feat(huya): R33 45函数全零调用定论+第9密文(4036B,头89c8f5变体)
- 25JNI+2XTEA核+16信封+2Java 全部安装且0调用 - 报告加密=防hook设计 (隐藏路径) - 9密文集齐: 头变体 69c9f5/75c8f5/89c8f5 会话段逐注册变化
This commit is contained in:
yml2213
@@ -1527,3 +1527,19 @@ full: 7c da | 11 | 69 c9 f5 28 9c 4d 46 | 95 6f 21 | 10 bb 80
|
|||||||
### 下一步 (R33)
|
### 下一步 (R33)
|
||||||
1. native 信封/收集器全钩: mfa 2E164/2E250/25234/252EC/34B98/34A00/2E4A4 + ga 1F918/1F9C8/27DBC/27CE0/23DF8!
|
1. native 信封/收集器全钩: mfa 2E164/2E250/25234/252EC/34B98/34A00/2E4A4 + ga 1F918/1F9C8/27DBC/27CE0/23DF8!
|
||||||
2. 或用已知对差分出 native 变体的确切公式 (再校验 Java 解密器)
|
2. 或用已知对差分出 native 变体的确切公式 (再校验 Java 解密器)
|
||||||
|
|
||||||
|
## §11.64 R33: 45 函数全零定论 + 第 9 密文 (2026-08-29)
|
||||||
|
|
||||||
|
### 全量钩子结果 (同一活体会话!)
|
||||||
|
- 25 JNI (mfa 11 + ga 14) + 2 XTEA 核 + 16 信封/收集器 + 2 Java = **全部安装, 全部 0 次调用**!
|
||||||
|
- 报告密文生成完全避开: JNI方法族 / XTEA核心 / deflate信封 / 解码链 / Java Cprivate!
|
||||||
|
- → turing 报告加密 = 隐藏调用路径 (防 hook 设计落实)
|
||||||
|
|
||||||
|
### 新密文 (第 9 个!)
|
||||||
|
- POST 4303B, cipher 4036B @80, 头: 7cda1189c8f5349c4d6c317a984ec2ee
|
||||||
|
- 头变体: 89c8f5 (vs 69c9f5/75c8f5!) — 会话段每注册变化; 计数位 34
|
||||||
|
|
||||||
|
### 剩余路径
|
||||||
|
1. ART 内联帧深度回溯 (bt 全 libart! Java 侧调用方在 JIT 内联里!)
|
||||||
|
2. native 上更早: libturing 的 a87 事件收集 → 找构造点 (sub_2C76C 采集器等)
|
||||||
|
3. 内存快照 @ SSL_write 时点 (密文生成缓冲区刚用完, 可扫关联!)
|
||||||
|
|||||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,247 @@
|
|||||||
|
'use strict';
|
||||||
|
function emit(row) { try { send(row); } catch (e) {} }
|
||||||
|
function btOk(ctx) { try { return Thread.backtrace(ctx, Backtracer.ACCURATE).slice(0, 40).map(a => { const m = Process.findModuleByAddress(a); return m ? m.name + '!' + a.sub(m.base) : a.toString(); }).join(' <- '); } catch (e) { return ''; } }
|
||||||
|
let fired = false, writes = 0;
|
||||||
|
for (const mod of Process.enumerateModules()) {
|
||||||
|
let addr = null;
|
||||||
|
try { addr = mod.getExportByName('SSL_write'); } catch (e) {}
|
||||||
|
if (addr === null) continue;
|
||||||
|
Interceptor.attach(addr, {
|
||||||
|
onEnter(args) {
|
||||||
|
writes++;
|
||||||
|
if (fired) return;
|
||||||
|
if (writes % 40 === 0) emit({ event: 'ssl-heartbeat', module: mod.name, writes });
|
||||||
|
const buf = args[1], num = args[2].toInt32();
|
||||||
|
if (num < 60) return;
|
||||||
|
try {
|
||||||
|
const u = new Uint8Array(buf.readByteArray(Math.min(num, 30000)));
|
||||||
|
// 编码成可检索串 (简化: 只查 ascii 子串)
|
||||||
|
let s = '';
|
||||||
|
for (let i = 0; i < u.length; i++) s += (u[i] >= 32 && u[i] < 127) ? String.fromCharCode(u[i]) : '.';
|
||||||
|
if (s.indexOf('dfpReport') < 0 && s.indexOf('hyudbwebuif') < 0) return;
