Upgrade to Pro — share decks privately, control downloads, hide ads and more …

apk-medit: memory search and patch tool for debuggable APK @CODE BLUE 2020 Bluebox

@tkmru
October 30, 2020

apk-medit: memory search and patch tool for debuggable APK @CODE BLUE 2020 Bluebox

@tkmru

October 30, 2020
Tweet

More Decks by @tkmru

Other Decks in Programming

Transcript

  1. $0%&#-6&#MVFCPY
    1SFTFOUFECZ5BJDIJ,PUBLF
    "LBUTVLJ*OD
    BQLNFEJU
    NFNPSZTFBSDIBOEQBUDIUPPMGPS"1,
    XJUIPVUSPPUBOESPJE/%,

    View full-size slide

  2. 8IP*BN
    w /BNF5BJDIJ,PUBLF
    w $PVOUZ+BQBO
    w +PC4FDVSJUZ&OHJOFFS!"LBUTVLJ*OD
    w 'PDVT(BNF4FDVSJUZ /FUXPSL1FOUFTU
    w (JU)VCULNSV

    View full-size slide

  3. 5PEBZT5PQJD
    4FDVSJUZUFTUJOH
    GPSNPCJMFHBNFBQQT
    Photo by Shannon Potter on Unsplash

    View full-size slide

  4. 4FDVSJUZUFTUJOHGPSNPCJMFHBNFBQQT
    w 4FDVSJUZUFTUJOHPGXFCBQQMJDBUJPOTBOETJNQMFNPCJMFBQQTDBOpOE
    NPTUWVMOFSBCJMJUJFTCZVTJOHBQSPYZUPPMUPNPEJGZXJUISFRVFTUT
    SFTQPOTFTUPUIFTFSWFS
    "QQT 4FSWFST
    &OHJOFFSTVTJOHBQSPYZUPPM
    .PEJpFE3FRVFTU
    3FTQPOTF
    3FRVFTU
    .PEJpFE3FTQPOTF

    View full-size slide

  5. 4FDVSJUZUFTUJOHGPSNPCJMFHBNFBQQT
    w .PCJMFHBNFBQQTPGUFOJNQMFNFOUHBNFMPHJDBOEBOUJDIFBUMPHJDJOUIFJSDMJFOUT
    BOEUIFDMJFOUTOFFEUPUBLFUIFUJNFUPDIFDLJU
    w 4FDVSJUZUFTUJOHGPSNPCJMFHBNFBQQTJTNPSFEJ⒏DVMUUIBOBTJNQMFNPCJMFBQQ
    CFDBVTFPGUIFQFSTQFDUJWFPGSFWFSTFFOHJOFFSJOH
    w %FDSZQUJOHSFRVFTUTSFTQPOTFTFODSZQUJPO
    w 44-QJOOJOHCZQBTT
    w 3PPUQSJWJMFHFTEFUFDUJPOCZQBTT
    w .FNPSZNPEJpDBUJPO
    w FUD
    5PEBZ`TUPQJD

    View full-size slide

  6. 8IBUJTNFNPSZNPEJGJDBUJPOʁ
    w 4FBSDIJOHGPSUIFWBMVFEJTQMBZFEPOUIF6*JOUIFEFWJDFTNFNPSZ
    BOENPEJGZJOHXJUIUIFWBMVFGPVOE
    w 5IFFBTJFTUXBZUPDIFBUJOHBNFT
    w 'PS"OESPJEHBNFT UIFSFJTBXFMMLOPXODIFBUUPPMDBMMFEɹɹ
    (BNF(VBSEJBO

    View full-size slide

  7. 8IBUJTBQLNFEJU
    w .FNPSZTFBSDIBOEQBUDIUPPMGPSEFCVHHBCMF"1,
    w 8PSLTXJUIPVUSPPUUIFBOESPJE/%,
    w *NQMFNFOUFEJO(PMBOH
    w 'PSNPCJMFTFDVSJUZUFTUJOH
    w "LBUTVLJTJOUFSOBMTFDVSJUZUFBNVTFTJUUPQFSGPSNTFDVSJUZUFTUTGPS
    NPCJMFHBNFBQQ
    w (JU)VCIUUQTHJUIVCDPNBLUTLBQLNFEJU

