iTunes X64位, 版本12.6.5.3
调试工具:X64dbg、IDAPro 、HTTPdebugger
首先打开X64dbg,附加itunes.
发现程序直接退出,有反调试的,不过只是应用层的。
这里可以直接使用反反调试插件,但出于好奇还是看了看。
1.过反调试
直接下结束进程断点,kernel32.dll 的ExitProcess.
然后恢复进程,发现程序依然退出并未断下来,可能用的其他函数,先不猜这个。
下isDebuggerpresent()断点试试,这次断下来了,
看到这个函数,很明显是一个反调试的函数,还用到了 GetTickCount() 来避免程序断点,CheckRemotDebuggerPresent 和isDebuggerpresent 。也可以发现结束进程用的是TerminateProcess。
找到这个函数就很清晰了,修改一下跳转这个函数就无效了。
如上图,现在这个函数已经无效了,下TerminateProcess断点,继续运行。看有没有其他地方,运行发现已经没有断下来了,程序已经可以正常调试了。用x64dbg重启程序会发现程序开头还有调试检测,也很简单就不介绍了。
2.分析登录协议
首先用HTTPdebug抓包。
登录抓包,这一步若提示 “连接到 Apple ID 服务器时出错” 就代表被检测到抓包了。
过这个检测,有个临时方案,+C81280 处断点 ,后在开抓包工具,就能抓到。至于这是为什么,就不细说了。
抓包成功看到核心是标注的这三个包
获取 sign-sap-setup-cert
请求方式: POSTURLhttps://s.mzstatic.com/sap/setupCert.plist<plist><dict><key>sign-sap-setup-cert</key><data>AQIAAAQWMIIEEjCCAvqgAwIBAgIBHDANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJVUzETMBEGA1UEChMKQXBwbGUgSW5jLjEmMCQGA1UECxMdQXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNVBAMTDUFwcGxlIFJvb3QgQ0EwHhcNMTEwMTI2MTkwMTM0WhcNMTkwMTI2MTkwMTM0WjCBhTELMAkGA1UEBhMCVVMxEzARBgNVBAoMCkFwcGxlIEluYy4xJjAkBgNVBAsMHUFwcGxlIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MTkwNwYDVQQDDDBBcHBsZSBTeXN0ZW0gSW50ZWdyYXRpb24gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDa4A+Yl8tYKYYqC7ieGVoxwy0OaixSAe4dA/uCQWnNUCY2ercMbw45A7jUGFajCLI8w/s2QeTXyGdgMgtOMn2H9/3NU7AauvwfbMlFB62COPOofMROwrFW2T6ybW0EQRrBmkfArBV8LXiRqweiZbF6g92YS3dA2O5Q68drWAgGl1dVfSf4Cua1Feenk/nxgOZCeT8W0zKdEXZBKQoxCe8PW/jzp6n3Ug27+C10rKZJHx/OewWnhT2+z6KnqiOFZv7FFhJ+W+Ixd5ECCd9+fuSK4OxBrBcsBOC8eaSJeEQGiztLoLyE4rCCtTK+BBwD7YI+dTcUz3WfgjFtzwkUhtEnAgMBAAGjga4wgaswDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFPAwc2Py7x2szOYJMsH6eXqxaVBoMB8GA1UdIwQYMBaAFCvQaUeUdgn+9GuNLkCm90dNfwheMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly93d3cuYXBwbGUuY29tL2FwcGxlY2Evcm9vdC5jcmwwEAYKKoZIhvdjZAYCBAQCBQAwDQYJKoZIhvcNAQEFBQADggEBAD17j60fDCKKm0ujz/grsB9o4Qz3nCSDFgMt07Ko0EPorzyXJsit1SzETFVTAUnQ4rT75tty0Zi7/JvITrePzGWGf0S52icqTt/L39N930Fx+LPAHaIKM7nsK8Vzcvvhyl2OLzT0a8RPD8iKrA/7byVut66Ox+QCuCBOXVZMSZexJHR+yZOTNIyZ0afAHNPUwq5p65+fV+Jox8rVxSKCZEFY/njRysH5NmprRPezhnJ6ZEAXMZ28rHXw+jNR5b0Balg/8ACumVwKwsnpXhyHAuygCFVBKpuMZIWOUAPN4BGvznIZ61Lzr5Ktky6Undav/8Am8d6UkhzZvD02zFX6ONsAAAUxMIIFLTCCBBWgAwIBAgIISnQ/0ZM7Y5AwDQYJKoZIhvcNAQEFBQAwgYUxCzAJBgNVBAYTAlVTMRMwEQYDVQQKDApBcHBsZSBJbmMuMSYwJAYDVQQLDB1BcHBsZSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTE5MDcGA1UEAwwwQXBwbGUgU3lzdGVtIEludGVncmF0aW9uIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMDQxNDIyMTE1NVoXDTE0MDQxMzIyMTE1NVowaTEdMBsGA1UEAwwURFJNIFRlY2hub2xvZ2llcyBBMDExJjAkBgNVBAsMHUFwcGxlIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRMwEQYDVQQKDApBcHBsZSBJbmMuMQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL4tkXdyBqnMthEsRK5gt/jeP83WbyB6RoltOli/TPr+DPipyRVPqSn391cfFiPVAEcZ/d8OI8hdTc5gdxTasGug6RLkC0prjq/Tf67ZQxG1X082Vr2T1ZWZa6iYid5v3UmtM+fKN6XCb+3Gj0opLqwXxTrpbfogirVOar2cIlJOdxyQj+ZCZla6NhvjBeCDMUCOMkV8zU7qtLIwIL0tEGX1wgiCUdYOljNPU1j1SMHeWruhqn47Y3inQRMTBGyb/kX9p1LEqrBbEoY0S/TU1pV+BaZS1HzkoXi9YJyL0/9K8j4zLNf7oMcGFj7T+c6QZxYSBTUBrj3qUMQFUk125zUCAwEAAaOCAbowggG2MB0GA1UdDgQWBBQMbHKfljPJRvMMXWJDZxYlhrNcVDAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFPAwc2Py7x2szOYJMsH6eXqxaVBoMIIBDgYDVR0gBIIBBTCCAQEwgf4GCSqGSIb3Y2QFATCB8DAoBggrBgEFBQcCARYcaHR0cDovL3d3dy5hcHBsZS5jb20vYXBwbGVjYTCBwwYIKwYBBQUHAgIwgbYMgbNSZWxpYW5jZSBvbiB0aGlzIGNlcnRpZmljYXRlIGJ5IGFueSBwYXJ0eSBhc3N1bWVzIGFjY2VwdGFuY2Ugb2YgdGhlIHRoZW4gYXBwbGljYWJsZSBzdGFuZGFyZCB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB1c2UsIGNlcnRpZmljYXRlIHBvbGljeSBhbmQgY2VydGlmaWNhdGlvbiBwcmFjdGljZSBzdGF0ZW1lbnRzLjAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8vY3JsLmFwcGxlLmNvbS9hc2ljYS5jcmwwDgYDVR0PAQH/BAQDAgWgMBMGCiqGSIb3Y2QGDAIBAf8EAgUAMA0GCSqGSIb3DQEBBQUAA4IBAQCzR9MjeoFy1yK32EyHlabYoUy1XY+OfcDN/qZkDJj3XJVKKrYVj