|
||||||
|
fired = true;
|
||||||
|
const hex = Array.from(u).map(x => x.toString(16).padStart(2, '0')).join('');
|
||||||
|
emit({ event: 'str-magic', module: mod.name, num, full: hex, bt: btOk(this.context) });
|
||||||
|
// ---- co-located: 命中后立即在 turing 区域 + 全堆扫第二处魔数/明文特征 ----
|
||||||
|
const MAG = [0x57, 0x18, 0x82, 0xcf, 0x66, 0x4b, 0xb3, 0x94, 0x01, 0xee];
|
||||||
|
setTimeout(() => {
|
||||||
|
try {
|
||||||
|
const regions = [];
|
||||||
|
for (const m of Process.enumerateModules()) {
|
||||||
|
if (/turing|Turin/.test(m.name)) regions.push({ name: m.name, p: m.base, n: Math.min(m.size, 2 * 1024 * 1024) });
|
||||||
|
}
|
||||||
|
// 附加: 加载库里的映射区域 (含 .turing.dat mmap) — 用 Process.enumerateRanges 'r--' 太广, 只挑 map 文件路径含 turing 的
|
||||||
|
for (const r of Process.enumerateRanges('r--')) {
|
||||||
|
try {
|
||||||
|
const f = r.file ? r.file.path : '';
|
||||||
|
if (/turing|\.dat/.test(f) && !/\.so/.test(f)) regions.push({ name: f.slice(-40), p: r.base, n: Math.min(r.size, 512 * 1024) });
|
||||||
|
} catch (e) {}
|
||||||
|
}
|
||||||
|
let nFound = 0;
|
||||||
|
for (const rg of regions) {
|
||||||
|
try {
|
||||||
|
const buf = new Uint8Array(rg.p.readByteArray(rg.n));
|
||||||
|
for (let i = 0; i + 10 < rg.n; i++) {
|
||||||
|
let ok = true;
|
||||||
|
for (let j = 0; j < 10; j++) if (buf[i+j] !== MAG[j]) { ok = false; break; }
|
||||||
|
if (!ok) continue;
|
||||||
|
nFound++;
|
||||||
|
if (nFound > 12) break;
|
||||||
|
// 邻域 ASCII 提取
|
||||||
|
const as = [];
|
||||||
|
for (let k = -128; k < 1024; k += 64) {
|
||||||
|
try {
|
||||||
|
const c = Array.from(new Uint8Array(rg.p.add(i + k).readByteArray(64)));
|
||||||
|
const str = c.map(x => (x >= 32 && x < 127) ? String.fromCharCode(x) : '.').join('');
|
||||||
|
if (/[A-Za-z0-9_\-\.\/:]{10,}/.test(str)) as.push({ k, s: str });
|
||||||
|
} catch (e) {}
|
||||||
|
}
|
||||||
|
emit({ event: 'co-magic', mod: rg.name, off: '0x' + i.toString(16), ascii: as.slice(0, 10) });
|
||||||
|
}
|
||||||
|
} catch (e) {}
|
||||||
|
}
|
||||||
|
emit({ event: 'co-done', n: nFound, regions: regions.length });
|
||||||
|
} catch (e) { emit({ event: 'co-err', msg: String(e).slice(0, 120) }); }
|
||||||
|
}, 0);
|
||||||
|
} catch (e) {}
|
||||||
|
},
|
||||||
|
});
|
||||||
|
emit({ event: 'ssl-hooked', module: mod.name });
|
||||||
|
}
|
||||||
|
|
||||||
|
// ===== 附加: Java 密钥钩子 (Cprivate.b 明文+密钥 / Perseus.a 会话密钥) =====
|
||||||
|
setTimeout(function(){
|
||||||
|
function S(o){ try { send(o); } catch(e){} }
|
||||||
|
try {
|
||||||
|
Java.perform(function(){
|
||||||
|
var hooked = 0;
|
||||||
|
try {
|
||||||
|