    View full-size slide

  8. 8IBUBSFJUTBEWBOUBHFTPWFSPUIFSUPPMT
    w /PSPPUQSJWJMFHFTBSFSFRVJSFEGPSUIFPQFSBUJPO
    w 5IFSFGPSF UIFSFJTOPOFFEUPCZQBTTSPPUEFUFDUJPO
    w (BNFBQQTPGUFOEFUFDUSPPU
    w 8PSLTXJUIDPMPSGVM$6*
    w /PDPNQFUJOHUPPMTUIBUXPSLXJUI$6*GPS"OESPJE

    View full-size slide

  9. 6TBHF
    %FNP.PWJF

    View full-size slide

  10. 6TBHF
    *OTUBMMBUJPO
    w %PXOMPBEUIFCJOBSZGSPN(JU)VC3FMFBTFT
    w QVTIUIFCJOBSZJOEBUBMPDBMUNQPOBO"OESPJEEFWJDF
    $ adb push medit /data/local/tmp/medit

    View full-size slide

  11. 6TBHF
    5PMBVODI
    w 6TFUIFSVOBTDPNNBOEUPSFBEXSJUFpMFTVTFECZUIF"1,
    w 5PBDDFTTUIFNFNPSZXJUIPVUSFRVJSJOHSPPUQSJWJMFHFT
    w 4PBQLNFEJUDBOPOMZCFVTFEXJUIBQQTUIBUIBWF
    UIFEFCVHHBCMFBUUSJCVUFFOBCMFE

    View full-size slide

  12. 6TBHF
    5PMBVODI
    w 5PFOBCMFUIFEFCVHHBCMFBUUSJCVUF
    w PQFOUIF"OESPJE.BOJGFTUYNMBOEBEEUIFGPMMPXJOHYNMBUUSJCVUF
    UPUIFBQQMJDBUJPOYNMOPEF
    android:debuggable="true"

    View full-size slide

  13. 6TBHF
    .BLFEFCVHHBCMFVTJOHBQLVUJM
    w 6TJOHBQLVUJM ZPVDBODIBOHFUIF"1,UPCFEFCVHHBCMF
    XJUIBTJOHMFDPNNBOE
    w "OPUIFSUPPM*DSFBUFE
    w IUUQTHJUIVCDPNBLUTLBQLVUJM
    $ pip install git+ssh://[email protected]/aktsk/apkutil.git
    $ apkutil debuggable

    View full-size slide

  14. 6TBHF
    "OPUIFSUPPM*DSFBUFE BQLVUJM
    w BQLVUJMJTBVTFGVMVUJMJUZGPSBOESPJEBQQTFDVSJUZUFTUJOH
    w 0UIFSVTFGVMGFBUVSFT
    w 5BLJOHTDSFFOTIPU NPWFUPDPOOFDUFE1$
    w 3FTJHOJOHUIF"1,
    w $IFDLJOH"OESPJE.BOJGFTUYNMXIFOEFDPEFUIF"1,
    w FUD

    View full-size slide

  15. 6TBHF
    5PMBVODI
    w "GUFSSVOOJOHUIFSVOBTDPNNBOE EJSFDUPSZJTDIBOHFE
    w $PQZNFEJUGSPNEBUBMPDBMUNQ
    w 3VOOJOHNFEJUMBVODIFTBOJOUFSBDUJWFQSPNQU
    $ adb shell
    $ pm list packages # to check
    $ run-as
    $ cp /data/local/tmp/medit ./medit
    $ ./medit

    View full-size slide

  16. 6TBHF
    4VCDPNNBOET
    w .BOZTVCDPNNBOETBSFBWBJMBCMFJOUIFJOUFSBDUJWFQSPNQU CVUUIF
    UISFFNBJOPOFTBSF
    w pOEWBMVFTFBSDIUIFTQFDJpFEJOUFHFSWBMVFJONFNPSZ
    w pMUFSWBMVFpMUFSTFBSDISFTVMUTVTJOHUIFTQFDJpFEWBMVF
    w QBUDIWBMVFXSJUFUIFTQFDJpFEWBMVFUPUIFBEESFTTGPVOECZUIF
    TFBSDI

