各位大牛好:
本人最近在逆向12306的官方客户端,classdump之后发现了它基本上采用的是worklight写的,抓包分析之后看到了一个叫做checkcode的参数,我用ida分析了只是感觉将两个参数合并成一个字符串之后md5一下,然后自己试了一下与抓包的不符合。gdb分析的时候,我po某些寄存器,里面就是一些值也没有对象的具体内容,书上说gdb不靠谱,换成lldb是否好用?现在就卡在这里了,请问各位大牛我如何继续呢?给个思路也好,谢谢~
; CheckCodePlugin - (void)getcheckcode:(id) withDict:(id)
; Attributes: bp-based frame
; void __cdecl -[CheckCodePlugin getcheckcode:withDict:](struct CheckCodePlugin *self, SEL, id, id)
__CheckCodePlugin_getcheckcode_withDict__
var_68= -0x68
var_5C= -0x5C
var_58= -0x58
var_54= -0x54
var_50= -0x50
var_4C= -0x4C
var_48= -0x48
var_34= -0x34
var_30= -0x30
var_2C= -0x2C
var_28= -0x28
var_24= -0x24
var_18= -0x18
PUSH {R4-R7,LR}
ADD R7, SP, #0xC
PUSH.W {R8,R10,R11}
SUB.W R4, SP, #0x40
BIC.W R4, R4, #0xF
MOV SP, R4
VST1.64 {D8-D11}, [R4@128]!
VST1.64 {D12-D15}, [R4@128]
SUB SP, SP, #0x50
MOVW R1, #(:lower16:(selRef_pop - 0x4A80))
MOV R4, R2
MOVT.W R1, #(:upper16:(selRef_pop - 0x4A80))
STR R0, [SP,#0x68+var_54]
ADD R1, PC ; selRef_pop
MOV R0, R4
LDR R1, [R1] ; "pop"
BLX _objc_msgSend
MOVW R3, #(:lower16:(___objc_personality_v0_ptr - 0x4A98))
LDR R1, =(unk_220394 - 0x4A9A)
MOVT.W R3, #(:upper16:(___objc_personality_v0_ptr - 0x4A98))
MOVW R2, #(:lower16:(selRef_objectAtIndex_ - 0x4AA4))
ADD R3, PC ; ___objc_personality_v0_ptr
ADD R1, PC ; unk_220394
MOVT.W R2, #(:upper16:(selRef_objectAtIndex_ - 0x4AA4))
STR R0, [SP,#0x68+var_50]
LDR R3, [R3] ; ___objc_personality_v0
ADD R2, PC ; selRef_objectAtIndex_
STR R3, [SP,#0x68+var_34]
ADD R0, SP, #0x68+var_4C
STR R1, [SP,#0x68+var_30]
LDR R1, =0x134
STR R7, [SP,#0x68+var_2C]
ORR.W R1, R1, #1
STR.W SP, [SP,#0x68+var_24]
ADD R1, PC
STR R1, [SP,#0x68+var_28]
MOVS R1, #1
LDR R5, [R2] ; "objectAtIndex:"
STR R1, [SP,#0x68+var_48]
BLX __Unwind_SjLj_Register
MOV R0, R4
MOV R1, R5
MOVS R2, #0
BLX _objc_msgSend
STR R0, [SP,#0x68+var_58]
MOV R0, #(selRef_stringWithFormat_ - 0x4AEA) ; selRef_stringWithFormat_
MOV R5, #(classRef_NSString - 0x4AEC) ; classRef_NSString
MOV R2, #(stru_254554 - 0x4AF2) ; "%@%@"
ADD R0, PC ; selRef_stringWithFormat_
ADD R5, PC ; classRef_NSString
MOVW R3, #(:lower16:(cfstr_Fqn1 - 0x4AFE)) ; "1"
ADD R2, PC ; "%@%@"
MOVT.W R3, #(:upper16:(cfstr_Fqn1 - 0x4AFE)) ; "1"
LDR R1, [R0] ; "stringWithFormat:"
MOVS R0, #2
LDR R5, [R5] ; _OBJC_CLASS_$_NSString
ADD R3, PC ; "1"
STR R5, [SP,#0x68+var_5C]
STR R0, [SP,#0x68+var_48]
LDR R0, [SP,#0x68+var_58]
STR R0, [SP,#0x68+var_68]
MOV R0, R5
BLX _objc_msgSend
MOV R2, R0
MOV R0, #(selRef_md5_ - 0x4B18) ; selRef_md5_
ADD R0, PC ; selRef_md5_
LDR R1, [R0] ; "md5:"
MOVS R0, #3
STR R0, [SP,#0x68+var_48]
LDR R0, [SP,#0x68+var_5C]
BLX _objc_msgSend
STR R0, [SP,#0x68+var_5C]
LDR R0, [SP,#0x68+var_58]
CBZ R0, loc_4B7C