tips

字符串反混淆

If you have a binary that has a lot of obfuscated strings, another thing you can do instead of just adding comments is to add a new segment to the database with idc.AddSeg, write the strings to it with idaapi.patch_many_bytes and idaapi.MakeStr, then add a data xref from the decryption call to the decrypted string in your new segment with idc.add_dref.

获取到当前的activity

adb shell dumpsys window | findstr mCurrentFocus

• run-as 降权后也和应用的权限不同。

• apt 获取包名 和 launcher

aapt dump badging litmatch-6-23-1.apk | findstr "MAIN"

aapt dump badging litmatch-6-23-1.apk | findstr "activity"

monkey命令

adb shell monkey -p com.litatom.app -v  -v  -v 10000

查看应用的uid

• adb shell dumpsys package com.litatom.app | findstr “userId”

frida获取context

var context = Java.use("android.app.ActivityThread").currentApplication().getApplicationContext()

frida remote

# listen on a specific interface and port
$ frida-server -l 192.168.1.3:1337

# connect to specific IP
$ frida-trace -H 192.168.1.3 -i "open*"

修改packages.xml为普通xml格式

setprop persist.sys.binary_xml false

OKHttp 修改请求参数

let Builder = Java.use("okhttp3.HttpUrl$Builder");
Builder["addQueryParameter"].implementation = function (name, value) {
    console.log(`Builder.addQueryParameter is called: name=${name}, value=${value}`);
    let result = this["addQueryParameter"](name, value);
    console.log(`Builder.addQueryParameter result=${result}`);
    return result;
};

private_dirty 和 shared_dirty

linker 映射libc.co 时，对got表的修改主要时shared_dirty ，该修改作用该进程并且至少一个其他进程。

https://stackoverflow.com/questions/33027341/shared-dirty-vs-private-dirty-in-shared-memory详细解释

用frida hook时，主要修改private_dirty 并且所有其他线程同地址内存块的都会修改；

adb command

• adb shell am clear-debug-app 清除应用调试标志

• android recovery mode 提示 ”no command “ 时 ，按住 ”电源键 + 音量下“

数字证书 = 公钥信息 + 其他信息

Dockfile 新增用户、设置密码 、加入sudo。

RUN groupadd -g $groupid $username \
 && useradd -m -u $userid -g $groupid $username \
 && adduser $username sudo \
 && echo $username >/root/username \
 && echo "export USER="$username >>/home/$username/.gitconfig \
 && echo $username:123 | chpasswd

fingerprint组成

为什么C++11后，类静态局部变量是线程安全

https://stackoverflow.com/questions/34457432/c11-singleton-static-variable-is-thread-safe-why

https://blog.pareto.fun/2024/03/26/magiskinit/