1、直接将某沙app拖入jadx，看起来是加壳的，全是字母。

2、通过frida-dump脱壳出dex，代码太多，一头雾水，决定frida查看一下app load流程。

3、先查看一下so的加载，看起来是基于webview的app，这种安全性更强？

android_dlopen_ext probe /data/user/0/com.hptfludyjx.syjqeafkll/files/HJfOTtKmmn/libflutter.so
android_dlopen_ext probe /vendor/lib/hw/gralloc.sdm845.so
android_dlopen_ext probe /data/user/0/com.hptfludyjx.syjqeafkll/files/HJfOTtKmmn/libkiwi.so
android_dlopen_ext probe /vendor/lib/hw/android.hardware.graphics.mapper@2.0-impl-qti-display.so
android_dlopen_ext probe /data/dalvik-cache/arm/system@product@app@webview@webview.apk@classes.dex
android_dlopen_ext probe libwebviewchromium.so
android_dlopen_ext probe /system/product/app/webview/webview.apk!/lib/armeabi-v7a/libwebviewchromium.so
android_dlopen_ext probe /system/lib/libwebviewchromium_plat_support.so

4、objection查看相关的控件，只有几个，决定从这几个包里面代码入手

com.FsmPTCXp.srkUzUwv.BuMNTWpHywCyOjEG
com.FsmPTCXp.srkUzUwv.SYwlcwEiRFSIXShR
com.FsmPTCXp.srkUzUwv.XgHiUUvJoGlJkOrD
com.FsmPTCXp.srkUzUwv.etdKYlBCbRsMOoYO
com.FsmPTCXp.srkUzUwv.kTqkUkCAFauhrgmp
com.FsmPTCXp.srkUzUwv.pipohLdKqLHPWLVM
com.FsmPTCXp.srkUzUwv.spWureHoPIGDecqQ
com.google.android.gms.common.api.GoogleApiActivity

com.FsmPTCXp.srkUzUwv.SYwlcwEiRFSIXShR

这个里面有webview的创建，在com.pichillilorenzo.flutter_inappwebview.in_app_browser.InAppBrowserManager发现会启动这个控件，后面就是继续分析怎么注入了。

5、继续分析并hook相关的类，终于找到了一些post get时会触发的方法。

(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.dispose()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.makeInitialLoad(java.util.HashMap)
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.dispose()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.makeInitialLoad(java.util.HashMap)
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.getView()
(agent) [612497] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.FlutterWebView.dispose()

6、hook关键函数com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.onPageFinished，找到关键的加载js的请求

(agent) [096825] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.loadCustomJavaScriptOnPageStarted(android.webkit.WebView)
(agent) [096825] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.shouldInterceptRequest(android.webkit.WebView, java.lang.String)
(agent) [096825] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.shouldInterceptRequest(android.webkit.WebView, android.webkit.WebResourceRequest)
(agent) [096825] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.shouldInterceptRequest(android.webkit.WebView, android.webkit.WebResourceRequest)
(agent) [096825] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.shouldInterceptRequest(android.webkit.WebView, android.webkit.WebResourceRequest)
(agent) [096825] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.shouldInterceptRequest(android.webkit.WebView, java.lang.String)
(agent) [096825] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.onPageFinished(android.webkit.WebView, java.lang.String)
(agent) [096825] Called com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.loadCustomJavaScriptOnPageFinished(android.webkit.WebView)

7、抓取核心接口的调用栈，拿到网页的链接，由于这个玩意服务器在国外，所以需要vpn才能inspect debug（可以但是太麻烦），干脆直接拿链接浏览器打开，居然能通。

(agent) [410874] Arguments com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebViewClient.onPageFinished(com.pichillilorenzo.flutter_inappwebview.in_app_webview.InAppWebView{c22f292 VFED..CL. ........ 0,0-2160,1080}, a18K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5L8i4y4Q4x3X3g2K6M7e0l9H3x3o6u0Q4x3X3g2U0L8W2)9J5c8X3I4G2j5X3u0&6i4K6u0r3i4K6y4r3N6h3W2V1i4K6y4p5x3e0f1%4x3K6b7%4y4U0x3H3i4K6t1$3j5h3#2H3i4K6y4n7N6r3!0C8k6h3&6Q4x3@1c8y4g2q4f1K6e0i4A6c8x3@1&6B7e0i4N6j5P5V1f1K6e0i4A6m8x3@1#2B7K9K6c8z5g2q4g2%4e0X3A6Y4y4V1#2*7g2X3q4c8L8r3c8G2k6f1c8K9N6$3q4g2f1i4S2e0x3V1A6b7j5W2q4Q4x3U0V1`.

8、链接在浏览器可以打开，可以f12 debug，但是没意义，因为充值接口不在游戏，不充值无法进行，所以这条路可能无意义，也许协议有漏洞，但需要分析。

基本上就是使用以下这两个请求链接来校验账号信息。

404K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5L8i4y4Q4x3X3g2K6M7e0l9H3x3o6u0Q4x3X3g2U0L8W2)9J5c8X3q4H3K9g2)9J5c8X3q4H3M7q4)9J5c8X3q4U0j5$3!0#2L8Y4c8Q4x3V1k6Y4k6i4c8Q4x3V1k6A6L8X3k6G2i4K6u0W2k6r3)9`.
432K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6^5L8i4y4Q4x3X3g2K6M7e0l9H3x3o6u0Q4x3X3g2U0L8W2)9J5c8X3q4H3K9g2)9J5c8X3q4H3M7q4)9J5c8Y4y4W2M7Y4k6W2M7W2)9J5c8X3I4A6M7%4c8Q4x3X3g2V1L8H3`.`.

9、网页js源码分析，寻找key、iv.......，F12初步分析网页逻辑，找到修改金币的位置，debug断点，修改数据，可以增加金币，但是和服务器交互后金币还是会被清零。

            setAccountInfo(t) {
                if (this.userInfoBarData = t,
                null === this.userInfoBar)
                    throw new ReferenceError("RoomLayer 已被 destroy");
                this.userInfoBar.setUserIcon(t.icon, t.frame),
                this.userInfoBar.setUserID(t.nickname),
                this.userInfoBar.setUserLevel(t.vip),
                t.agentUserId && this.userInfoBar.setUid(t.agentUserId),
                this.setCurrentGold(t.score) //修改t.score
            }

后面会继续更新。

[培训]科锐逆向工程师培训第53期2025年7月8日开班！