var Cpr = null, Melon = null;
|
||||||
|
Java.enumerateClassLoaders({
|
||||||
|
onMatch: function(loader){
|
||||||
|
try {
|
||||||
|
Java.classFactory.loader = loader;
|
||||||
|
var c = Java.use('com.tencent.turingfd.sdk.ams.ga.private');
|
||||||
|
if (c) { Cpr = c; Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon'); }
|
||||||
|
} catch(e){}
|
||||||
|
},
|
||||||
|
onComplete: function(){}
|
||||||
|
});
|
||||||
|
if (!Cpr) { Cpr = Java.use('com.tencent.turingfd.sdk.ams.ga.private'); Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon'); }
|
||||||
|
var Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon');
|
||||||
|
Cpr.b.overload('[B','[B').implementation = function(a, b){
|
||||||
|
var out = this.b(a, b);
|
||||||
|
try {
|
||||||
|
S({event:'cpr-b', dlen:a.length, klen:b.length,
|
||||||
|
key:Melon.a(b), dhead:(Melon.a(a)||'').substring(0,300)});
|
||||||
|
} catch(e){ S({event:'cpr-err', e:String(e)}); }
|
||||||
|
return out;
|
||||||
|
};
|
||||||
|
hooked++;
|
||||||
|
} catch(e){ S({event:'cpr-nohook', e:String(e).substring(0,120)}); }
|
||||||
|
try {
|
||||||
|
var Perseus = Java.use('com.tencent.turingfd.sdk.ams.ga.Perseus');
|
||||||
|
var Guava = Java.use('com.tencent.turingfd.sdk.ams.ga.Guava');
|
||||||
|
Perseus.a.implementation = function(){
|
||||||
|
this.a();
|
||||||
|
try {
|
||||||
|
var g = this.b.value;
|
||||||
|
if (g) S({event:'perseus-key', c:g.c.value, b1:g.a.value, blen: g.b.value ? g.b.value.length : -1});
|
||||||
|
} catch(e){}
|
||||||
|
};
|
||||||
|
hooked++;
|
||||||
|
} catch(e2){ S({event:'cpr-noperseus', e:String(e2).substring(0,120)}); }
|
||||||
|
S({event:'cpr-installed', hooked:hooked});
|
||||||
|
});
|
||||||
|
} catch(e) { S({event:'cpr-perm', e:String(e).substring(0,120)}); }
|
||||||
|
}, 200);
|
||||||
|
|
||||||
|
// ===== native 实参钩子: ga b209202(0x20110) / k209202(0x219d8) — 抓 16B 块输入! =====
|
||||||
|
setTimeout(function(){
|
||||||
|
try {
|
||||||
|
var mod = Process.findModuleByName('libturingga.so');
|
||||||
|
if (!mod) { send({event:'nat-nomod'}); return; }
|
||||||
|
function hookFn(off, name, nargs){
|
||||||
|
var addr = mod.base.add(off);
|
||||||
|
try {
|
||||||
|
Interceptor.attach(addr, {
|
||||||
|
onEnter: function(args){
|
||||||
|
var regs = '';
|
||||||
|
for (var i=2;i<Math.min(nargs,7);i++) regs += ' a'+i+'='+args[i].toString(16);
|
||||||
|
send({event:'nat-ent', name:name, regs:regs});
|
||||||
|
this.t = Date.now();
|
||||||
|
},
|
||||||
|
onLeave: function(ret){
|
||||||
|
send({event:'nat-ret', name:name, ret:ret.toString(16), dt:Date.now()-this.t});
|
||||||
|
}
|
||||||
|
});
|
||||||
|
