From 0647c0c68253c211a956ee9af76cbb1b52d05808 Mon Sep 17 00:00:00 2001 From: yml2213 Date: Sat, 29 Aug 2026 09:04:15 +0800 Subject: [PATCH] =?UTF-8?q?feat(huya):=20R33=2045=E5=87=BD=E6=95=B0?= =?UTF-8?q?=E5=85=A8=E9=9B=B6=E8=B0=83=E7=94=A8=E5=AE=9A=E8=AE=BA+?= =?UTF-8?q?=E7=AC=AC9=E5=AF=86=E6=96=87(4036B,=E5=A4=B489c8f5=E5=8F=98?= =?UTF-8?q?=E4=BD=93)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 25JNI+2XTEA核+16信封+2Java 全部安装且0调用 - 报告加密=防hook设计 (隐藏路径) - 9密文集齐: 头变体 69c9f5/75c8f5/89c8f5 会话段逐注册变化 --- docs/HUYA_HDID_ALGORITHM_GEN.md | 16 ++ evidence/dfp_live/dfp_body_4303.bin | Bin 0 -> 4116 bytes evidence/dfp_live/dfp_post_4303.bin | Bin 0 -> 4303 bytes tools/frida/hook_env.js | 247 ++++++++++++++++++++++++++++ 4 files changed, 263 insertions(+) create mode 100644 evidence/dfp_live/dfp_body_4303.bin create mode 100644 evidence/dfp_live/dfp_post_4303.bin create mode 100644 tools/frida/hook_env.js diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md index 918037d..2356c9c 100644 --- a/docs/HUYA_HDID_ALGORITHM_GEN.md +++ b/docs/HUYA_HDID_ALGORITHM_GEN.md @@ -1527,3 +1527,19 @@ full: 7c da | 11 | 69 c9 f5 28 9c 4d 46 | 95 6f 21 | 10 bb 80 ### 下一步 (R33) 1. native 信封/收集器全钩: mfa 2E164/2E250/25234/252EC/34B98/34A00/2E4A4 + ga 1F918/1F9C8/27DBC/27CE0/23DF8! 2. 或用已知对差分出 native 变体的确切公式 (再校验 Java 解密器) + +## §11.64 R33: 45 函数全零定论 + 第 9 密文 (2026-08-29) + +### 全量钩子结果 (同一活体会话!) +- 25 JNI (mfa 11 + ga 14) + 2 XTEA 核 + 16 信封/收集器 + 2 Java = **全部安装, 全部 0 次调用**! +- 报告密文生成完全避开: JNI方法族 / XTEA核心 / deflate信封 / 解码链 / Java Cprivate! +- → turing 报告加密 = 隐藏调用路径 (防 hook 设计落实) + +### 新密文 (第 9 个!) +- POST 4303B, cipher 4036B @80, 头: 7cda1189c8f5349c4d6c317a984ec2ee +- 头变体: 89c8f5 (vs 69c9f5/75c8f5!) — 会话段每注册变化; 计数位 34 + +### 剩余路径 +1. ART 内联帧深度回溯 (bt 全 libart! Java 侧调用方在 JIT 内联里!) +2. native 上更早: libturing 的 a87 事件收集 → 找构造点 (sub_2C76C 采集器等) +3. 内存快照 @ SSL_write 时点 (密文生成缓冲区刚用完, 可扫关联!) diff --git a/evidence/dfp_live/dfp_body_4303.bin b/evidence/dfp_live/dfp_body_4303.bin new file mode 100644 index 0000000000000000000000000000000000000000..5b150043485b32602c7794d491c1068f851edbb3 GIT binary patch literal 4116 zcmV+v5bN&%01y-q11vmDRt#u$d0};AVs~X?b!lb^WM*(uWpHnDbbSB;59kO00R{wg zQe|-+009r$3I+fc2Vrhxa&Kv5EdT)z#8()C&t^-rlmYI1+7XG!