利用VirtualApp hook Unity游戏

老论坛搬家

是时展其技矣!
是时候展现真正的技术了!
系时候展现真正嘅技术嘞!
重要嘅嘢讲三次.
前方高能,无破解基础就表往下看了,这里有基础教程
开发工具： AndroidStudio3.0
开发环境: Android-NDK-r10e,Android SDK,java sdk

先来个传送门VirtualApp
首先简单讲解下VirtualApp的用途, VirtualApp是一个开源的Android App虚拟化引擎，允许在其中创建虚拟空间，并在这个虚拟空间中运行其他应用。
类似于LBE平行空间。

本次讲解的内容是利用VirtualApp来hook Unity游戏的dll文件
首先下载VirtualApp并解压到一个磁盘里,然后打开AndroidStudio把项目导入




导入进去之后直接去看c代码,因为hook操作也是在so中执行的


找到IOUniformer.cpp  然后ctrl+F搜索方法

void onSoLoaded(const char *name, void *handle)

hook so的操作就在这里执行,  首先我们要对Unity打的Android的apk包有一定的了解,这样我们才可以一气呵成不走弯路

对unity3d引擎的游戏，重要的资源就是C#脚本，脚本是被打包到APK的assets目录下的一些dll文件，有的游戏可能会对其加密，运行的时候再动态解密。可以通过HOOK libmono.so中的函数mono_image_open_from_data_with_name就可以DUMP出原始内容
IDA也是通过断点mono_image_open_from_data_with_name来dump出自己需要的dll文件

在onSoLoaded方法中我们可以获取到加载进来的so
void onSoLoaded(const char *name, void *handle)然后直接上代码,以下代码用途是捕获mono然后提取mono_image_open_from_data_with_name这个方法

• void onSoLoaded(const char *name, void *handle) {
  
• //判断加载进来的so是否为libmono.so
  
•     if(strstr(name,"mono")){
  
•     //mono加载进来
  
•     ALOGD(" allready found libmono.so");
  
•      //通过dlsym函数从libmono中提取到mono_image_open_from_data_with_name这个方法
  
•       void *mono_image_open_from_data_with_name = dlsym(handle, "mono_image_open_from_data_with_name");
  
•       //判空处理,增强健壮性
  
•       if (mono_image_open_from_data_with_name == NULL){
  
•              ALOGD(" mono_image_open_from_data_with_name not found!");
  
•              ALOGD(" dlsym err: %s.", dlerror());
  
•          }else{
  
•              ALOGD(" mono_image_open_from_data_with_name found: %p", mono_image_open_from_data_with_name);
  
•             //开始Hook
  
•              MSHookFunction(mono_image_open_from_data_with_name, (void *)&mono_image_open_from_data_with_name_mod, (void **)&mono_image_open_from_data_with_name_orig);
  
•          }
  
•        }}
  

到了此处已经提取到了mono中的mono_image_open_from_data_with_name方法 接下来就该hook dll了

• int mono_image_open_from_data_with_name_mod(char *data, int data_len, int need_copy, void *status, int refonly, const char *name) {
  
•         //打印加载过来的dll的名字 ,内存大小以及数据
  
•         ALOGD(" mono_image_open_from_data_with_name, name: %s, len: %d, buff: %s", name, data_len, data);
  
•         int ret = mono_image_open_from_data_with_name_orig(data, data_len, need_copy, status, refonly, name);
  
•         //判断dll是否为Assembly-CSharp.dll ,此处也可以hook其他的dll
  
•         if(strstr(name,"Assembly-CSharp.dll")){
  
•             //do sth. 在此处写入导出逻辑
  
•             ALOGD("  allready dump dll");
  
•          }
  
•     return ret;}
  

接着写入导出逻辑代码就可以把目标Assembly-CSharp.dll导出了

用法也是很简单,把编译好的apk拽到模拟器/真机中,然后运行



然后运行某游戏,查看AndroidStudio中的logcat

• 03-18 22:10:04.041 4717-4717/com.ztx.guopan D/VA++: [dumpu3d] allready found libmono.so
  
• 03-18 22:10:04.041 4717-4717/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name found: 0x9edc4ad1
  
• 03-18 22:10:04.041 4717-4717/com.ztx.guopan D/VA++: do_dlopen : /data/data/io.virtualapp/virtual/data/app/com.ztx.guopan/lib/libmono.so, return : 0xb24d73dc.
  