} catch(e){ send({event:'nat-fail', name:name, e:String(e).substring(0,80)}); }
|
||||||
|
}
|
||||||
|
hookFn(0x20110, 'b209202', 7);
|
||||||
|
hookFn(0x219d8, 'k209202', 4);
|
||||||
|
hookFn(0x1f918, 'xtea-enc', 5);
|
||||||
|
send({event:'nat-hooked'});
|
||||||
|
} catch(e){ send({event:'nat-exc', e:String(e).substring(0,100)}); }
|
||||||
|
}, 200);
|
||||||
|
|
||||||
|
// ===== 核心: XTEA 核心内部调用钩 — 抓密钥指针! =====
|
||||||
|
setTimeout(function(){
|
||||||
|
function findBase(name){
|
||||||
|
try { return Process.findModuleByName(name); } catch(e){ return null; }
|
||||||
|
}
|
||||||
|
function hookXtea(mod, off, name, inOffset){
|
||||||
|
if (!mod) { send({event:'xtea-nomod', name:name}); return; }
|
||||||
|
var addr = mod.base.add(off);
|
||||||
|
try {
|
||||||
|
Interceptor.attach(addr, {
|
||||||
|
onEnter: function(args){
|
||||||
|
try {
|
||||||
|
// XTEA: a1=buf(输入), a2=±n, a3=key!
|
||||||
|
var n = args[1].toInt32();
|
||||||
|
var kp = args[2];
|
||||||
|
var key = kp.readByteArray(16);
|
||||||
|
var khex = Array.prototype.map.call(new Uint8Array(key), function(x){return ('0'+x.toString(16)).slice(-2)}).join('');
|
||||||
|
// buf 头 (inOffset 字节开读: 输入轮回)
|
||||||
|
var bh = '';
|
||||||
|
try {
|
||||||
|
var inb = args[inOffset].readByteArray(8);
|
||||||
|
bh = Array.prototype.map.call(new Uint8Array(inb), function(x){return ('0'+x.toString(16)).slice(-2)}).join('');
|
||||||
|
} catch(e){}
|
||||||
|
send({event:'xtea-got', name:name, n:n, key:khex, bufH:bh});
|
||||||
|
} catch(e){ send({event:'xtea-err', name:name, e:String(e).substring(0,80)}); }
|
||||||
|
}
|
||||||
|
});
|
||||||
|
send({event:'xtea-hooked', name:name});
|
||||||
|
} catch(e){ send({event:'xtea-fail', name:name, e:String(e).substring(0,80)}); }
|
||||||
|
}
|
||||||
|
hookXtea(findBase('libturingmfa.so'), 0x24D58, 'mfa-xtea', 0);
|
||||||
|
hookXtea(findBase('libturingga.so'), 0x1F1CC, 'ga-xtea', 0);
|
||||||
|
}, 200);
|
||||||
|
|
||||||
|
// ===== mfa JNI 全族 + ga 全表钩子 =====
|
||||||
|
setTimeout(function(){
|
||||||
|
var mfa = Process.findModuleByName('libturingmfa.so');
|
||||||
|
var ga = Process.findModuleByName('libturingga.so');
|
||||||
|
var table = [];
|
||||||
|
if (mfa) table.push(['mfa', mfa, [
|
||||||
|
[0x25680,'a87_'], [0x25c98,'b87_'], [0x262a8,'c87_'], [0x26418,'d87_'],
|
||||||
|
[0x26768,'e87_'], [0x26edc,'f87_'], [0x271d0,'g87_'], [0x274c0,'h87_'],
|
||||||
|
[0x276d0,'i87_'], [0x27a78,'j87_'], [0x27b74,'k87_']
|
||||||
|
]]);
|
||||||
|
if (ga) table.push(['ga', ga, [
|
||||||
|
[0x1fcb8,'a209202'], [0x20110,'b209202'], [0x20574,'c209202'], [0x20688,'d209202'],
|
||||||
|