^)#GKY%zM6PQvcT z)%&nO;Iq73%KghKe{Sqvg_wH56{9~_a+N!zYcrSxX~3Z!_%nwPs~&^v7SR0u*(JAk5)>{u)KSfW+HJ>zfayeK5}A?tE3Q>t@yVerR6tl11*f`gUQwozR__WAevpMIY z?u7c*Or!hx3Qegr4pA#=Aq@woKI2`eJWkg(a24OiwvlkH98`8tnGf~&`$*7H%gC?8 z=igDo_473zPo_6D^RlKf-FL7@q5(~m;PoJSH`W*-*+3*VZfU9d>&8PgqtXm`;&(5T zzm5y%Q#``g$-G5O-=w4=FCpRBP-%(;5=89bcti8@s^ z+qx8ePOmWmFczZz+TakYW=yJRw>12+OYC-F8ws;agh*j~Zzdx5548 zdV`9=<+y1+GsvO-*i`(#jJYWB!X6Te$Lr)2grsW64SYa6^MX>{! zBJQhuSr&G(z*iES3WEjxRajyaGtt(htsXCxdJ$l>>ybr?&syvudQOpl4x#Be;z6(;4hKQ%IJ_jK8-$ z-WO_sNd!N>u7&mlWm-OipIg-l^5`<8NYQccykA$HQ*M7`Wt>)U9Ql4#qit6VKBoT4 zhDSwXuY6`Jf4mK6Vpf%%a19y_xj{@rAw~@8_6Gjq`la)@ z+x94Dzd_3Zfgtv@d8QJ*Ha4mMITQ?;sy6Braf|YfaiBpMYL6+y2}2vFe3cwF<4n%N z1eI`CHnjJW_9$}}LDP+0GGR7Q2(SN9b?fM0gSDmz{Dm=Ah91wrgl!m-2n=maZs{^>OyCX7x)29Uip~ zA&#u10)AUbzxMng=xh7tpGFM76%i!(8Yp9K<5803O}6>N_wx~EX&Y)$mmL=uZn{y=1Q&h&8Vi&*UMdn>=5~Ns5n$1fE;vDj1_odsM#HI%?h549WQq z?@#Cz*kNWF;Yx~kL!Z>;Z8S(Hci=E-765!;3rY~k=pC>PV56E*4q8YsXfl} zy$a%nOlUgxMJa%RyIQNnxg0o1MYq`cSUtHs(pZjtJ+#+S#o<4y>?*ad9@bhju)gLV zQwBY2?+H=WzrJN2=)5OuRz(F0k@qZ>FMDi4nz2)=1?*O)x4+U* z`uAYSNimwbO0*?d6Qi;hmstRPDY-`3(V>y!GN&rqa9Z_ta^H12pI+irap?r-7tGez zU|CBozMgPNPHt&^EVTpG_>!DfRy0HN>PZ>Ph7!&@^CAm6D#W8cZJ9H8IPBwoTe^!V zQ?OOU>2DW0Y3j?q&cUS(2a(5mA;;)6c~qsQm2Z!)z$xmkt!NCqidb-(dRRAD)RoK# z428lqg|t6vLoF84q9q!{fE;V;lTn=4Ml>zExgvZ23ET8!+k{6xSqa?L&sAevKe-h066gGgB#Tnb_vg9Bfh_BwD9%|$+GW#G|Qtn ztAsTEx8FWe3bm(Hwxkz&WF>Bk#8u<{*E2u>3~A=%)P?^<>LUA?3}P=_B{p7=38-;e zwX19v+m(-;#go+r%hM<^smLg+=wDC^3G{j+M)6kg)=>X`RbR*OrEJEmz)SH*r}Hh1 z*~nRnc7T#aOZ~3E z`hux^YEg}40QLLCI`r7b>fgm{2px^28jtb)j%;RndfhEAjwf=x&)c?2d-VYo3yb2g zCge#NITxvZ1=Oi=J-)=IX=$}}fYbDRp9ZtEMSi%f3^UB-=O}o>?3U7(Te7oTA?Dq+ zZm_N5T`UUy`Vg=`IuLl9hURBJonBtT-GQf;*}41OrP?IS#EII;DI&kUuxeGvR)V8D z(ungoeg-7@9n;c=1N!iL*G)j=B}`r$cwxJmWbv%I#n?}?