The target

Prints the parameters and return value of the CC_MD5 method

The environment

Jailbroken iOS devices require frida to be installed

For macOS computers, install Frida and install Frida-Tools

steps

(1) The mobile phone connects to the computer, and the mobile phone starts the app to be tested

(2) Frida-ps view the PID of the current app

frida-ps -Ua
Copy the code

The output is as follows:

PID Name Identifier -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 47712 WeChat com. Tencent. Xin 30692 alipay com. Alipay. Iphoneclient Calculator com.appleCopy the code

(3) Frida-trace the final wechat CC_MD5 method

frida-trace -U 47712 -i "CC_MD5"
Copy the code

The output is as follows:

Instrumenting functions...                                              
CC_MD5: Loaded handler at "/Users/xxxx/Documents/TargetApp/__handlers__/ASEProcessing/CC_MD5.js"
Copy the code

Hold down the keyboard Ctrl+C to stop frida-trace

(4) According to the above path to find the cc_md5. js file, and edit

Main code:

onEnter: function (log, args, state) { log('CC_MD5()--arg[0]='+args[0].readUtf8String()); }, onLeave: function (log, retval, state) { log('CC_MD5()--return--='); var md5_digest = hexdump(retval,{length:16}); var hexified = " "; var raw_array = md5_digest.split("\n"); for (var a=0; a<raw_array.length; a++) { var line_array = raw_array[a].split(" "); for (var b=1; b<line_array.length-1; b++) { if (line_array[b].length === 2) { hexified += line_array[b]; hexified = hexified.trim(); } } } log(hexified+"\n"); }}Copy the code

Remember to save the modification.

(5) Repeat step (3)

After a few finger operations on wechat, you will see some CC_MD5 related prints on the terminal:

20014 ms CC_MD5()--arg[0]=dong540131487888 20014 ms CC_MD5()--return--= 20014 ms c476c6182489c453fff807eeb9595f8d 20015 ms CC_MD5()--arg[0]=https://wx.qlogo.cn/mmhead/ver_1/3lDOnjQscyrAxQP555555f8MuNjW8tAqoETibPgkds5qLFiaKEkyzfxZ2fdg5uPuKib6N1 WyshhmI5fEqgqRiaXicZVzvp0NoAiakPkbeklsWI39S8/132 20015 ms CC_MD5()--return--= 20015 ms 3d9f8fb870f139c3c73d5d83j5734d26Copy the code

Test successful!