iddoeldor

extract db

PASS=alpine; PORT=2222; sshpass -p $PASS ssh -p $PORT root@localhost -t "cp \$(find /var/mobile/Containers/Data/Application/ -name s4l*db) /private/var/tmp/skype.db" && sshpass -p $PASS scp -P $PORT root@localhost:/private/var/tmp/skype.db .

pull & read plist

/tmp$ scp -P 2222 root@localhost:/private/var/mobile/Containers/Data/Application/F8C7294C-2B60-48EC-A987-D46B9FE4DEAE/Library/Preferences/com.skype.skype.plist .
/tmp$ sudo apt-get install libplist-utils
/tmp$ plistutil -i com.skype.skype.plist | less

iddoeldor

{

  onEnter: function (log, args, state) {
    soname = Memory.readUtf8String(args[0]);
    if(soname.includes('libmono-btls-shared.so')) {
      log("libmono-btls-shared.so cargada!");
      this.dlopen = true;
      this.dlopenMonitor = false;

    }

iddoeldor

$ gcc test.c

$ python solve.py
WARNING | 2019-05-06 19:54:00,017 | angr.state_plugins.symbolic_memory | The program is accessing memory or registers with an unspecified value. This could indicate unwanted behavior.
WARNING | 2019-05-06 19:54:00,017 | angr.state_plugins.symbolic_memory | angr will cope with this by generating an unconstrained symbolic variable and continuing. You can resolve this by:
WARNING | 2019-05-06 19:54:00,017 | angr.state_plugins.symbolic_memory | 1) setting a value to the initial state
WARNING | 2019-05-06 19:54:00,017 | angr.state_plugins.symbolic_memory | 2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to make unknown regions hold null
WARNING | 2019-05-06 19:54:00,017 | angr.state_plugins.symbolic_memory | 3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY_REGISTERS}, to suppress these messages.
WARNING | 2019-05-06 19:54:00,018 | angr.state_plugins.symbolic_memory | Filling register r15 with 8 unconstrained bytes referenced from 0x810 (__libc_csu_

iddoeldor

#include <android/log.h>
#include <jni.h>
#include <binder/Binder.h>
#include <binder/Parcel.h>
#include <binder/IServiceManager.h>
#include <dlfcn.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

iddoeldor

from ghidra.program.model.address import Address
from ghidra.program.model.mem import MemoryAccessException
from ghidra.program.flatapi import FlatProgramAPI
from ghidra.util.task import TaskMonitor

import math
import json
from os.path import isfile, join, dirname
import struct as st
import string

iddoeldor

var kModuleName = 'library.so';
var _module = Process.findModuleByName(kModuleName);
var _module_end = _module.base.add(_module.size);
var o = 0xFF537;
Interceptor.attach(base.add(o),{
  onEnter: function (args) {
    console.log(o.toString(16), this.context.x0.readPointer().readCString())

    this.tid = Process.getCurrentThreadId();

iddoeldor

#include <speex/speex.h>
#include <iostream>
#include <fstream>
#include <vector>
#include <iterator>
#include <cassert>

int main(int argc, char const *argv[])
{
    if (argc < 2)

iddoeldor

import sark

for segname in ['.bss', '.data']:
    for line in sark.Segment(name=segname).lines:
        if not line.name:
            continue

        if line.name.startswith('g_'):
            continue

iddoeldor

def strs(f=None, visited=None, level=0, maxlevel=-1):
    if maxlevel >= 0 and level > maxlevel:
        return [], set()
    if not f:
        f = sark.Function()
    if not visited:
        visited = set()
        root = True
    else:
       root = False

iddoeldor

Java.scheduleOnMainThread(function() {
        Toast = Java.use("android.widget.Toast");
        var currentApplication = Java.use('android.app.ActivityThread').currentApplication();
        var context = currentApplication.getApplicationContext();
        Toast.makeText(context,"hello world", Toast.LENGTH_SHORT.value).show();
});