&WeLGBRBP~c%p39MXb{)3u9=Tp$e!Uf>k4NP4jU5n$qxzo)MsmEGO|1gU21%&Yae+K0|l5h^mRInhchNI_%H2RCP(WRp668KYi;@29z#_|W_o5TBf1iSRB4ClLX zOk`hOZq~0};ZQR^W(;C&)lr!GRu|`1_?7w(72oyIx)RRSwCSr8zml<)HBO?MCmMjh za9U$j@t-NsqEw8UW|1q5G}tY?YmWKomtZZG)saUav!d1@K}nN$na>9C&iu2CW*ghH zuyhaw`utKM0Pe^c7dWb1J&?vJ`YY4~6S!ANu&9MQ`X*Phf=;3GrObiN9E2ra5RQ2p z4OYItjy$M`8{6demI#p55!b>Q0t^fPU?XhH^iv&o!PNqXz%0!5T&z5=!d?}S#h=Gg z23VXC=*XJNpdTJlBs%R(%N>1e^k|~BFC9m~`#5Ih+)(Zld0rQLz^wH3Qo!k!a4(Qp z<=hog{t_iSe>MiQKYZ)FSzt-SlmQ0D8T}QxMp+po?ekh0-t(_A7$ev6m@MoFG=2ra zMT;Kz)42kBE43LoJB;Q#DBY8^ZQ_QwR+d3ve3h1h35&S*jF zt)oqp5|&rr82BQ_+??Fhp*40&;vN3Ju0ASRMKr$Aw$QCS#wKHT?8`GxpRBG^r*0x? z({jtq6euum;m;3V4+ItrMeg)g;v@RcV@N6({nL538b6}%F%)yZrh9m?d352U!T9!PAk7G*Z{T`4&9w6_dQ0;b5 zFi+72MiYS0oqF1du}oqZ)Wjj8Ei_VR5E+pgZP`NgeQ(ZIBkq3L?%^X&8^KNqzEk6h z5=vOs6;Q`wz{7!ex=T+RL>Y%tv~qHz`pE=}-gi{|BCH6cjAX~JA_fOD=4Ol)nT+&}^NOX6IR zFIKF)oZTO-7CZ}h4>Wol4uXnNXgZFhuX5khhLRXA!g&Nf_t+9BxZ49DAmn{lgSNWv z<#dv+2*j~5)gkoi;gl0 zb3MB=s`B_hFoI=Q#&HwX$&MrP3d?A8rmEAl*N$ALFwZalsUgNj<)bno7hM_m{XhRv zNm6ngI4cc>yjE|&Y$vH$Qn_c9GIC&&_3WuNn{kKh`~W0; z87c%&Ac8C<>8M;WR(8dxg%NEnl*>@*f_7Y^pT-}i5&n6LI+sVAtpo@ZmLg>mTrqWW SPoWzK-ZlV03=52y45$p5!U2H* literal 0 HcmV?d00001 diff --git a/evidence/dfp_live/dfp_post_4303.bin b/evidence/dfp_live/dfp_post_4303.bin new file mode 100644 index 0000000000000000000000000000000000000000..44fa61db317fc94a52310648a4b4796aa250d133 GIT binary patch literal 4303 zcmV;=5HRmhPg7JNFCa)%R8TK5E-?)XX)ShTaylR}4GKeVZggdCbS+eQaAi6mVQ_G4 zX=7n@X>V>XZ)0?2bS-mqa%Ev{4GKeVZggdCbS+F}ZfA68Iv_MLF*XefNN;m=Iv{s* zVQ^_KXmxpEE@N+P4GKeVZf<2`bZKvHIv`7BWpFJ)Y-x674GKYHV`Xr3Ek$l)Z)9n1 zXF4EfdTDSC3RQDuaxFn;Wo~pjAa84EbaZepGcGYSE;$Vf4GI7N5EKvtEIdqB3}|(E zVRd9;cV%LAX=VvzW^htvaBp&SeE=1^^ZZVQyq{Z)s#L z009rgR~UlNW=pe_0q%U-5sAq4G@MOrF?yIz!tTe_`>;UZv%Fl&{mUwUZtPx#n0mn# zqd!-2l{=(sGnfQvz@Z)ZGlvkX9)s%^(ER?{V7C4BH;iLjYyyro$q@2HTY}s8yOJ6j z(Hcs?L^{lkgtw8u!u@clG(xB&o_JFHhzOKA0vsZjBf*4kJTpm--p*@zZ<9vC8KeyB(9@j~6fQZ`QO$wcZO4Lu z=|p7`nUVP`u2o&}$)PP&Kv)z7r@C!m1-g)tKjAM2Qj^}Mw8&huIp?D8g!yhTjkq@*A!SFTRr zBTruV?Tmpe?`kM=$)(hvtg%VVxq9;%Je==|I#o5>x)gm*uQ35I7NY*z;1H{3OsZ(N zH2ktl>~>%q3%X^(y)QE_zfSLlHD(dxtLqoLRoHWNj2a#Wwp(^f8zwbkzjK=I(L-(d zO!gG2Zp*sDg<`+g0@2ZIyvdm1TU!E;8fg@_!TsfWgNniBxM@B!