文章总结： 这篇文章详细介绍了如何使用AI辅助技术分析一个使用了白盒AES加密的APP。作者首先通过抓包和hook技术定位加密位置，然后搭建unidbg环境模拟APP的加密过程。面对被ollvm混淆的代码，作者利用AI辅助分析，成功识别出AES加密的各个步骤（SubBytes、ShiftRows、MixColumns、AddRoundKey）。最后，作者通过DFA（差分故障分析）攻击获取了AES密钥，成功解密了密文。文章展示了AI在逆向工程中的实用价值，特别是在分析混淆代码时的辅助作用。
综合评分： 91
文章分类： 逆向分析,移动安全,漏洞分析,AI安全,二进制安全

AI辅助逆向APP白盒AES分析

nianchu

看雪学苑

2025年10月29日 18:06
上海

一、分析定位

#

首先APP为x60企业壳有frida检测我采用的是内核模块过的好了开始rush b

抓个包先看看参数如下阔以发现有个q参数 sign参数

#

sign=7453071242111271530988405881185832853&q=nRMSmZftbACgM2slHBK7oInWjkf2hkOgn-nXF2vFgMZ8TzBce9nuQn90up6rVtw7r6oouj6xaI5gWVt189jMGI58dLeWGKCt2hpcAWebpVcSiGrQcNkemn-0-bQ9ev7wiZ8nDc3B0WMo1h3_39UXBdoUk5OR9JD-PdP8zVgG28YUEd6mLGBnQeAC2Pmz1AeFCSulOGMgDgooLkHQBU_zkTiBWThMufvE7NIWvLxtiD10lOlRFMHoFinzGY9dG-jA00X9bwWB3_sdMKqQr3Hnsz4TWvNFcM7Yqs6SDyvmnYFTAWmSqd1NhRbhgDy1uOfGBhnu7MDZYZ6pZtdUaML5_pDycR-aJouuXxjO_Rs3KUGMcEmuo4Jkf32mGq5bpaXzTxBoSpRAK0UiasbdKFJE35n72fQsleoOt2Tl9Tpwg1MWBLTbcTyuy9uQF9pIsP1Fy8CCQ_ycUI1ppbPPxfqdZZuHQ9ujLk2dzECY5N4dQMvxrnhN7uDL-rEnhKIF-HB_Rb7U_rfVd0LNoO02KTdzhG4VodWG8_rdXStD_KnF9TL0iRqgwqD4SCTZxQmf0NHSAb1oXRTFpXtrxKwDGafthreGaCf6SAbMKfqyR_QAXrpYhm-xwK0HVf1-xxLhbHvWJ8Zirwy1207ZAa67qxJ0DWHHVCsrMXf_Ug47im6LpW0%3D&uid=bfcf236c-1f0b-4517-942a-93d846ef739c1747667865472&t=1759404531524&cid=210101

#

那么先确认下加密位置通过hook java.lang.String 下的一些getBytes方法得到一些信息比如登录会提交手机号所以追踪我们的手机号看看有没有信息打印阔以发现 str.getBytesCharset : {“latitude”:”29.207122″,”mobile”:”13232323232″,”countryNo”:”86″,”validateCode”:”123456″,”appversion”:”5397″后面省略

