介绍#

NOTE
曾经也是jnic正版用户，但是由于jnic的更新太慢了，150英镑的昂贵价格让人望而却步。 jnic还有授权次数限制，次数限制一旦没有就无法再次授权新设备。

有个myj2c的混淆，通过魔改native-obfuscator的逻辑来实现和 jnic 一致是性能和效果

radioegor146

native-obfuscator

Waiting for api.github.com...

00K

Waiting...

这里面也包括 chacha20 和一模一样的缓存技术,但是却丢失了flow的功能。

NOTE
但是这个myj2c的混淆名声不是很好，因为其中藏有后门，利用LZMA将无混native的class一同打包进.dat文件中

由于太无聊，这次看看jnic的3.7.0生成的代码都有什么新变化，~~希望这篇文章不会被dmca~~

配置#

字符串混淆#

新版本将原来的哈希SHA-256升级为SHA-512，增加了数字签名Ed25519

但是似乎字符串加密并没有什么变化。

唯一区别就是JNI_ONLOAD的

1
jnic_buf = (*env)->GetDirectBufferAddress(env, buf);
2
struct chacha20_context c;
3
chacha20_init_context(&c, key, jnic_buf + 32, 0);
4
chacha20_write_stream(&c, jnic_buf, 1681);

变为

1
uint8_t *java_buf = (*env)->GetDirectBufferAddress(env, buf);
2
struct chacha20_context c;
3
chacha20_init_context(&c, key, java_buf + 32, 0);
4
jnic_buf = malloc(2564);
5
chacha20_write_stream(&c, jnic_buf, 2564);

依旧没法避免 jni hook 得到这个buf（

对应更新：

Improved memory efficiency of loader

新功能useIntrinsics#

内部优化，根据官网的文档的话，那就是

该选项允许JNIC将特定Java API方法的调用替换为手工编写的最优代码。

除了能够提升性能外，这种方式还能防止在JVM层面对这些方法调用进行插桩检测，

从而增加逆向工程的难度。支持优化的方法包括：

java.lang.Object.getClass()
java.lang.String.equals(java.lang.Object)
java.lang.String.isEmpty()
java.lang.String.length()

若未指定该选项，默认值为 false（禁用状态）。

String.equals#

实际上就是把原来的CallBooleanMethod直接替换成一整块的代码块

未优化实现

1
// c_27id_7 ->  equals
2
stack0.i = (*env)->CallBooleanMethod(env，stack0.1, c_27id_7(env)，stack1.l);
3
if ((*env)->ExceptionCheck(env)){
4
  return;
5
}

优化后实现

1
// stack0.i 就相当于返回equals的结果
2
if (stack1.l == NULL) stack0.i = 0;
3
else if ((*env)->IsSameObject(env, stack0.l, stack1.l)) stack0.i = 1;
4
else if (!(*env)->IsInstanceOf(env, stack1.l, c_27(env))) stack0.i = 0;
5
else {
6
  jsize l = (*env)->GetStringLength(env, stack0.l);
7
  if (l != (*env)->GetStringLength(env, stack1.l)) stack0.i = 0;
8
  else {
9
    const jchar *s1 = (*env)->GetStringCritical(env, stack0.l, NULL);
10
    const jchar *s2 = (*env)->GetStringCritical(env, stack1.l, NULL);
11
    jboolean r = 1;
12
    for (jsize i = 0; i < l; ++i) {
13
        if (s1[i] != s2[i]) { r = 0; break; }
14
    }
15
    (*env)->ReleaseStringCritical(env, stack1.l, s2);
16
    (*env)->ReleaseStringCritical(env, stack0.l, s1);
17
    stack0.i = r;
18
  }
19
}

String.length#

未优化实现

1
stack2.l = local1.l;
2
stack2.i = (*env)->CallIntMethod(env, stack2.l, c_4id_2(env));
3
if ((*env)->ExceptionCheck(env)) {
4
  return;
5
}

