|
|
|
@@ -0,0 +1,112 @@
|
|
|
|
|
#!/usr/bin/env python3
|
|
|
|
|
"""抓 hyCred 签发链: 挂 saveLoginData(落盘) + LoginCred handler(vtable探测)。
|
|
|
|
|
|
|
|
|
|
用法: 脚本跑起来后, 在手机上 手动退出登录 -> 重新登录 一次。
|
|
|
|
|
捕获: 登录态JSON明文(含cred字段) / saveLoginData 入参 / LoginCred handler 触发。
|
|
|
|
|
"""
|
|
|
|
|
from __future__ import annotations
|
|
|
|
|
|
|
|
|
|
import json
|
|
|
|
|
import subprocess
|
|
|
|
|
import time
|
|
|
|
|
from pathlib import Path
|
|
|
|
|
|
|
|
|
|
import frida
|
|
|
|
|
|
|
|
|
|
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
|
|
|
|
|
|
|
|
|
|
JS = r"""
|
|
|
|
|
var base = Process.getModuleByName('libudbauthunify.so').base;
|
|
|
|
|
send({type:'armed'});
|
|
|
|
|
function hx(p,n){ try{ return Array.from(new Uint8Array(p.readByteArray(n))).map(x=>('0'+x.toString(16)).slice(-2)).join(''); }catch(e){ return 'ERR'; } }
|
|
|
|
|
function rdStr(p){ try{
|
|
|
|
|
var b0=p.readU8();
|
|
|
|
|
if((b0&1)===0){ var l=b0>>1; return {len:l,v:l?hx(p.add(1),Math.min(l,256)):''}; }
|
|
|
|
|
var len=parseInt(p.add(8).readU64().toString());
|
|
|
|
|
if(len>4096) return {len:len,v:''};
|
|
|
|
|
return {len:len,v:hx(p.add(16).readPointer(),len)};
|
|
|
|
|
}catch(e){ return {len:-1,v:String(e)}; } }
|
|
|
|
|
Java.perform(function(){
|
|
|
|
|
var n=0;
|
|
|
|
|
function go(){
|
|
|
|
|
try{
|
|
|
|
|
var seed=Java.use('com.duowan.kiwi.base.login.udb.HuyaLoginProxy');
|
|
|
|
|
var F=Java.ClassFactory.get(seed.class.getClassLoader());
|
|
|
|
|
var done=false;
|
|
|
|
|
['com.huyaudbunify.HuyaAuth','com.hysdkproxy.HuyaAuth','com.huyaudbunify.sdk.HuyaAuth'].forEach(function(cn){
|
|
|
|
|
if(done) return;
|
|
|
|
|
try{
|
|
|
|
|
var C=F.use(cn);
|
|
|
|
|
var inst = C.getInstance ? C.getInstance() : null;
|
|
|
|
|
var r = inst ? inst.getCred(1199666914671) : C.getCred(1199666914671);
|
|
|
|
|
send({type:'java_cred', cls:cn, r:String(r).slice(0,400)});
|
|
|
|
|
done=true;
|
|
|
|
|
}catch(e2){}
|
|
|
|
|
});
|
|
|
|
|
if(!done) throw new Error('no HuyaAuth');
|
|
|
|
|
}catch(e){ n+=1; if(n%6===0) send({type:'retry',n:n}); setTimeout(go,5000); }
|
|
|
|
|
}
|
|
|
|
|
setTimeout(go, 15000);
|
|
|
|
|
});
|
|
|
|
|
Interceptor.attach(base.add(0x265524), {
|
|
|
|
|
onEnter: function(a){ this.uid=a[1].toString(); this.out=a[2]; },
|
|
|
|
|
onLeave: function(){ send({type:'getcred', uid:this.uid, out:rdStr(this.out)}); }
|
|
|
|
|
});
|
|
|
|
|
"""
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def main():
|
|
|
|
|
d = frida.get_device_manager().add_remote_device('127.0.0.1:31877')
|
|
|
|
|
pid = d.spawn(['com.duowan.kiwi'])
|
|
|
|
|
s = d.attach(pid)
|
|
|
|
|
s.create_script((RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()).load()
|
|
|
|
|
s.create_script((RE / "evidence/scripts/mask_frida_maps_only.js").read_text()).load()
|
|
|
|
|
d.resume(pid)
|
|
|
|
|
time.sleep(11)
|
|
|
|
|
s.create_script((RE / "evidence/scripts/patch_guard_block_termination.js").read_text()).load()
|
|
|
|
|
print('armed. >>> 请在手机上退出登录并重新登录 <<<')
|
|
|
|
|
|
|
|
|
|
sc = s.create_script(JS)
|
|
|
|
|
events = []
|
|
|
|
|
def on_msg(m, _):
|
|
|
|
|
if m.get('type') == 'error':
|
|
|
|
|
print('JS ERR:', str(m)[:200]); return
|
|
|
|
|
if m.get('type') != 'send':
|
|
|
|
|
return
|
|
|
|
|
p = m.get('payload') or {}
|
|
|
|
|
t = p.get('type')
|
|
|
|
|
events.append(p)
|
|
|
|
|
if t == 'vt_attached':
|
|
|
|
|
print(f"[vt] {p['name']} slot{p['slot']} @+{p['fp']}")
|
|
|
|
|
elif t == 'saveLD_str':
|
|
|
|
|
print(f"[saveLD_str] str={p['str']['t']}:{p['str']['len']}\n bean={p['bean_head']}\n bt={p['bt']}")
|
|
|
|
|
elif t == 'saveLD_bean':
|
|
|
|
|
print(f"[saveLD_bean] flag={p['flag']}\n bean={p['bean_head']}\n bt={p['bt']}")
|
|
|
|
|
elif t == 'cred_unpack':
|
|
|
|
|
print(f"[cred_unpack] in={p['in']['t']}:{p['in']['len']}:{p['in']['v'][:160]} <- {p['ra']}")
|
|
|
|
|
elif t == 'bigaes':
|
|
|
|
|
print(f"[bigaes] len={p['x2']['len']} head={p['x2']['v'][:120]}")
|
|
|
|
|
elif t == 'vtable':
|
|
|
|
|
print(f"[VT!] {p['name']}#{p['slot']} a1={p['a1']} bt={p['bt']}")
|
|
|
|
|
sc.on('message', on_msg)
|
|
|
|
|
sc.load()
|
|
|
|
|
deadline = time.time() + 300
|
|
|
|
|
while time.time() < deadline:
|
|
|
|
|
time.sleep(3)
|
|
|
|
|
if any(e.get('type') in ('java_cred','getcred') for e in events):
|
|
|
|
|
time.sleep(10)
|
|
|
|
|
break
|
|
|
|
|
Path('/Users/yml/codes/douyu_login_py/evidence/getcred.json').write_text(json.dumps(events))
|
|
|
|
|
from collections import Counter
|
|
|
|
|
print('saved:', Counter(e.get('type') for e in events))
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
if __name__ == '__main__':
|
|
|
|
|
for attempt in range(4):
|
|
|
|
|
try:
|
|
|
|
|
main()
|
|
|
|
|
break
|
|
|
|
|
except frida.InvalidOperationError as e:
|
|
|
|
|
print('detached:', e)
|
|
|
|
|
subprocess.run(['adb', 'shell', 'am', 'force-stop', 'com.duowan.kiwi'])
|
|
|
|
|
time.sleep(3)
|
yml2213