#

这个看起来像是登录提交参数那很可能是加密明文于是对信息过滤有手机号打印堆栈得到以下信息。

&nbsp; &nbsp;at java.lang.String.getBytes(Native Method)
&nbsp; &nbsp; &nbsp; &nbsp; at java.lang.String.getBytes(String.java:978)
&nbsp; &nbsp; &nbsp; &nbsp; at com.******.safeboxlib.CryptoHelper.c(SourceFile:7)
&nbsp; &nbsp; &nbsp; &nbsp; at com.lucky.lib.http2.HttpAesCrypto.d(SourceFile:1)
&nbsp; &nbsp; &nbsp; &nbsp; at com.lucky.lib.http2.AbstractLcRequest.getRequestParams(SourceFile:7)
&nbsp; &nbsp; &nbsp; &nbsp; at com.lucky.lib.http2.HttpPostRequestBuilder.k(SourceFile:15)
&nbsp; &nbsp; &nbsp; &nbsp; at com.lucky.lib.http2.HttpPostRequestBuilder.getRequest(Unknown&nbsp;Source:0)
&nbsp; &nbsp; &nbsp; &nbsp; at com.lucky.lib.http2.AbstractLcRequest.async(SourceFile:5)
&nbsp; &nbsp; &nbsp; &nbsp; at com.lucky.lib.http2.AbstractLcRequest.enqueue(SourceFile:3)
&nbsp; &nbsp; &nbsp; &nbsp; at com.lucky.lib.http2.HttpPostRequestBuilder.enqueue(Unknown&nbsp;Source:0)
&nbsp; &nbsp; &nbsp; &nbsp; at com.lucky.lib.lchttp2rx.result.ReactiveResult$a.a(SourceFile:4)
&nbsp; &nbsp; &nbsp; &nbsp; at io.reactivex.internal.operators.observable.ObservableCreate.F5(SourceFile:3)
&nbsp; &nbsp; &nbsp; &nbsp; at io.reactivex.Observable.subscribe(SourceFile:4)
&nbsp; &nbsp; &nbsp; &nbsp; at io.reactivex.internal.operators.observable.ObservableFlatMap.F5(SourceFile:2)
&nbsp; &nbsp; &nbsp; &nbsp; at io.reactivex.Observable.subscribe(SourceFile:4)
&nbsp; &nbsp; &nbsp; &nbsp; at io.reactivex.internal.operators.observable.ObservableObserveOn.F5(SourceFile:4)
&nbsp; &nbsp; &nbsp; &nbsp; at io.reactivex.Observable.subscribe(SourceFile:4)
&nbsp; &nbsp; &nbsp; &nbsp; at com.luckin.luckyclient.account.login.phoneno.LoginPhoneNoPresenter.n2(SourceFile:31)
&nbsp; &nbsp; &nbsp; &nbsp; at com.luckin.luckyclient.account.login.phoneno.LoginPhoneNoFragment.e2(SourceFile:4)
&nbsp; &nbsp; &nbsp; &nbsp; at com.luckin.luckyclient.account.login.phoneno.LoginPhoneNoFragment.onConfirm(SourceFile:7)
&nbsp; &nbsp; &nbsp; &nbsp; at com.luckin.luckyclient.account.login.phoneno.LoginPhoneNoFragment_ViewBinding$b.b(Unknown&nbsp;Source:2)
&nbsp; &nbsp; &nbsp; &nbsp; at butterknife.internal.DebouncingOnClickListener.onClick(SourceFile:4)
&nbsp; &nbsp; &nbsp; &nbsp; at android.view.View.performClick(View.java:7140)
&nbsp; &nbsp; &nbsp; &nbsp; at android.view.View.performClickInternal(View.java:7117)
&nbsp; &nbsp; &nbsp; &nbsp; at android.view.View.access$3500(View.java:801)
&nbsp; &nbsp; &nbsp; &nbsp; at android.view.View$PerformClick.run(View.java:27351)
&nbsp; &nbsp; &nbsp; &nbsp; at android.os.Handler.handleCallback(Handler.java:883)
&nbsp; &nbsp; &nbsp; &nbsp; at android.os.Handler.dispatchMessage(Handler.java:100)
&nbsp; &nbsp; &nbsp; &nbsp; at android.os.Looper.loop(Looper.java:214)
&nbsp; &nbsp; &nbsp; &nbsp; at android.app.ActivityThread.main(ActivityThread.java:7356)
&nbsp; &nbsp; &nbsp; &nbsp; at java.lang.reflect.Method.invoke(Native Method)
&nbsp; &nbsp; &nbsp; &nbsp; at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:492)
&nbsp; &nbsp; &nbsp; &nbsp; at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:930)

#

通过堆栈 at com.******.safeboxlib.CryptoHelper.c(SourceFile:7) 查找确定加密点位于以下代码然后jadx 一键生成frida hook 脚本验证发现此处hook得到与加密结果一致。