$f5q&RQ$h;xhV0% z9ukVj>*QOFmRY#YZy0fQ&;(1=WiNJrMYWTAt@!GkD*v3AUDgC{p+YR?yGxQ7Iw10R}!2Gg9ZInSYi}2 z(blA`9xs)85n#0B#<&eXJrGt{#6pvmS;C6PRAt*YOZu<5?Pj&jemii)syhU(o&dD& zVhaQvQaTP3t22F&B5IhbY_s2VPzJ=lGl4aT&N|=WK#UaRE3R$Ni7cJMFT*CCqAa=_ zt4+J7w*TF;YNV>5XJLRNxQz1C8SFY!NS4QpzqdTz7ixe>1V6s6h4utxT0VoHTh$5j z=rW{8(Q)s*Uss(|ZhvHDoK|og`F>TSZC4CFrvA!?M@3_=d}b?uybWh!S`zfL{*Tz# zW=!YKjsct4%7sS3vwpLA*wPpeXN|E{XO18IvDW#UFKhdY@Oe|ZXHzD1fA6VZ;HjhF zb)6sB_yJ0!j$T@D4H^x(K}*!#EwWbK<) zS)jB^25yrlV{Nmq6V7L5%^+fKZ9Di1DEBV{kKGX$Y&2Pkh_&==SkE`4AV4BYaIQv9 zmLIZ;6zOA_)UY)JxGD>gJVuiFea>oPiY_s54%a|gV5ErGmEPc^^sw|;tTQT{$k$Wf zu#XVtpwRucYiM4V@_p=f3j;y2tep^Yu_WU8}Yy0M(Mhw3d z5hVB;C}VEpQIh3Nw)w;N^9}5KMxSKJi2zly&C&hSLx&42%g}&n`p)g~gT_b%j|Bxd zeFd}}Au};-=VW)*&g}!Ik-lw3l)0i41oBC3{e`g?D6U=A@KpKePYYwcWUm{DHLn!U zw@>; zPB(@&P1#%BD-h4%CsF#5+UxR8>;om%+Wp6=J<>LzUCfN20d%<2~pL*zGWWhyeDf`MFk3x z_bin!du&3Qu~VuA>{h1Z?Nr_74+#=x^Bg&hxDM^O^0M|SKbcqK_kH-lX^PL2R&EMl zj_AFj$rd(F-zL!aoOX5K#2&~4nSie2@dt2GUp`ouJ;VkWyB+l6LqrlicB%J-ibSS$ za+E&%+}XnSxYUxo^VM{ZfSiiwFA}olAKmn zG(+?1Ng2zA63#pGA`3by#G^iKnKO7e?Bjl0x{D}NuvNtAZx=dg>dU^)!KDock;i%= z$LKV9RHdesZ;!9QDeA7RXbilHSa6zpST|VImCOhXg~Bz3v_EP?Ef&(EB^tzl9Bb;6 zQJmLCG%dTiB76S{+w^4HghxJE3Eb7sRbyK~=hAj2UqkT{iJtIBw>Tg&zywe%(hPq$ zs2|nx(OYuji^DT|p$XSYZg=U%uqlR+d+0&F%^CXZD z8Uw2z$(`$Z{a{dyk}15xZQyRWBqYpFhR)53XUV*OsiG{mMD-S51miIPdQa{Pvp)U_ z43flB0JmD*=!ZbKc8*i1yyh#9r8}^W#cB{s{jR|Jf~kCJQH^B)_4~v+^w`Jh-^FVP z9gUd*GtA}ZD0sr`meQA7va?$u=H0b!u&v@g zUS7i8fv1+)x%=Iv+9b@xiQ362BEP+`YE{Tqf}=aqi1Rpp1|<0%)6#|m`tW<#O+e%& zOkNv!VY`}S@vOPU*iW<0ii0yFH}#{Pr5&Uj*@)t8+A*Qrh?(OGjEyR2@{3h2rNISk zsCH~)2Zxgt^Kku|((s9%5ul1JC-D)3$2FePE$+>X3k)a%1koKtAhrSlGfD#w z>>h+$tumJFQR_$G1vRCohsm=J#ndS;D&`hu+i)&+cj!KyjjsN8M8^&a32r)67rj7g z^`XQ57&U^aI8H!);H}QcB;kW|?^59Z9UvUAVt!9U;>qnUlI*Bb_}AUctM$3sht5+G zDl)A((Ml`ijjU^?oO&L24LaRTz3P4}I}8lgJlChOFPNJG88i2lVT4Pl4pDECyRE(Ntkt>We*e$$k zj``@9U@eu^kw+l2qShcmNt1V(&j#_%{IiT^8{4z6bPxsl{8AwR?#LMzII3Jdkj5$c zE7SxNxK~NAsD(TFCReh8PNDLp%z@1uge6`Oj(HmmR=&TEJgA2o+vN6^2$0ng*TNYB z3=98YBW%m`Qyq7~)dGjWEX?&>tURy6UKNnVpT|-LSey~)$ePNaA0AO8I_*r$9er%{ zXri?*9Y?