• 03-18 22:10:05.227 4717-4742/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: /data/app/com.ztx.guopan-1/base.apk/assets/bin/Data/Managed/UnityEngine.dll, len: 668672, buff: MZ�
  
• 03-18 22:10:05.246 4717-4742/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: /data/app/com.ztx.guopan-1/base.apk/assets/bin/Data/Managed/Assembly-CSharp-firstpass.dll, len: 117760, buff: MZ�
  
• 03-18 22:10:05.291 4717-4742/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: /data/app/com.ztx.guopan-1/base.apk/assets/bin/Data/Managed/Assembly-CSharp.dll, len: 4765184, buff: MZ�
  
• 03-18 22:10:05.299 4717-4742/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: /data/app/com.ztx.guopan-1/base.apk/assets/bin/Data/Managed/Assembly-UnityScript-firstpass.dll, len: 65024, buff: MZ�
  
• 03-18 22:10:05.301 4717-4742/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: /data/app/com.ztx.guopan-1/base.apk/assets/bin/Data/Managed/Assembly-UnityScript.dll, len: 55296, buff: MZ�
  
• 03-18 22:10:05.303 4717-4742/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: /data/app/com.ztx.guopan-1/base.apk/assets/bin/Data/Managed/UnityEngine.UI.dll, len: 176128, buff: MZ�
  
• 03-18 22:10:05.310 4717-4742/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: /data/app/com.ztx.guopan-1/base.apk/assets/bin/Data/Managed/Pathfinding.ClipperLib.dll, len: 58880, buff: MZ�
  
• 03-18 22:10:05.313 4717-4742/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: /data/app/com.ztx.guopan-1/base.apk/assets/bin/Data/Managed/Pathfinding.Ionic.Zip.Reduced.dll, len: 240640, buff: MZ�
  
• 03-18 22:10:05.315 4717-4742/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: /data/app/com.ztx.guopan-1/base.apk/assets/bin/Data/Managed/Pathfinding.JsonFx.dll, len: 56832, buff: MZ�
  
• 03-18 22:10:05.323 4717-4742/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: /data/app/com.ztx.guopan-1/base.apk/assets/bin/Data/Managed/Pathfinding.Poly2Tri.dll, len: 36352, buff: MZ�
  
• 03-18 22:10:05.325 4717-4742/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: /data/app/com.ztx.guopan-1/base.apk/assets/bin/Data/Managed/PlayMaker.dll, len: 156160, buff: MZ�
  
• 03-18 22:10:05.327 4717-4742/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: /data/app/com.ztx.guopan-1/base.apk/assets/bin/Data/Managed/CG.dll, len: 139264, buff: MZ�
  
• 03-18 22:10:05.330 4717-4742/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: /data/app/com.ztx.guopan-1/base.apk/assets/bin/Data/Managed/ICSharpCode.SharpZipLib.dll, len: 200704, buff: MZ�
  
• 03-18 22:10:05.335 4717-4742/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: /data/app/com.ztx.guopan-1/base.apk/assets/bin/Data/Managed/ZEx.dll, len: 300544, buff: MZ�
  
• 03-18 22:10:05.336 4717-4742/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: /data/app/com.ztx.guopan-1/base.apk/assets/bin/Data/Managed/zlib.net.dll, len: 69632, buff: MZ�
  
• 03-18 22:10:05.337 4717-4742/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: /data/app/com.ztx.guopan-1/base.apk/assets/bin/Data/Managed/Poly2Tri.dll, len: 83968, buff: MZ�03-18 22:10:08.944 4717-4843/com.ztx.guopan D/VA++: [dumpu3d] mono_image_open_from_data_with_name, name: (null), len: 3187712, buff: MZ�
  

接着把hook出的dll从模拟器导出了

后面我也不知道要干啥,我也不知道Reflector,IDA是啥东西,替换什么dll,签什么名


补充dump代码

• FILE* outfile;
  
•      outfile = fopen("/storage/emulated/0/Pictures/Assembly-CSharp.dll","wb");//(输入流) （变量）（输出文件流）
  
•      fwrite(data , sizeof(unsigned char) , data_len , outfile);
  
• 
  
•      fflush(outfile);     fclose(outfile);