#

public&nbsp;synchronized&nbsp;String&nbsp;c(String&nbsp;str) {
&nbsp; &nbsp; &nbsp; &nbsp; c cVar =&nbsp;this.f198397a;
if&nbsp;(cVar !=&nbsp;null) {
String&nbsp;str2 =&nbsp;"";
String&nbsp;a10 = cVar.a();
if&nbsp;(TextUtils.isEmpty(a10)) {
return&nbsp;"";
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
try&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; str2 =&nbsp;new&nbsp;String(Base64.encode(localAESWork(str.getBytes(),&nbsp;2,&nbsp;Base64.decode(a10.replace('-',&nbsp;'+').replace('_',&nbsp;'/').getBytes(),&nbsp;2)),&nbsp;2));
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(Exception&nbsp;e10) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; e10.printStackTrace();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
return&nbsp;str2.replace('+',&nbsp;'-').replace('/',&nbsp;'_');
&nbsp; &nbsp; &nbsp; &nbsp; }
throw&nbsp;new&nbsp;RuntimeException(StubApp.getString2("40814"));
&nbsp; &nbsp; }

#

继续追踪代码阔以来到最终加密点函数localAESWork 然后hook_RegisterNatives 得到so层加密详情如下：

#

com.******.safeboxlib.CryptoHelper localAESWork ([BI[B)[B 0x7ce5c4aed8 libcryptoDD.so 0x41ed8

public&nbsp;static&nbsp;native&nbsp;byte[]&nbsp;localAESWork(byte[] bArr,&nbsp;int&nbsp;i10,&nbsp;byte[] bArr2);

二、搭建unidbg

#

加密函数找到后就开始我们的unidbg之旅，首先搭建下架子

#

package&nbsp;demo.coffe;
import&nbsp;com.alibaba.fastjson.util.IOUtils;
import&nbsp;com.github.unidbg.AndroidEmulator;
import&nbsp;com.github.unidbg.Emulator;
import&nbsp;com.github.unidbg.Module;
import&nbsp;com.github.unidbg.Symbol;
import&nbsp;com.github.unidbg.file.FileResult;
import&nbsp;com.github.unidbg.arm.HookStatus;
import&nbsp;com.github.unidbg.arm.backend.Unicorn2Factory;
import&nbsp;com.github.unidbg.arm.context.Arm32RegisterContext;
import&nbsp;com.github.unidbg.arm.context.RegisterContext;
import&nbsp;com.github.unidbg.debugger.Debugger;
import&nbsp;com.github.unidbg.debugger.DebuggerType;
import&nbsp;com.github.unidbg.file.FileResult;
import&nbsp;com.github.unidbg.file.IOResolver;
import&nbsp;com.github.unidbg.hook.HookContext;
import&nbsp;com.github.unidbg.hook.ReplaceCallback;
import&nbsp;com.github.unidbg.hook.hookzz.Dobby;
import&nbsp;com.github.unidbg.hook.hookzz.HookEntryInfo;
import&nbsp;com.github.unidbg.hook.hookzz.HookZz;
import&nbsp;com.github.unidbg.hook.hookzz.IHookZz;
import&nbsp;com.github.unidbg.hook.hookzz.InstrumentCallback;
import&nbsp;com.github.unidbg.hook.hookzz.WrapCallback;
import&nbsp;com.github.unidbg.hook.xhook.IxHook;
import&nbsp;com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import&nbsp;com.github.unidbg.linux.android.AndroidResolver;
import&nbsp;com.github.unidbg.linux.android.XHookImpl;
import&nbsp;com.github.unidbg.linux.android.dvm.*;
import&nbsp;com.github.unidbg.linux.android.dvm.array.ByteArray;
import&nbsp;com.github.unidbg.memory.Memory;
import&nbsp;com.github.unidbg.utils.Inspector;
import&nbsp;com.github.unidbg.virtualmodule.android.AndroidModule;
import&nbsp;com.sun.jna.Pointer;
import&nbsp;java.io.File;
import&nbsp;java.io.FileNotFoundException;
import&nbsp;java.io.FileOutputStream;
import&nbsp;java.io.PrintStream;
import&nbsp;java.math.BigInteger;
import&nbsp;java.nio.charset.StandardCharsets;
import&nbsp;java.util.ArrayList;
import&nbsp;java.util.Arrays;
import&nbsp;java.util.List;
import&nbsp;java.util.Base64;