优化后实现

1
stack2.l = local1.l;
2
stack2.i = (*env)->GetStringLength(env, stack2.l);
3
if ((*env)->ExceptionCheck(env)) {
4
  return;
5
}

实际上，我们依旧可以通过Hook GetStringLength 来得到这个字符串的长度以及内容

String.isEmpty#

优化前实现

1
stack2.l = local3.l;
2
stack2.i = (*env)->CallBooleanMethod(env, stack2.l, c_4id_1(env));
3
if ((*env)->ExceptionCheck(env)) {
4
    return;
5
}

优化后实现

1
stack2.l = local3.l;
2
stack2.i = (*env)->GetStringLength(env, stack2.l) == 0;
3
if ((*env)->ExceptionCheck(env)) {
4
  return;
5
}

实际上就是获取长度，判断它的长度是否为0，和前面的length依旧可以进行hook

Object.getClass#

优化前实现

1
stack2.l = local1.l;
2
stack2.l = (*env)->CallObjectMethod(env, stack2.l, c_3id_0(env));
3
if ((*env)->ExceptionCheck(env)) {
4
  return;
5
}

优化后实现

1
stack2.l = local1.l;
2
stack2.l = (*env)->GetObjectClass(env, stack2.l);
3
if ((*env)->ExceptionCheck(env)) {
4
  return;
5
}

实现的优化依旧还是在jni的体系中啊（，依旧可以轻松的Hook出来

fastCompile快速编译#

由于这个功能没人照做过，但是通过Hook可以复现同款操作（。

其输出的是：

1
zig cc -fno-sanitize=all -fno-sanitize-trap=all -Os -fno-optimize-sibling-calls -fno-slp-vectorize -target x86_64-windows -std=c11 -fPIC -shared -s -fvisibility=hidden -IC:\Users\xxxx\AppData\Local\Temp\jnic6249051816001900267 -oC:\Users\xxxx\AppData\Local\Temp\jnic6249051816001900267\WINDOWS_X86_64\jnic.jnilib C:\Users\xxxx\AppData\Local\Temp\jnic6249051816001900267\jnic.c

根据上面的hook之类输出则可以得到下面的代码

1
import java.io.File;
2
import java.io.IOException;
3
import java.util.ArrayList;
4
import java.util.List;
5

6
public class ZigMultiCompiler {
7
  private static final String BASE_DIR = "C:\\Users\\xxxxx\\AppData\\Local\\Temp\\jnic6249051816001900267";
8

9
  private static final String SOURCE_FILE_NAME = "jnic.c";
10

11
  static class Target {
12
    String zigTarget;   // Zig 的 target
13
    String outDirName;  // 输出文件夹名称
14
    String ext;         // 文件后缀 ( .jnilib, .so, .dll)
15

16
    public Target(String zigTarget, String outDirName, String ext) {
17
      this.zigTarget = zigTarget;
18
      this.outDirName = outDirName;
19
      this.ext = ext;
20
    }
21
  }
22

23
  public static void main(String[] args) {
24
    List<Target> targets = new ArrayList<>();
25

26
    // --- Windows ---
27
    targets.add(new Target("x86_64-windows", "WINDOWS_X86_64", ".jnilib"));
28
    // targets.add(new Target("x86-windows",    "WINDOWS_X86",    ".jnilib"));
29

30
    // --- Linux ---
31
    targets.add(new Target("x86_64-linux-gnu", "LINUX_X86_64",   ".so"));
32
    // targets.add(new Target("aarch64-linux-gnu", "LINUX_ARM64",    ".so"));
33

34
    targets.add(new Target("x86_64-macos",     "MACOS_X86_64",   ".dylib"));
35
    targets.add(new Target("aarch64-macos",    "MACOS_ARM64",    ".dylib"));
36

37

38
    long startTime = System.currentTimeMillis();
39
    int successCount = 0;
40

41
    for (Target target : targets) {
42
      boolean success = compileForTarget(target);
43
      if (success) successCount++;
44
    }
45

