钥:137xxx

17、再次登录，根据请求手动计算，还原sign成功

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：挖个洞先 挖个洞先《【Android逆向】逆向加密签名之frida hook java底层类Cipher和MessageDigest》