Dumpdecrypted 对插件脱壳

技能讨论
1

环境:
iPhone 5s (9.3.3)

使用的 dumpedecrypted 版本为

dumpdecrypted.plist

{
        Filter = {
                Bundles = (
                        "com.jnzc.recipebook",
                        "com.netease.iphonereader",
                        "com.netease.iphonereader.TodayExtension",
                        "com.tencent.qqreaderiphone",
                        "com.tencent.qqreaderiphone.todaywidget",
                );
        };
}

我想要实现的是对com.tencent.qqreaderiphone.todaywidget 这个QQ阅读的 today 插件进行脱壳。

我的操作是通过在通知中心添加 today 插件,然后通过点击插件启动应用

实际情况是:

应用可以脱壳,但是插件不能脱壳

Xcode 输出的错误信息比较简单就一句

Nov 21 03:32:03 Jasons-iPhone kernel[0] <Notice>: xpcproxy[5090] Builtin profile: container (sandbox)
Nov 21 03:32:03 Jasons-iPhone kernel[0] <Notice>: xpcproxy[5090] Container: /private/var/mobile/Containers/Data/Application/6C30EAEF-B7F9-42FA-99F4-5E3D7CAA6F61 (sandbox)
Nov 21 03:32:03 Jasons-iPhone com.apple.xpc.launchd[1] <Error>: assertion failed: 13G34: launchd + 116796 [9F6284CF-8A17-36CC-9DB5-85D510A21F14]: 0x3
Nov 21 03:32:03 Jasons-iPhone QQReaderUI[5090] <Notice>: MS:Notice: Injecting: com.tencent.qqreaderiphone [QQReaderUI] (1290.11)
Nov 21 03:32:03 Jasons-iPhone QQReaderUI[5090] <Notice>: MS:Notice: Loading: /Library/MobileSubstrate/DynamicLibraries/dumpdecrypted.dylib
Nov 21 03:32:03 Jasons-iPhone QQReaderUI[5090] <Warning>: mach-o decryption dumper
Nov 21 03:32:03 Jasons-iPhone QQReaderUI[5090] <Warning>: DISCLAIMER: This tool is only meant for security research purposes, not for application crackers.
Nov 21 03:32:03 Jasons-iPhone QQReaderUI[5090] <Warning>: [+] detected 64bit ARM binary in memory.
Nov 21 03:32:03 Jasons-iPhone QQReaderUI[5090] <Warning>: [+] offset to cryptid found: @0x10003cca8(from 0x10003c000) = ca8
Nov 21 03:32:03 Jasons-iPhone QQReaderUI[5090] <Warning>: [+] Found encrypted data at address 00004000 of length 37994496 bytes - type 1.
Nov 21 03:32:03 Jasons-iPhone QQReaderUI[5090] <Warning>: [+] Opening /private/var/containers/Bundle/Application/E276C2C9-20FE-4450-915A-86EBE07798AC/QQReaderUI.app/QQReaderUI for reading.
Nov 21 03:32:03 Jasons-iPhone QQReaderUI[5090] <Warning>: [+] Reading header
Nov 21 03:32:03 Jasons-iPhone QQReaderUI[5090] <Warning>: [+] Detecting header type
Nov 21 03:32:03 Jasons-iPhone QQReaderUI[5090] <Warning>: [+] Executable is a plain MACH-O image
Nov 21 03:32:03 Jasons-iPhone QQReaderUI[5090] <Warning>: [+] Opening /var/mobile/Containers/Data/Application/6C30EAEF-B7F9-42FA-99F4-5E3D7CAA6F61/Library/Caches/QQReaderUI.decrypted for writing.
Nov 21 03:32:03 Jasons-iPhone QQReaderUI[5090] <Warning>: [+] Copying the not encrypted start of the file
Nov 21 03:32:03 Jasons-iPhone QQReaderUI[5090] <Warning>: [+] Dumping the decrypted data into the file
Nov 21 03:32:04 Jasons-iPhone QQReaderUI[5090] <Warning>: [+] Copying the not encrypted remainder of the file
Nov 21 03:32:04 Jasons-iPhone SpringBoard[374] <Warning>: plugin com.netease.iphonereader.TodayExtension invalidated
Nov 21 03:32:04 Jasons-iPhone QQReaderUI[5090] <Warning>: [+] Setting the LC_ENCRYPTION_INFO->cryptid to 0 at offset ca8
Nov 21 03:32:04 Jasons-iPhone QQReaderUI[5090] <Warning>: [+] Closing original file
Nov 21 03:32:04 Jasons-iPhone QQReaderUI[5090] <Warning>: [+] Closing dump file
Nov 21 03:32:04 Jasons-iPhone SpringBoard[374] <Warning>: plugin com.tencent.qqreaderiphone.todaywidget invalidated
Nov 21 03:32:04 Jasons-iPhone QQReaderUI[5090] <Error>: MS:Error: process is not CS_VALID
Nov 21 03:32:04 Jasons-iPhone backboardd[306] <Notice>: SecTaskLoadEntitlements failed error=22 cs_flags=680500c, task->pid_self=-1

求解? 是操作不正确还是其他原因?

1 个赞