    View full-size slide

  17. 5IFNFNPSZNPEJGJDBUJPOGMPX
    w 6TFUIFlpOEzDPNNBOEUPTFBSDIUIFWBMVFPOUIF6*
    w *GNBOZSFTVMUTBSFEJTQMBZFE DIBOHFUIFWBMVFPOUIF6*UP
    lpMUFSzUIFSFTVMUT
    w 8IFOUIFSFBSFGFXFSSFTVMUT ZPVDBONPEJGZUIFNFNPSZ
    CZVTJOHUIFQBUDIDPNNBOE

    View full-size slide

  18. )PXJUXPSLT
    Photo by Harrison Broadbent on Unsplash

    View full-size slide

  19. )PXJUXPSLT
    w 0O-JOVYCBTFE04FT QTFVEPpMFTBSFQMBDFEVOEFSQSPDUPBDDFTT
    QSPDFTTJOGPSNBUJPO
    w 5IFGPMMPXJOHQBUITBSFVTFE
    w QSPDNBQT
    w QSPDNFN

    View full-size slide

  20. QSPDNBQT
    w QSPDNBQTDPOUBJOTUIFNFNPSZNBQJOGPSNBUJPO
    w 5IFNFNPSZNBQJOEJDBUFTXIJDIQBSUPGUIFNFNPSZUIFQSPDFTT
    TQFDJpFECZUIFlQJE IBTQFSNJTTJPOTUPSFBEBOEXSJUFUP

    View full-size slide

  21. QSPDNBQT
    sargo:/data/data/jp.aktsk.tap1000000 $ cat /proc/11283/maps
    12c00000-12d40000 rw-p 00000000 00:05 23292 /dev/ashmem/dalvik-main space (region space) (deleted)
    12d40000-133c0000 ---p 00140000 00:05 23292 /dev/ashmem/dalvik-main space (region space) (deleted)
    133c0000-13700000 ---p 007c0000 00:05 23292 /dev/ashmem/dalvik-main space (region space) (deleted)
    13700000-13780000 rw-p 00b00000 00:05 23292 /dev/ashmem/dalvik-main space (region space) (deleted)
    13780000-14140000 ---p 00b80000 00:05 23292 /dev/ashmem/dalvik-main space (region space) (deleted)
    14140000-2ac00000 rw-p 01540000 00:05 23292 /dev/ashmem/dalvik-main space (region space) (deleted)
    6f181000-6f3a6000 rw-p 00000000 fd:01 221 /data/dalvik-cache/arm/system@[email protected]
    6f3a6000-6f3bc000 r--p 00225000 fd:01 221 /data/dalvik-cache/arm/system@[email protected]
    6f3bc000-6f4b3000 rw-p 00000000 fd:01 229 /data/dalvik-cache/arm/system@[email protected]
    6f4b3000-6f4c5000 r--p 000f7000 fd:01 229 /data/dalvik-cache/arm/system@[email protected]
    6f4c5000-6f4f6000 rw-p 00000000 fd:01 232 /data/dalvik-cache/arm/system@[email protected]
    6f4f6000-6f4f9000 r--p 00031000 fd:01 232 /data/dalvik-cache/arm/system@[email protected]
    6f4f9000-6f526000 rw-p 00000000 fd:01 235 /data/dalvik-cache/arm/system@[email protected]
    6f526000-6f529000 r--p 0002d000 fd:01 235 /data/dalvik-cache/arm/system@[email protected]
    6f529000-6f57f000 rw-p 00000000 fd:01 240 /data/dalvik-cache/arm/system@[email protected]
    ...