_XIA-PCQ0^0XUKe}7tn~F#!0DE7FOXQ}+!a#(5+yr-HU_gleCxbfU`fN2 z0S3ky{S~=JSs5hl^I93+^RF@(BiHhnEbIt0eg(lriyrvXxdOSJnV29@i2v0JAK?Jt z|Li?#9XtW#4%-xXs+E*~t&U;5E(EWTtUoJTqd^*30_lBQK_+>yl;ML|g?^xE@qNfG zH4{QIFl{t?)uwJ++L@(JY0pl+^vC6nJt`lG7~rbV=Jf#nPlE+nQ>=;wNQ`EW8bOeU zu9j!g)9hT1V~3KvY|^j4bXA^a8CTuF=5P=|K(OrlhH|(vv9(!rVROmk?-N6Fxk9po z(Ac4!M)$5M?3=?vX}way_Kgq&+doA+3tB~sv%<8W{WDaw z>W3Gcwv?^o8l!n3_prBnVFloK2x2z^Dad1Xh|jW^s$%rAKuvK}H2J>QW6v3hbEO+r z&&?@hW#uY`e}TQbGcten#{}4Uda1gF*k?b^XhG|(qfL|&mRH{x_#(#KoZQr*HFiqk z9sa(qJ}Oy7G``Wc(5*biCS!N(%QH`(tgch1ZX#*Za?8vVC@^l}&ktS?1QrZM?(|mT zBl^!{NGcfp(|Nb!xSRQyZp7kOVth$@q*7wF@8muPlsZ6QlOooJC>_O`(TKA{BKCbis>n!6EMxATz0Gfnl&KQr_lg} z16;)$&_?#|2=<-cl?KhvNQcZjunGh!zIX`6pXByAr?f6zCpviAhYUR%Kq@VBV536J z!I2e)Bm^S~gsWOwmOO`#V@l=y9*{sDAn&74?RHQwPtgWO6M)d2dfJJxOkx<+#37y0W>03SahbCJ7a*R!%Gfd$&-xq~5gP_v&Hf^6Fx@YraTW!?-D-aqp*dJ-aii^7ub6f@N36aTC?ajwA94 z%V>0_s?)UBj$EfO&oBR}A;w1KqcR~ET^aZNKmSolQgR$PD-DCDH1p5BK3aD7t%mN8 zA%w{_l`IKNCQBq`BqCN?ei?GoeoVjKw%-n+#NY4jt6ICBH!t03>`FDg;mF?DiJp&JO^HUK~j3yhcys0=M?Jl_BS literal 0 HcmV?d00001 diff --git a/tools/frida/hook_env.js b/tools/frida/hook_env.js new file mode 100644 index 0000000..286b28e --- /dev/null +++ b/tools/frida/hook_env.js @@ -0,0 +1,247 @@ +'use strict'; +function emit(row) { try { send(row); } catch (e) {} } +function btOk(ctx) { try { return Thread.backtrace(ctx, Backtracer.ACCURATE).slice(0, 40).map(a => { const m = Process.findModuleByAddress(a); return m ? m.name + '!' + a.sub(m.base) : a.toString(); }).join(' <- '); } catch (e) { return ''; } } +let fired = false, writes = 0; +for (const mod of Process.enumerateModules()) { + let addr = null; + try { addr = mod.getExportByName('SSL_write'); } catch (e) {} + if (addr === null) continue; + Interceptor.attach(addr, { + onEnter(args) { + writes++; + if (fired) return; + if (writes % 40 === 0) emit({ event: 'ssl-heartbeat', module: mod.name, writes }); + const buf = args[1], num = args[2].toInt32(); + if (num < 60) return; + try { + const u = new Uint8Array(buf.readByteArray(Math.min(num, 30000))); + // 编码成可检索串 (简化: 只查 