public&nbsp;class&nbsp;rxkf&nbsp;extends&nbsp;AbstractJni&nbsp;implements&nbsp;IOResolver&nbsp; {

private&nbsp;final&nbsp;AndroidEmulator emulator;
private&nbsp;final&nbsp;VM vm;
private&nbsp;final&nbsp;Module&nbsp;module;

private&nbsp;final&nbsp;boolean&nbsp;logging;

&nbsp; &nbsp; rxkf(boolean&nbsp;logging){

this.logging = logging;

&nbsp; &nbsp; &nbsp; &nbsp; emulator = AndroidEmulatorBuilder.for64Bit()
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .setProcessName("com.lucky.luckyclient")
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .addBackendFactory(new&nbsp;Unicorn2Factory(true))
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .build();&nbsp;// 创建模拟器实例，要模拟32位或者64位，在这里区分
final&nbsp;Memorymemory&nbsp;=&nbsp;emulator.getMemory();&nbsp;// 模拟器的内存操作接口
&nbsp; &nbsp; &nbsp; &nbsp; memory.setLibraryResolver(new&nbsp;AndroidResolver(23));&nbsp;// 设置系统类库解析

&nbsp; &nbsp; &nbsp; &nbsp; vm = emulator.createDalvikVM(new&nbsp;File("unidbg-android/src/test/java/demo/coffe/kf.apk"));&nbsp;// 创建Android虚拟机
&nbsp; &nbsp; &nbsp; &nbsp; vm.setVerbose(logging);&nbsp;// 设置是否打印Jni调用细节
&nbsp; &nbsp; &nbsp; &nbsp; vm.setJni(this);
&nbsp; &nbsp; &nbsp; &nbsp; emulator.getSyscallHandler().addIOResolver(this);
new&nbsp;AndroidModule(emulator,vm).register(memory);
DalvikModuledm&nbsp;=&nbsp;vm.loadLibrary("cryptoDD",&nbsp;true);&nbsp;// 加载libttEncrypt.so到unicorn虚拟内存，加载成功以后会默认调用init_array等函数
module&nbsp;= dm.getModule();&nbsp;// 加载好的libttEncrypt.so对应为一个模块
&nbsp; &nbsp; &nbsp; &nbsp; dm.callJNI_OnLoad(emulator);&nbsp;// 手动执行JNI_OnLoad函数
// &nbsp; &nbsp; &nbsp; &nbsp;List<String> funclist = AesKeyFinder.readFuncFromIDA("unidbg-android/src/test/java/demo/one/1.txt");
// &nbsp; &nbsp; &nbsp; &nbsp;AesKeyFinder aesKeyFinder = new AesKeyFinder(emulator);
// &nbsp; &nbsp; &nbsp; &nbsp;aesKeyFinder.searchEveryFunction(module.base, funclist);

&nbsp; &nbsp; }

void&nbsp;destroy()&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; IOUtils.close(emulator);
if&nbsp;(logging) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; System.out.println("destroy");
&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; }

public&nbsp;static&nbsp;byte[] hexStringToBytes(String hexString) {
if&nbsp;(hexString.isEmpty()) {
return&nbsp;null;
&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; hexString = hexString.toLowerCase();
final&nbsp;byte[] byteArray =&nbsp;new&nbsp;byte[hexString.length() >>&nbsp;1];
intindex&nbsp;=0;
for&nbsp;(inti&nbsp;=0; i < hexString.length(); i++) {
if&nbsp;(index > hexString.length() -&nbsp;1) {
return&nbsp;byteArray;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
bytehighDit&nbsp;=&nbsp;(byte) (Character.digit(hexString.charAt(index),&nbsp;16) &&nbsp;0xFF);
bytelowDit&nbsp;=&nbsp;(byte) (Character.digit(hexString.charAt(index +&nbsp;1),&nbsp;16) &&nbsp;0xFF);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; byteArray[i] = (byte) (highDit <<&nbsp;4&nbsp;| lowDit);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; index +=&nbsp;2;
&nbsp; &nbsp; &nbsp; &nbsp; }
return&nbsp;byteArray;
&nbsp; &nbsp; }