    View full-size slide

  22. QSPDNFN
    w 6TJOHQSPDNFN JUJTQPTTJCMFUPSFBEUIFNFNPSZIFMECZUIF
    QSPDFTTTQFDJpFECZUIFlQJEz
    w TZTUFNDBMMTDBOCFVTFEUPSFBEUIFNFNPSZ
    w PQFO
    SFBE
    MTFFL

    View full-size slide

  23. )PXJUXPSLT
    w 5IF.FNPSZNBQUFMMTVTXIFSFXFDBOSFBEXSJUF
    w *UVTFTQSPDNFNUPSFBEUIFNFNPSZBOETFBSDIGPSUIF
    UBSHFUWBMVF
    w 8IFOUIFUBSHFUWBMVFJTGPVOE JUVTFTQSPDNFNUPQBUDIUIF
    NFNPSZ

    View full-size slide

  24. 8IBUBSFUIFCFOFGJUTPGJNQMFNFOUJOH
    VTJOH(PMBOHPOBOESPJEEFWJDFT
    Photo by Nandhu Kumar on Unsplash

    View full-size slide

  25. 8IBUBSFUIFCFOFGJUTPGJNQMFNFOUJOH
    VTJOH(PMBOHPOBOESPJEEFWJDFT
    w &BTZUPQSFQBSF&-'CJOBSJFTGPS"3.
    w &BTZUPJOWPLFTZTUFNDBMMT
    w &BTZUPpOEUIFUBSHFUCZUFJOBMBSHFCZUFTFRVFODFRVJDLMZ
    w &BTZUPEJTUSJCVUFCJOBSJFTCZVTJOH(JU)VC"DUJPOTBOE(P3FMFBTFS

    View full-size slide

  26. &BTZUPQSFQBSF&-'CJOBSJFTGPS"3.
    w (PDPNQJMFSTVQQPSUTDSPTTDPNQJMBUJPO
    w (004 (0"3$)FOWJSPONFOUWBSJBCMFTBSFQSPWJEFEGPSTQFDJGZJOH
    UIF04BOE$16
    $ GOOS=linux GOARCH=arm64 GOARM=7 go build -o medit

    View full-size slide

  27. &BTZUPJOWPLFTZTUFNDBMMT
    w 6OJYQBDLBHFXSBQTUIFTZTUFNDBMMTOJDFMZ
    w &BTZUPJOWPLFUIFTZTUFNDBMMT

    View full-size slide

  28. &BTZUPGJOEUIFUBSHFUCZUF
    JOBMBSHFCZUFTFRVFODFRVJDLMZ
    w "GBTUTUSJOHTFBSDIBMHPSJUINDBMMFEUIF3BCJO,BSQJTVTFEJOTJEF
    CZUFT*OEFY

    w 8JUIPVUJNQMFNFOUJOHDPNQMFYBMHPSJUINT *DBORVJDLMZpOEEBUBJO
    UIFNFNPSZCZTJNQMZVTJOHCZUFT*OEFY

    View full-size slide

  29. &BTZUPEJTUSJCVUFCJOBSJFT
    CZVTJOH(JU)VC"DUJPOTBOE(P3FMFBTFS
    w (JU)VC"DUJPOTBOE(P3FMFBTFSNBLFJUFBTZUP
    EFWFMPQXJUI(PMBOH
    w 8IFOBUBHHFEDPNNJUJTVQMPBEFEUP(JU)VC UIFCVJMESVOTWJB
    (JU)VC"DUJPOTBOE(P3FMFBTFSBVUPNBUJDBMMZSFHJTUFSTUIFCJOBSZUP
    (JUIVC3FMFBTFT

    View full-size slide

  30. 4VNNBSZ
    w BQLNFEJUBMMPXTNFNPSZNPEJpDBUJPOTXJUIPVUCZQBTTJOHSPPUJOH
    EFUFDUJPO
    w #VUUIFSFJTBOFFEUPDIBOHFUIF"1,UPCFEFCVHHBCMF
    w (PMBOHJTBVTFGVMMBOHVBHFGPSCVJMEJOH"OESPJEUPPMT
    w *IPQFBQLNFEJUXJMMCFDPNFUIFEFGBDUPTUBOEBSE
    GPSTFDVSJUZUFTUJOH

    View full-size slide

  31. 5IBOL:PV
    IUUQTHJUIVCDPNBLUTLBQLNFEJU

    View full-size slide