记一次Clip Studio For iPad的逆向过程

前段时间买了<iOS应用逆向与安全之道>,第一次接触逆向工程
研究了将近一周终于逆向成功

难点:

  • Clip Studio Paint考虑到跨平台的因素,其UI使用OpenGL图形API开发,无法使用Reveal进行分析
  • 应用的大部分逻辑不在OC,大多在C中实现
  • 应用包体很大(400M+),每次编译部署到实机上会花费很久时间(还好有了M1芯片的Mac,可以直接在Mac上运行,调试效率高的不是一星半点)
  • 主要使用frida、aspect库进行分析

Github文章链接
欢迎交流

2 Likes

m1我有 develperid我没有 然后跑不了 :sob:

所以老哥是在学画画吗?要不交流一下?我刚把笔触练稳 脸型画不出来 哎

在M1上部署ios软件需要付费开发者帐号,这是个门槛,咬牙一起也买了个Hopper

想学画画,结果刚拿起笔来因为软件的关系就学了逆向 :joy:

我买了procreate… 你可以试试sidecar这个支持压感的…

procreate, ibisi都买了

CSP主要是有向量图层,PC版有的功能基本都移植了

我有既有mac又有id :wink:

那你号没了

为啥我签名总是失败,姿势不对么?

我用的MonkeyDev在运行时自动签,正常免费开发者账号也可以签的,你可以搜搜codesign相关的内容

我买了透视构成色彩的课,我觉得先把基础学好,各种角度的脸型自然就准了

1 Like

现在开始尝试1.10版本的CSP,从1.10.0版本之后开始的版本好像大改了代码,大部分C代码都变成了boost::detail::function、boost::function,剩下的都是sub_,
入口点那里啥也分析不出来,之前还能看到调用C的InitializeActivation,现在啥也看不到了,
随便看个调用堆栈