public&nbsp;static&nbsp;String&nbsp;bytesTohexString(byte[] bytes)&nbsp;{
StringBuffersb&nbsp;=new&nbsp;StringBuffer();
for&nbsp;(inti&nbsp;=0; i < bytes.length; i++) {
Stringhex&nbsp;=&nbsp;Integer.toHexString(bytes[i] &&nbsp;0xFF);
if&nbsp;(hex.length() <&nbsp;2) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sb.append(0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sb.append(hex);
&nbsp; &nbsp; &nbsp; &nbsp; }
return&nbsp;sb.toString();
&nbsp; &nbsp; }
public&nbsp;static&nbsp;String&nbsp;b64TohexString(String base64String){

byte[] decodedBytes = org.apache.commons.codec.binary.Base64.decodeBase64(base64String);
BigIntegerbigInteger&nbsp;=new&nbsp;BigInteger(1, decodedBytes);
StringhexString&nbsp;=&nbsp;bigInteger.toString(16);
return&nbsp; hexString;

&nbsp; &nbsp; }

public&nbsp;void&nbsp;trace(){
StringtraceFile&nbsp;="unidbg-android/src/test/java/demo/coffe/trace.txt";
PrintStreamtraceStream&nbsp;=null;
try{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; traceStream =&nbsp;new&nbsp;PrintStream(new&nbsp;FileOutputStream(traceFile),&nbsp;true);
&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(FileNotFoundException e) {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; e.printStackTrace();
&nbsp; &nbsp; &nbsp; &nbsp; }
//核心 trace 开启代码，也可以自己指定函数地址和偏移量
&nbsp; &nbsp; &nbsp; &nbsp; emulator.traceCode(module.base,module.base+module.size).setRedirect(traceStream);
&nbsp; &nbsp; }

public&nbsp;static&nbsp;void&nbsp;main(String[] args)&nbsp;{
rxkfdemo&nbsp;=new&nbsp;rxkf(true);
&nbsp; &nbsp; &nbsp; &nbsp; demo.s();

&nbsp; &nbsp; }

public&nbsp;void&nbsp;s(){
DvmClassCryptoHelper&nbsp;=&nbsp;vm.resolveClass("com/******/safeboxlib/CryptoHelper");
//DvmObject<?> Context = vm.resolveClass("android/content/Context").newObject(null);
byte[] bytes =&nbsp;"hello".getBytes();
Stringa2&nbsp;&nbsp;="u7Su25kSE9PxcTgQZkRgL0kJ+lDaV2IQcqdsfGGuNDs="&nbsp;;
byte[] bytes2 = Base64.getDecoder().decode(a2.replace('-',&nbsp;'+').replace('_',&nbsp;'/').getBytes());
// &nbsp; &nbsp; &nbsp; &nbsp;emulator.traceCode(module.base,module.base+module.size);

ByteArrayreval&nbsp;=&nbsp;CryptoHelper.callStaticJniMethodObject(emulator,&nbsp;"localAESWork([BI[B)[B", &nbsp;bytes,2,bytes2);
&nbsp; &nbsp; &nbsp; &nbsp; System.out.println("结果:"&nbsp;+ bytesTohexString(reval.getValue()));