46
    long endTime = System.currentTimeMillis();
47
    System.out.println("\n========================================");
48
    System.out.println(String.format("批量编译完成。成功: %d / %d，耗时: %d ms",
49
            successCount, targets.size(), (endTime - startTime)));
50
  }
51

52
  private static boolean compileForTarget(Target target) {
53
    String sourcePath = new File(BASE_DIR, SOURCE_FILE_NAME).getAbsolutePath();
54
    File outputDir = new File(BASE_DIR, target.outDirName);
55
    File outputFile = new File(outputDir, "jnic" + target.ext);
56

57
    if (!outputDir.exists()) {
58
      outputDir.mkdirs();
59
    }
60

61
    List<String> command = new ArrayList<>();
62
    command.add("zig");
63
    command.add("cc");
64

65
    command.add("-fno-sanitize=all"); // 禁用所有运行时代码清洗/安全检查
66
    command.add("-fno-sanitize-trap=all"); // 防止编译器为未定义行为生成陷阱指令。
67
    command.add("-Os"); // 减小代码体积
68
    command.add("-fno-optimize-sibling-calls"); // 禁用“兄弟调用”
69
    command.add("-fno-slp-vectorize"); // 禁用 SLP
70
    command.add("-std=c11");
71
    command.add("-fPIC");
72
    command.add("-shared");
73
    command.add("-s"); // 删除符号表和调试信息
74
    command.add("-fvisibility=hidden"); // 隐藏符号
75

76
    command.add("-target");
77
    command.add(target.zigTarget);
78

79
    command.add("-I" + BASE_DIR);
80
    command.add("-o" + outputFile.getAbsolutePath());
81
    command.add(sourcePath);
82

83
    try {
84
      ProcessBuilder pb = new ProcessBuilder(command);
85
      pb.directory(new File(BASE_DIR));
86
      pb.inheritIO();
87

88
      Process process = pb.start();
89
      int exitCode = process.waitFor();
90

91
      if (exitCode == 0) {
92
        System.out.println("    [OK] 生成文件: " + target.outDirName + File.separator + outputFile.getName());
93
        return true;
94
      } else {
95
        System.err.println("    [FAIL] 编译失败: " + exitCode);
96
        return false;
97
      }
98
    } catch (IOException | InterruptedException e) {
99
      e.printStackTrace();
100
      return false;
101
    }
102
  }
103
}

果然这个编译还是太神秘了

缓存#

这个应该是对应的更新

通过 CSE 在 JNI ID 缓存上生成的原生代码性能提升（Improved performance of generated native code with CSE on JNI ID caches）

1
struct cached_c_5 {
2
  jclass _Atomic clazz;
3
  jmethodID id_3;
4
  jmethodID id_1;
5
  jmethodID id_2;
6
  jmethodID id_0;
7
};
8
static struct cached_c_5* c_5_(JNIEnv *env) {
9
  static struct cached_c_5 cache;
10
  static atomic_flag lock;
11
  if (atomic_load_explicit(&cache.clazz, memory_order_acquire)) return &cache;
12
  jclass clazz = (*env)->FindClass(env, jnic_decrypt((char[]) {60, -104, -28, -42, -8, 73, 11, -111, 48, 79, -26, -75, -119, -90, -67, 94, 108, 31, 102, 6, 52, -120, 10, 0}, 893, 23));
13
  while (atomic_flag_test_and_set(&lock)) {}
14
  if (!cache.clazz) {
15
    cache.id_2 = (*env)->GetMethodID(env, clazz, jnic_decrypt((char[]) {93, 106, -90, 50, 107, 117, 0}, 916, 6), jnic_decrypt((char[]) {-64, -61, 113, 40, 100, 52, -59, -33, 45, 113, 21, -97, 63, -58, 73, -10, -57, -87, 111, 72, -8, 7, -35, 56, 83, -63, -123, 49, 0}, 922, 28));
16
    cache.id_0 = (*env)->GetMethodID(env, clazz, jnic_decrypt((char[]) {-25, 94, -108, 72, 7, 81, 0}, 950, 6), jnic_decrypt((char[]) {-40, -85, -45, 0}, 956, 3));
17
    cache.id_1 = (*env)->GetMethodID(env, clazz, jnic_decrypt((char[]) {-118, -41, -21, 71, -5, -21, 0}, 959, 6), jnic_decrypt((char[]) {-97, 24, -54, -125, 58, -24, -117, 121, 3, -103, 88, 127, -81, -9, -79, 97, -14, 70, 12, -92, 89, -31, 0, -68, -107, -32, -61, 116, 109, -122, -83, -94, -113, -86, 35, 62, -70, -102, 98, -35, 32, 22, -53, -31, 65, 0}, 965, 45));
18
    cache.id_3 = (*env)->GetMethodID(env, clazz, jnic_decrypt((char[]) {-3, 36, -91, 100, -66, -4, 64, -47, 0}, 1010, 8), jnic_decrypt((char[]) {-97, 83, -23, -37, -99, 70, 51, 72, 47, 30, -118, 56, 23, -69, 49, 60, -117, -12, -84, 6, 0}, 1018, 20));
19
    clazz = (*env)->NewGlobalRef(env, clazz);
20
    atomic_store_explicit(&cache.clazz, clazz, memory_order_release);
21
  }
22
  atomic_flag_clear(&lock);
23
  return &cache;
24
}