2021-01-24 16:55:43.113088+0800 CLIP STUDIO PAINT[5726:2981854] 6.31.0 - [Firebase/Analytics][I-ACS023013] Analytics collection disabled
2021-01-24 16:55:43.624668+0800 CLIP STUDIO PAINT[5726:2981345] ----aspect hook PWLegacyProgressiOS::beginWaitCursor:----
0   libMyClipStudioPaintDylib.dylib     0x0000000106d5fcc8 PrintCallStack + 52
1   libMyClipStudioPaintDylib.dylib     0x0000000106d5fd8c __HookClassMethodPrintBT_block_invoke + 132
2   CoreFoundation                      0x000000019c94c894 __invoking___ + 148
3   CoreFoundation                      0x000000019c94c71c -[NSInvocation invoke] + 448
4   CoreFoundation                      0x000000019c980234 -[NSInvocation invokeWithTarget:] + 80
5   libMyClipStudioPaintDylib.dylib     0x0000000106d41a04 -[AspectIdentifier invokeWithInfo:] + 756
6   libMyClipStudioPaintDylib.dylib     0x0000000106d45c14 __ASPECTS_ARE_BEING_CALLED__ + 2956
7   CoreFoundation                      0x000000019c94aec0 ___forwarding___ + 736
8   CoreFoundation                      0x000000019c94ab30 _CF_forwarding_prep_0 + 96
9   CLIP STUDIO PAINT                   0x000000010278bf84 _ZN12Planeswalker14PW3DDMeshDataTIN5boost10shared_ptrINS_17PW3DIVertexBufferEEEE16SetDrawElemArrayERKNSt3__16vectorINS_13PW3DDDrawElemENS6_9allocatorIS8_EEEE + 406280
10  CLIP STUDIO PAINT                   0x000000010289a394 _ZN5boost6detail8function21function_obj_invoker1INS_3_bi6bind_tIjNS_4_mfi3mf1IjN12Planeswalker13PWContextMenuERNS7_7PWEventEEENS3_5list2INS3_5valueIPS8_EENS_3argILi1EEEEEEEjSA_E6invokeERNS1_15function_bufferESA_ + 13948
11  CLIP STUDIO PAINT                   0x000000010289aa68 _ZN5boost6detail8function21function_obj_invoker1INS_3_bi6bind_tIjNS_4_mfi3mf1IjN12Planeswalker13PWContextMenuERNS7_7PWEventEEENS3_5list2INS3_5valueIPS8_EENS_3argILi1EEEEEEEjSA_E6invokeERNS1_15function_bufferESA_ + 15696
12  CLIP STUDIO PAINT                   0x000000010289af48 _ZN5boost6detail8function21function_obj_invoker1INS_3_bi6bind_tIjNS_4_mfi3mf1IjN12Planeswalker13PWContextMenuERNS7_7PWEventEEENS3_5list2INS3_5valueIPS8_EENS_3argILi1EEEEEEEjSA_E6invokeERNS1_15function_bufferESA_ + 16944
13  CLIP STUDIO PAINT                   0x0000000103c21200 _ZN5boost6detail8function21function_obj_invoker1INS_3_bi6bind_tIjNS_4_mfi3mf1IjN12Planeswalker20PWFolderTagDialogBoxERNS7_7PWEventEEENS3_5list2INS3_5valueIPS8_EENS_3argILi1EEEEEEEjSA_E6invokeERNS1_15function_bufferESA_ + 2212
14  CLIP STUDIO PAINT                   0x0000000103c2a838 _ZN5boost6detail8function21function_obj_invoker1INS_3_bi6bind_tIjNS_4_mfi3mf1IjN12Planeswalker20PWFolderTagDialogBoxERNS7_7PWEventEEENS3_5list2INS3_5valueIPS8_EENS_3argILi1EEEEEEEjSA_E6invokeERNS1_15function_bufferESA_ + 40668
15  CLIP STUDIO PAINT                   0x00000001003624f0 CLIP STUDIO PAINT + 1385712
16  CLIP STUDIO PAINT                   0x00000001002eeee0 CLIP STUDIO PAINT + 913120
17  CLIP STUDIO PAINT                   0x00000001027c22ec _ZN5boost6detail8function21function_obj_invoker1INS_3_bi6bind_tIjNS_4_mfi3mf1IjN12Planeswalker17PWCheckBoxEnablerERNS7_7PWEventEEENS3_5list2INS3_5valueIPS8_EENS_3argILi1EEEEEEEjSA_E6invokeERNS1_15function_bufferESA_ + 13232
18  CLIP STUDIO PAINT                   0x00000001027c2248 _ZN5boost6detail8function21function_obj_invoker1INS_3_bi6bind_tIjNS_4_mfi3mf1IjN12Planeswalker17PWCheckBoxEnablerERNS7_7PWEventEEENS3_5list2INS3_5valueIPS8_EENS_3argILi1EEEEEEEjSA_E6invokeERNS1_15function_bufferESA_ + 13068
19  CLIP STUDIO PAINT                   0x00000001027c1c84 _ZN5boost6detail8function21function_obj_invoker1INS_3_bi6bind_tIjNS_4_mfi3mf1IjN12Planeswalker17PWCheckBoxEnablerERNS7_7PWEventEEENS3_5list2INS3_5valueIPS8_EENS_3argILi1EEEEEEEjSA_E6invokeERNS1_15function_bufferESA_ + 11592
