Git Product home page Git Product logo

uzmap-resource-extractor's Introduction

uzmap-resource-extractor

License Python 3.x


用于解密和提取apicloud apk下的资源文件(html, js ,css)

背景&说明

本人平时分析这类h5 app的时候,经常需要提取html, css, js等资源文件。 然而目前没有便捷的方法(有些通过xpose hook的方式提取,但比较麻烦)
所以我针对同类app分析, 同时也对其中的libsec.so文件进行逆向,发现是使用rc4方式加密,而且密钥可以静态提取,所以写了这个工具方便快速提取资源文件
项目的 resources 文件夹中附带了apk和libsec.so的文件样本,供参考分析。
如果后续的加密方式有修改而导致不适用,可以提issue,也特别欢迎各位有志之士添砖加瓦
这个工具仅供个人研究学习使用。 其它非法用途所造成的法律责任,一律与本项目无关。

Note

接入 AndroidNativeEmu ,探索并尝试新的解密思路

  • master 分支支持 python3.x
  • emu_support 分支支持 AndroidNativeEmu 解密方式
  • python2 分支支持 python2.7
    请根据具体需要选择相应分支

Setup

先安装项目的依赖

pip install -r requirements.txt
  • 支持pycryptodome, 让解密更高效

    pip install -r optional-requirements.txt
    

Usage

python main.py xxx.apk

支持参数列表通过 -h查看

python main.py -h

具体用例

  • 查看apk中的rc4密钥

    python main.py -v xxx.apk

    输出信息说明

         package      : xxx.ooo.xxx              ==> 应用包名
         uz_version   : 1.3.13                   ==> apicloud engine的版本号
         encrypted    : False                    ==> 资源是否加密
         rc4Key       : xxxxxxxxxxxxxxxxxxxx     ==> 资源加密用到的RC4密钥
    
  • 解密并提取所有的资源文件(如果不指明输出路径 默认输出到apk所在的文件夹下)

    python main.py -o 输出路径 xxx.apk

  • 支持批量识别和解密 可以指定文件夹,会自动扫描文件夹下的所有 apicloud apk 并执行识别或解密

    python main.py -v targetFolder

uzmap-resource-extractor's People

Contributors

newdive avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar

uzmap-resource-extractor's Issues

解密后的文件内容不可读

 ➜  uzmap-resource-extractor git:(master) python3 main.py -v /tmp/26f82bfa2911d19ce2013752ddfd1a63e15d1fc2.apk
/tmp/26f82bfa2911d19ce2013752ddfd1a63e15d1fc2.apk
	package      : aiyu.a45d36e98.a4dd6592a
	uz_version   : 3.0.77
	encrypted    : True
	rc4Key       : 57aca5e37ff7ecbdfad6

共找到 1 个 apicloud apk

 ➜  uzmap-resource-extractor git:(master) file /tmp/26f82bfa2911d19ce2013752ddfd1a63e15d1fc2/assets/widget/script/api.js
/tmp/26f82bfa2911d19ce2013752ddfd1a63e15d1fc2/assets/widget/script/api.js: data

 ➜  uzmap-resource-extractor git:(master) ls /tmp/26f82bfa2911d19ce2013752ddfd1a63e15d1fc2/assets/widget/
config.xml css        index.html js123      list       pages      script

apk 下载 https://1drv.ms/u/s!Ak3JGHQlv_fLiRllf3-siWnS6YPF?e=KUo1ge

风险提示,apk 会窃取通讯录,别在真机上运行

解密失败

按照说明执行后得到的文件还是加密的,解密失败!
兄弟有空可否帮忙看看,劳驾劳驾!万分感谢!

大佬有AndroidNativeEmu 方式的文章吗,我发现用你resources 里面提供的解密出来的文件(20220426_issue14.apk),都是0kb,信息如下,改如何解决

Register native ('bs', '(Ljava/lang/String;I)Ljava/lang/String;') failed on class Enslecb.
Register native ('bbs', '([BI)Ljava/lang/String;') failed on class Enslecb.
Register native ('md', '(Ljava/lang/String;I)Ljava/lang/String;') failed on class Enslecb.
Register native ('bmd', '([BI)Ljava/lang/String;') failed on class Enslecb.
Register native ('pm', '(Ljava/lang/Object;)Ljava/lang/String;') failed on class Enslecb.
Register native ('km', '(Ljava/lang/Object;)Ljava/lang/String;') failed on class Enslecb.

