docs: R34 清理 (卡死前状态保存)

2026-08-29 09:12:15 +08:00
parent 2fe23e4274
commit 12fad07385
1 changed files with 77 additions and 0 deletions
@@ -0,0 +1,77 @@
+(function waitLibs(){
+  var mfa = Process.findModuleByName('libturingmfa.so');
+  var ga = Process.findModuleByName('libturingga.so');
+  if (!mfa && !ga) { setTimeout(waitLibs, 150); return; }
+  emit({event:'libs-ready', mfa:!!mfa, ga:!!ga});
+})();
+// 多切片×多密钥暴力: Java 真 Cprivate.a
+function emit(o){ try{ send(o); }catch(e){} }
+let klist = [];
+for (const mod of Process.enumerateModules()) {
+  let addr = null;
+  try { addr = mod.getExportByName('SSL_write'); } catch(e){}
+  if (!addr) continue;
+  Interceptor.attach(addr, {
+    onEnter(args){
+      try {
+        var num = args[2].toInt32();
+        if (num < 60 || num > 60000) return;
+        var u = new Uint8Array(args[1].readByteArray(num));
+        var s = '';
+        for (var i=0;i<u.length;i++) s += (u[i]>=32 && u[i]<127) ? String.fromCharCode(u[i]) : '.';
+        if (s.indexOf('dfpReport') < 0 && s.indexOf('hyudbwebuif') < 0) return;
+        var hex = Array.prototype.map.call(u, function(x){return ('0'+x.toString(16)).slice(-2)}).join('');
+        emit({event:'post', num:num, hex:hex});
+        setTimeout(function(){
+          try {
+            Java.perform(function(){
+              var keys = [];
+              Java.enumerateClassLoaders({
+                onMatch: function(loader){
+                  try {
+                    Java.classFactory.loader = loader;
+                    Java.choose('com.tencent.turingfd.sdk.ams.ga.Perseus', {
+                      onMatch: function(inst){
+                        try {
+                          var g = inst.b.value;
+                          if (g && keys.indexOf(g.c.value) < 0) keys.push(g.c.value);
+                        } catch(e){}
+                      },
+                      onComplete: function(){
+                        try {
+                          var C = Java.use('com.tencent.turingfd.sdk.ams.ga.private');
+                          var Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon');
+                          var idx = hex.indexOf('571882cf664bb39401ee');
+                          if (idx < 0) return;
+                          var all = hex.substring(idx+20);
+                          var tot = keys.length;
+                          for (var ki=0; ki<tot; ki++) {
+                            var key = keys[ki];
+                            var karr = Java.use('java.lang.String').$new(key).getBytes('UTF-8');
+                            for (var off=0; off<=48; off+=2) {
+                              var cph = all.substring(off);
+                              if (cph.length < 16 || cph.length % 8 !== 0) continue;
+                              var bytes = [];
+                              for (var i=0;i<cph.length;i+=2) bytes.push(parseInt(cph.substr(i,2),16));
+                              var arr = Java.array('byte', bytes);
+                              var plain = C.a(arr, karr);
+                              if (plain !== null) {
+                                emit({event:'DEC-OK', key:key, off:off, len:plain.length, hex:Melon.a(plain).substring(0,400)});
+                              }
+                            }
+                          }
+                          emit({event:'brute-done', keys:keys.length});
+                        } catch(e){ emit({event:'brute-e', e:String(e).substring(0,120)}); }
+                      }
+                    });
+                  } catch(e){}
+                },
+                onComplete: function(){}
+              });
+            });
+          } catch(e){}
+        }, 50);
+      } catch(e){}
+    }
+  });
+}