20  CLIP STUDIO PAINT                   0x00000001027ee3c0 _ZN5boost6detail8function21function_obj_invoker1INS_3_bi6bind_tIjNS_4_mfi3mf1IjN12Planeswalker6PWViewERNS7_7PWEventEEENS3_5list2INS3_5valueIPNS7_9PWEditBoxEEENS_3argILi1EEEEEEEjSA_E6invokeERNS1_15function_bufferESA_ + 8992
21  CLIP STUDIO PAINT                   0x00000001027ef5f8 _ZN5boost6detail8function21function_obj_invoker1INS_3_bi6bind_tIjNS_4_mfi3mf1IjN12Planeswalker6PWViewERNS7_7PWEventEEENS3_5list2INS3_5valueIPNS7_9PWEditBoxEEENS_3argILi1EEEEEEEjSA_E6invokeERNS1_15function_bufferESA_ + 13656
22  CLIP STUDIO PAINT                   0x00000001027a10a0 _ZN12Planeswalker14PW3DDMeshDataTIN5boost10shared_ptrINS_17PW3DIVertexBufferEEEE16SetDrawElemArrayERKNSt3__16vectorINS_13PW3DDDrawElemENS6_9allocatorIS8_EEEE + 492580
23  CLIP STUDIO PAINT                   0x00000001027a24f0 _ZN12Planeswalker14PW3DDMeshDataTIN5boost10shared_ptrINS_17PW3DIVertexBufferEEEE16SetDrawElemArrayERKNSt3__16vectorINS_13PW3DDDrawElemENS6_9allocatorIS8_EEEE + 497780
24  CLIP STUDIO PAINT                   0x000000010275fe34 _ZN12Planeswalker14PW3DDMeshDataTIN5boost10shared_ptrINS_17PW3DIVertexBufferEEEE16SetDrawElemArrayERKNSt3__16vectorINS_13PW3DDDrawElemENS6_9allocatorIS8_EEEE + 225720
25  CoreFoundation                      0x000000019c94c894 __invoking___ + 148
26  CoreFoundation                      0x000000019c94c71c -[NSInvocation invoke] + 448
27  libMyClipStudioPaintDylib.dylib     0x0000000106d45b04 __ASPECTS_ARE_BEING_CALLED__ + 2684
28  CoreFoundation                      0x000000019c94aec0 ___forwarding___ + 736
29  CoreFoundation                      0x000000019c94ab30 _CF_forwarding_prep_0 + 96
30  Foundation                          0x000000019d7136c8 __NSFireDelayedPerform + 416
31  CoreFoundation                      0x000000019c986068 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 32
32  CoreFoundation                      0x000000019c985c68 __CFRunLoopDoTimer + 1064
33  CoreFoundation                      0x000000019c9856fc __CFRunLoopDoTimers + 392
34  CoreFoundation                      0x000000019c96a63c __CFRunLoopRun + 1936
35  CoreFoundation                      0x000000019c969740 CFRunLoopRunSpecific + 600
36  HIToolbox                           0x00000001a4486678 RunCurrentEventLoopInMode + 292
37  HIToolbox                           0x00000001a44864a8 ReceiveNextEventCommon + 688
38  HIToolbox                           0x00000001a44861d8 _BlockUntilNextEventMatchingListInModeWithFilter + 76
39  AppKit                              0x000000019f141da4 _DPSNextEvent + 868
40  AppKit                              0x000000019f140724 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1312
41  AppKit                              0x000000019f13260c -[NSApplication run] + 600
42  AppKit                              0x000000019f103db0 NSApplicationMain + 1064
43  AppKit                              0x000000019f3f5c28 +[NSWindow _savedFrameFromString:] + 0
44  UIKitMacHelper                      0x00000001af54feac UINSApplicationMain + 1276
45  UIKitCore                           0x00000001bfc1e720 UIApplicationMain + 164
46  CLIP STUDIO PAINT                   0x0000000102762e14 _ZN12Planeswalker14PW3DDMeshDataTIN5boost10shared_ptrINS_17PW3DIVertexBufferEEEE16SetDrawElemArrayERKNSt3__16vectorINS_13PW3DDDrawElemENS6_9allocatorIS8_EEEE + 237976
47  CLIP STUDIO PAINT                   0x00000001027a1338 _ZN12Planeswalker14PW3DDMeshDataTIN5boost10shared_ptrINS_17PW3DIVertexBufferEEEE16SetDrawElemArrayERKNSt3__16vectorINS_13PW3DDDrawElemENS6_9allocatorIS8_EEEE + 493244
48  CLIP STUDIO PAINT                   0x0000000100f698c0 CLIP STUDIO PAINT + 13998272
49  libdyld.dylib                       0x000000019c88cf34 start + 4

调用栈中的这些C函数查找引用都是一堆sub_,
请教一下还有没有其他的分析思路?

1.10.6版本 gktp

嗯嗯 我用 MonkeyDev 可以在iPad 上调试 并不能在m1 上调试

要在m1上调试需要付费的开发者账号

看下Lumina能不能拉到

这个账号 我也弄了 签名工具不给力,前几天可以这几天 不知道加了什么校验 又过不去了。。。。

我记得看说是Apple从服务器上禁用了这么玩?

从MacOS 11.2开始禁用了,好像是安装ipa的时候会连服务器验证开发者是否允许运行在M1上