升级为单独的一个函数

1
__attribute__((const))static jmethodID c_40id_0(JNIEnv *env) {
2
  static _Atomic jmethodID id;
3
  jmethodID cached = atomic_load_explicit(&id, memory_order_relaxed);
4
  if (__builtin_expect(cached != 0, 1)) return cached;
5
  jclass clazz = c_40(env);
6
  cached = (*env)->GetMethodID(env, clazz, "<init>", "(Ljava/lang/String;ILjava/lang/String;)V");
7
  atomic_store_explicit(&id, cached, memory_order_relaxed);
8
  return cached;
9
}
10
__attribute__((const))static jclass c_19(JNIEnv *env) {
11
  static _Atomic jclass clazz;
12
  jclass cached = atomic_load_explicit(&clazz, memory_order_relaxed);
13
  if (__builtin_expect(cached != 0, 1)) return cached;
14
  jclass loaded = (*env)->FindClass(env, "java/lang/Integer");
15
  loaded = (*env)->NewGlobalRef(env, loaded);
16
  if (atomic_compare_exchange_strong_explicit(&clazz, &cached, loaded, memory_order_relaxed, memory_order_relaxed))
17
      return loaded;
18
  (*env)->DeleteGlobalRef(env, loaded);
19
  return cached;
20
}

Flow#

太复杂了，分析不来

jnic机器码#

可以发现jnic的机器码是依据设备的mac地址

1
import java.net.InetAddress;
2
import java.net.NetworkInterface;
3
import java.security.MessageDigest;
4
import java.security.NoSuchAlgorithmException;
5
import java.util.Base64;
6

7
public class HWIDGenerator {
8
    private static final MessageDigest SHA256;
9

10
    static {
11
      try {
12
        SHA256 = MessageDigest.getInstance("SHA-256");
13
      } catch (NoSuchAlgorithmException e) {
14
        throw new RuntimeException(e);
15
      }
16
    }
17

18
    public static byte[] getMachineId() throws Exception {
19
      InetAddress localHost = InetAddress.getLocalHost();
20
      NetworkInterface networkInterface = NetworkInterface.getByInetAddress(localHost);
21
      byte[] macAddress = networkInterface.getHardwareAddress();
22
      byte[] machineId = SHA256.digest(macAddress);
23
      return machineId;
24
    }
25

26
    public static void main(String[] args) throws Exception {
27
    System.out.println(Base64.getEncoder().encodeToString(getMachineId()));
28
  }
29
}

❄

介绍#

配置#

字符串混淆#

新功能useIntrinsics#

String.equals#

String.length#

String.isEmpty#

Object.getClass#

fastCompile快速编译#

缓存#

Flow#

jnic机器码#