&nbsp; &nbsp; }

@Override
public&nbsp;FileResult&nbsp;resolve(Emulator emulator, String pathname,&nbsp;int&nbsp;oflags)&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; System.out.println("pathname:"+ pathname);
// &nbsp; &nbsp; &nbsp; &nbsp;if(pathname.equals("/proc/"+emulator.getPid()+"/cmdline")){
// &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;return FileResult.success(new SimpleFileIO(oflags, new File("unidbg-android/src/test/java/demo/wb/cmdline"), pathname));
//
// &nbsp; &nbsp; &nbsp; &nbsp;}

return&nbsp;null;
&nbsp; &nbsp; }

}

先跑一下再说发现报错了去到0x43b08 处是一个free函数那么可能是 Unidbg在内存管理方面存在的一些问题，此处是在内存的释放上 free出错。

JNIEnv->SetByteArrayRegion([B@6aaa5eb0,&nbsp;0,&nbsp;16, RW@0x40399010) was&nbsp;called&nbsp;from&nbsp;RX@0x40043b08[libcryptoDD.so]0x43b08
[19:53:15&nbsp;655] &nbsp;WARN [com.github.unidbg.arm.AbstractARM64Emulator] (AbstractARM64Emulator$1:66)&nbsp;-&nbsp;Write memory failed: address=0x0, size=8,&nbsp;value=0x40057000
[19:53:15&nbsp;655] &nbsp;WARN [com.github.unidbg.AbstractEmulator] (AbstractEmulator:420)&nbsp;-&nbsp;emulate RX@0x40041ed8[libcryptoDD.so]0x41ed8&nbsp;exception sp=unidbg@0xbffff3b0, msg=unicorn.UnicornException: Invalid memory write (UC_ERR_WRITE_UNMAPPED),&nbsp;offset=10ms

针对此处报错我们先对free处理看看能否成功跑起来，hook free函数，替换它的实现，让它什么都不做就直接返回。

处理后 unidbg已经跑出了结果 frida hook 传参并且传入与抓包对比一致 no problem 下一步开始分析算法，这个案例老版本有很多文章了，阔以知道这个家伙用的是白盒aes ida打开so 去到localAESWork 函数处先瞅一眼。

public&nbsp;void&nbsp;patchFree(){
IWhalewhale&nbsp;=&nbsp;Whale.getInstance(emulator);
Symbolfree&nbsp;=&nbsp;emulator.getMemory().findModule("libc.so").findSymbolByName("free");
&nbsp; &nbsp; whale.inlineHookFunction(free,&nbsp;new&nbsp;ReplaceCallback() {
@Override
public&nbsp;HookStatus&nbsp;onCall(Emulator<?> emulator,&nbsp;long&nbsp;originFunction)&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; System.out.println("WInlineHookFunction free="&nbsp;+ emulator.getContext().getPointerArg(0));
return&nbsp;HookStatus.LR(emulator,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; });
}

不看不知道一看全是线条 ollvm 玩个锤子奈子的 trace 它吧

先固定传参方便后续处理我们的aes 传个hello 加密，结果是 fa63a50fd234b8c15a8f4ff9761ea69a 然后开启我们的trace 会再文件夹生成trace文本。

public&nbsp;static&nbsp;void&nbsp;main(String[] args) {
&nbsp; &nbsp; &nbsp; &nbsp; rxkf demo =&nbsp;new&nbsp;rxkf(true);
&nbsp; &nbsp; &nbsp; &nbsp; demo.patchFree();
&nbsp; &nbsp; &nbsp; &nbsp; demo.trace();
&nbsp; &nbsp; &nbsp; &nbsp; demo.s();
}

然后在我们的trace结果中搜索我们的结果 fa63a50fd234b8c15a8f4ff9761ea69a 搜下 0xfa 发现结果有点多不好看继续往后找发现搜素 0x8f 结果比较少比较好观察于是前后观察下发现我们生成结果都在于是找个地址跳过去看看这里找的0x199e0

阔以发现 ollvm 严重影响我们分析那么不还原ollvm 我们就只能硬着头皮看看主要看函数跟进去看看瞧瞧瞅瞅他们都干啥了那么此处你需要先去了解AES的算法然后还有白盒AES。

由于论坛已经有很多写的好的文章了，这里就不提哪么详细，那么有人问我没了解AES算法怎么办别怕我们有小帮手AI 毕竟现在是AI辅助逆向时代我们往下继续找函数。

我们进 219CC 里面去看看发现是这个鸟样子看不懂怎么办不怕问下ai ai猜猜猜他在干啥

经过AI的一顿分析喀喀喀的就出来了我们的结果它说是AES加密中的轮密钥加（AddRoundKey）操作我们继续往下看几个比如21BEC

这个函数我们阔以看到有个byte_455E8 它频繁的从里面取了值我们去看看byte_455E8 这不是s盒吗看这个操作从s盒取值然后后面又赋值给result 符合我们AES里面的SubBytes操作那不问ai了继续往下看 223E0