[0x20984,'e209202'], [0x20fc4,'f209202'], [0x211e8,'g209202'], [0x21468,'h209202'],
|
||||||
|
[0x21624,'i209202'], [0x21948,'j209202'], [0x219d8,'k209202'], [0x42d50,'l209202'],
|
||||||
|
[0x21bdc,'m209202'], [0x43900,'n209202']
|
||||||
|
]]);
|
||||||
|
var hooked = 0;
|
||||||
|
table.forEach(function(t){
|
||||||
|
var nm = t[0], mod = t[1];
|
||||||
|
t[2].forEach(function(h){
|
||||||
|
try {
|
||||||
|
Interceptor.attach(mod.base.add(h[0]), {
|
||||||
|
onEnter: function(args){
|
||||||
|
var r = '';
|
||||||
|
for (var i=2;i<6;i++) { try { r += ' a'+i+'='+args[i].toString(16); } catch(e){} }
|
||||||
|
send({event:'jni-ent', f:nm+'/'+h[1], regs:r});
|
||||||
|
this.t = Date.now();
|
||||||
|
},
|
||||||
|
onLeave: function(ret){
|
||||||
|
send({event:'jni-ret', f:nm+'/'+h[1], ret:ret.toString(16), dt:Date.now()-this.t});
|
||||||
|
}
|
||||||
|
});
|
||||||
|
hooked++;
|
||||||
|
} catch(e){ send({event:'jni-fail', f:nm+'/'+h[1], e:String(e).substring(0,60)}); }
|
||||||
|
});
|
||||||
|
});
|
||||||
|
send({event:'jni-table', hooked:hooked});
|
||||||
|
}, 200);
|
||||||
|
|
||||||
|
// ===== 信封/收集器族全钩 =====
|
||||||
|
setTimeout(function(){
|
||||||
|
function hk(mod, off, name, note){
|
||||||
|
if (!mod) { send({event:'env-nomod', f:name}); return; }
|
||||||
|
try {
|
||||||
|
Interceptor.attach(mod.base.add(off), {
|
||||||
|
onEnter: function(args){
|
||||||
|
var r='';
|
||||||
|
for (var i=0;i<5;i++){ try{ r+=' a'+i+'='+args[i].toString(16); }catch(e){} }
|
||||||
|
send({event:'env-ent', f:name, regs:r});
|
||||||
|
this.t=Date.now();
|
||||||
|
},
|
||||||
|
onLeave: function(ret){
|
||||||
|
send({event:'env-ret', f:name, ret:ret.toString(16), dt:Date.now()-this.t});
|
||||||
|
}
|
||||||
|
});
|
||||||
|
} catch(e){ send({event:'env-fail', f:name, e:String(e).substring(0,60)}); }
|
||||||
|
}
|
||||||
|
var mfa = Process.findModuleByName('libturingmfa.so');
|
||||||
|
var ga = Process.findModuleByName('libturingga.so');
|
||||||
|
[ [mfa,0x2E164,'mfa-env-def-xtea'], [mfa,0x2E250,'mfa-env-parse'], [mfa,0x25234,'mfa-xtea-w'], [mfa,0x252EC,'mfa-xtea-w2'],
|
||||||
|
[mfa,0x34B98,'mfa-deflate'], [mfa,0x34A00,'mfa-inflate'], [mfa,0x2E4A4,'mfa-decode'], [mfa,0x27DA4,'mfa-a87core'],
|
||||||
|
[ga,0x1F918,'ga-xtea-enc'], [ga,0x1F9C8,'ga-xtea-dec'], [ga,0x27DBC,'ga-decode'], [ga,0x27CE0,'ga-state-enc'],
|
||||||
|
[ga,0x23DF8,'ga-enc-ctx'], [ga,0x1BAD8,'ga-ctx-thunk'], [ga,0x1AA64,'ga-feed'], [ga,0x19F0C,'ga-feed2'] ].forEach(function(x){
|
||||||
|
hk(x[0], x[1], x[2], x[3]);
|
||||||
|
});
|
||||||
|
send({event:'env-table-done'});
|
||||||
|
}, 200);
|
||||||
Reference in New Issue
Block a user