ascii 子串) + let s = ''; + for (let i = 0; i < u.length; i++) s += (u[i] >= 32 && u[i] < 127) ? String.fromCharCode(u[i]) : '.'; + if (s.indexOf('dfpReport') < 0 && s.indexOf('hyudbwebuif') < 0) return; + fired = true; + const hex = Array.from(u).map(x => x.toString(16).padStart(2, '0')).join(''); + emit({ event: 'str-magic', module: mod.name, num, full: hex, bt: btOk(this.context) }); + // ---- co-located: 命中后立即在 turing 区域 + 全堆扫第二处魔数/明文特征 ---- + const MAG = [0x57, 0x18, 0x82, 0xcf, 0x66, 0x4b, 0xb3, 0x94, 0x01, 0xee]; + setTimeout(() => { + try { + const regions = []; + for (const m of Process.enumerateModules()) { + if (/turing|Turin/.test(m.name)) regions.push({ name: m.name, p: m.base, n: Math.min(m.size, 2 * 1024 * 1024) }); + } + // 附加: 加载库里的映射区域 (含 .turing.dat mmap) — 用 Process.enumerateRanges 'r--' 太广, 只挑 map 文件路径含 turing 的 + for (const r of Process.enumerateRanges('r--')) { + try { + const f = r.file ? r.file.path : ''; + if (/turing|\.dat/.test(f) && !/\.so/.test(f)) regions.push({ name: f.slice(-40), p: r.base, n: Math.min(r.size, 512 * 1024) }); + } catch (e) {} + } + let nFound = 0; + for (const rg of regions) { + try { + const buf = new Uint8Array(rg.p.readByteArray(rg.n)); + for (let i = 0; i + 10 < rg.n; i++) { + let ok = true; + for (let j = 0; j < 10; j++) if (buf[i+j] !== MAG[j]) { ok = false; break; } + if (!ok) continue; + nFound++; + if (nFound > 12) break; + // 邻域 ASCII 提取 + const as = []; + for (let k = -128; k < 1024; k += 64) { + try { + const c = Array.from(new Uint8Array(rg.p.add(i + k).readByteArray(64))); + const str = c.map(x => (x >= 32 && x < 127) ? String.fromCharCode(x) : '.').join(''); + if (/[A-Za-z0-9_\-\.\/:]{10,}/.test(str)) as.push({ k, s: str }); + } catch (e) {} + } + emit({ event: 'co-magic', mod: rg.name, off: '0x' + i.toString(16), ascii: as.slice(0, 10) }); + } + } catch (e) {} + } + emit({ event: 'co-done', n: nFound, regions: regions.length }); + } catch (e) { emit({ event: 'co-err', msg: String(e).slice(0, 120) }); } + }, 0); + } catch (e) {} + }, + }); + emit({ event: 'ssl-hooked', module: mod.name }); +} + +// ===== 附加: Java 密钥钩子 (Cprivate.b 明文+密钥 / Perseus.a 会话密钥) ===== +setTimeout(function(){ + function S(o){ try { send(o); } catch(e){} } + try { + Java.perform(function(){ + var hooked = 0; + try { + var Cpr = null, Melon = null; + Java.enumerateClassLoaders({ + onMatch: function(loader){ + try { + Java.classFactory.loader = loader; + var c = Java.use('com.tencent.turingfd.sdk.ams.ga.private'); + if (c) { Cpr = c; Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon'); } + } catch(e){} + }, + onComplete: function(){} + }); + if (!Cpr) { Cpr = Java.use('com.tencent.turingfd.sdk.ams.ga.private'); Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon'); } + var Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon'); + Cpr.b.overload('[B','[B').implementation = function(a, b){ + var out = this.b(a, b); + try { + S({event:'cpr-b', dlen:a.length, klen:b.length, + key:Melon.a(b), dhead:(Melon.a(a)||'').substring(0,300)}); + } catch(e){ S({event:'cpr-err', e:String(e)}); } + return out; + }; + hooked++; + } catch(e){ S({event:'cpr-nohook', e:String(e).substring(0,120)}); } + try { + var Perseus = Java.use('com.tencent.turingfd.sdk.ams.ga.Perseus'); + var Guava = Java.use('com.tencent.turingfd.sdk.ams.ga.Guava'); + Perseus.a.implementation = function(){ + this.a(); + try { + var g = this.b.value; + if (g) S({event:'perseus-key', c:g.c.value, b1:g.a.value, blen: g.b.value ? g.b.value.length : -1}); + } catch(e){} + }; + hooked++; + } catch(e2){ S({event:'cpr-noperseus', e:String(e2).substring(0,120)}); } + S({event:'cpr-installed', hooked:hooked}); + }); + } catch(e) { S({event:'cpr-perm', e:String(e).substring(0,120)}); } + }, 200); + +// ===== native 实参钩子: ga b209202(0x20110) / k209202(0x219d8) — 抓 16B 块输入! ===== +setTimeout(function(){ + try { + var mod = Process.findModuleByName('libturingga.so'); + if (!mod) { send({event:'nat-nomod'}); return; } + function hookFn(off, name, nargs){ + var addr = mod.base.add(off); + try { + Interceptor.attach(addr, { + onEnter: function(args){ + var regs = ''; + for (var i=2;i