这个APK解密报错

https://a.app.qq.com/o/simple.jsp?pkgname=com.xingshiwu.app

环境:python3.7 windows
使用命令: python3 -v com.xingshiwu.app_1.0.4_11.apk
报错信息
Traceback (most recent call last):
File "D:/Desktop/uzmap-resource-extractor-master/main.py", line 33, in
extractMap = tools.decryptAllResourcesInApk(args[0],outputFolder,printLog=True)
File "D:\Desktop\uzmap-resource-extractor-master\tools.py", line 227, in decryptAllResourcesInApk
rc4Key = extractRC4KeyFromApk(apkFilePath)
File "D:\Desktop\uzmap-resource-extractor-master\tools.py", line 175, in extractRC4KeyFromApk
rc4Key = extractRC4Key(soContent)
File "D:\Desktop\uzmap-resource-extractor-master\tools.py", line 37, in extractRC4Key
dataSection,dataContent = elffile.get_section_by_name('.rodata'),None
File "D:\py3_venv\lib\site-packages\elftools\elf\elffile.py", line 105, in get_section_by_name
for i, sec in enumerate(self.iter_sections()):
File "D:\py3_venv\lib\site-packages\elftools\elf\elffile.py", line 114, in iter_sections
yield self.get_section(i)
File "D:\py3_venv\lib\site-packages\elftools\elf\elffile.py", line 93, in get_section
section_header = self._get_section_header(n)
File "D:\py3_venv\lib\site-packages\elftools\elf\elffile.py", line 468, in _get_section_header
stream_pos=self._section_offset(n))
File "D:\py3_venv\lib\site-packages\elftools\common\utils.py", line 39, in struct_parse
stream.seek(stream_pos)
File "D:\Python37\lib\zipfile.py", line 1025, in seek
self._fileobj.seek(self._orig_compress_start)
File "D:\Python37\lib\zipfile.py", line 704, in seek
if self.writing():
AttributeError: '_SharedFile' object has no attribute 'writing'

可以提供一个加密的吗

希望能写一个加密文件的功能 因为我研究的时候 修改文件之后 替换回去 这样更方便调试 解密后的替换进去 发现不能正常运行app

可以通过pyinstaller打包成exe可执行文件嘛

可以通过pyinstaller打包成exe可执行文件嘛?就是不用通过执行python main.py xx.apk这个cmd语句去执行解密过程,而是把项目打包成exe可执行文件,直接输入xx.apk就可以执行解密过程

测试某些app的时候会卡死

python main.py -v /disk1t/samba/apps/api/
...........
error extracting apicloud info :/disk1t/samba/apps/api/讯飞听见_2.0.1428.apk
Traceback (most recent call last):
File "/disk1t/samba/uzmap-resource-extractor-master/apk_util.py", line 296, in extractAPICloudInfo
attrsList = extractManifestAttributes(mBytes)
File "/disk1t/samba/uzmap-resource-extractor-master/apk_util.py", line 249, in extractManifestAttributes
stringList = extractStringList(fileBytes,8)
File "/disk1t/samba/uzmap-resource-extractor-master/apk_util.py", line 228, in extractStringList
length = (val << 8) | struct.unpack('=b',rawStringDataBlock[offset+1 : offset+2] )
TypeError: unsupported operand type(s) for |: 'int' and 'tuple'
error extracting apicloud info :/disk1t/samba/apps/api/讯飞听见1.0.1038.apk .apk
Traceback (most recent call last):
File "/disk1t/samba/uzmap-resource-extractor-master/apk_util.py", line 296, in extractAPICloudInfo
attrsList = extractManifestAttributes(mBytes)
File "/disk1t/samba/uzmap-resource-extractor-master/apk_util.py", line 249, in extractManifestAttributes
stringList = extractStringList(fileBytes,8)
File "/disk1t/samba/uzmap-resource-extractor-master/apk_util.py", line 228, in extractStringList
length = (val << 8) | struct.unpack('=b',rawStringDataBlock[offset+1 : offset+2] )
TypeError: unsupported operand type(s) for |: 'int' and 'tuple'
error extracting apicloud info :/disk1t/samba/apps/api/美达罗捷_2.1.3.apk
Traceback (most recent call last):
File "/disk1t/samba/uzmap-resource-extractor-master/apk_util.py", line 296, in extractAPICloudInfo
attrsList = extractManifestAttributes(mBytes)
File "/disk1t/samba/uzmap-resource-extractor-master/apk_util.py", line 249, in extractManifestAttributes
stringList = extractStringList(fileBytes,8)
File "/disk1t/samba/uzmap-resource-extractor-master/apk_util.py", line 228, in extractStringList
length = (val << 8) | struct.unpack('=b',rawStringDataBlock[offset+1 : offset+2] )
TypeError: unsupported operand type(s) for |: 'int' and 'tuple'

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.