223E0 函数有个很明显的换位操作符合AES里面的ShiftRows继续看看22810 直接丢给ai看

说这是列混淆去trace里面看看这个函数调用几次

阔以看到是9次 AES-128 中 10轮运算只有9轮有列混淆经过AI辅助(不一定正确)，我们已经找出了AES的这些步骤接下来就可以进行DFA攻击了故障点应该让发生在倒数两个列混淆之间

◆✅SubBytes– 字节替换

◆✅ShiftRows– 行移位

◆✅MixColumns– 列混淆

◆✅AddRoundKey– 轮密钥加

攻击之后得到的故障密文与正确密文对比如下可以发现四个字节不一样说明故障注入成功

public&nbsp;void&nbsp;dfaAttack(){
&nbsp; &nbsp; &nbsp; &nbsp; emulator.attach().addBreakPoint(module.base +&nbsp;0x22810,&nbsp;new&nbsp;BreakPointCallback() {
intcount&nbsp;=0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; UnidbgPointer pointer;
@Override
public&nbsp;booleanonHit(Emulator<?> emulator,&nbsp;long&nbsp;address)&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; count +=&nbsp;1;
RegisterContextregisterContext&nbsp;=&nbsp;emulator.getContext();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pointer = registerContext.getPointerArg(0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; emulator.attach().addBreakPoint(registerContext.getLRPointer().peer,&nbsp;new&nbsp;BreakPointCallback() {
@Override
public&nbsp;booleanonHit(Emulator<?> emulator,&nbsp;long&nbsp;address)&nbsp;{
if(count %&nbsp;8&nbsp;==&nbsp;0){
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pointer.setByte(randInt(0,&nbsp;15), (byte) randInt(0,&nbsp;0xff));
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
return&nbsp;true;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; });

return&nbsp;true;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; });
&nbsp; &nbsp; }

&nbsp; &nbsp; ============================
&nbsp; &nbsp; 正确:fa63a5&nbsp;0f&nbsp;d234 b8 c15a&nbsp;8f&nbsp;4ff9&nbsp;76&nbsp;1ea69a
&nbsp; &nbsp; 故障:fa63a5&nbsp;36&nbsp;d234 f4 c15a dd 4ff9&nbsp;43&nbsp;1ea69a
&nbsp; &nbsp; 可以发现4处不同

然后循环注入得到更多的故障密文，使用 phoenixAES 把第十轮的密钥给计算出来

得到

然后使用aes_keyschedule去计算出原始密钥

有了key之后我们去解密一下首先密文需要replace(‘-‘, ‘+’).replace(‘_’, ‘/’)); 替换下然后去解密可以正常解密。

看雪ID：nianchu

https://bbs.kanxue.com/user-home-949800.htm

*本文为看雪论坛优秀文章，由 nianchu 原创，转载请注明来自看雪社区

往期推荐

V8 Bytecode反汇编/反编译不完全指南

静态程序分析之数据流分析(Foundations + LiveVar Analysis Code)续

tt x-gorgon分析

基于Minifilter实现目录保护软件，自定义保护目录，用户可选择是否允许文件行为

一道简单的RE迷宫题

球分享

球点赞

球在看

点击阅读原文查看更多

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：看雪学苑 nianchu《AI辅助逆向APP白盒AES分析》

Tags: AI安全二进制安全漏洞分析移动安全逆向分析

你可能错过

格物致知：在RK3588 Linux平台上增加锂电池充电限制的实践之旅

Deepseek桌面版悄悄上线；Muse大火，扎克伯格跃升全球第四大富豪；OpenAI被曝筹备推出ProMax订阅层级，月费或达500-600美元 | 极客早知道

分库分表，可能真的要退出历史舞台了！

Sorry勒索软件新变种来袭