From 39c516b71b9ce57f2bb03beb576443305f72bdb8 Mon Sep 17 00:00:00 2001 From: yml2213 Date: Sat, 29 Aug 2026 06:50:34 +0800 Subject: [PATCH] =?UTF-8?q?feat(huya):=20turing=E8=BF=90=E8=A1=8C=E4=B8=AD?= =?UTF-8?q?dump=E5=B7=A5=E7=A8=8B=E5=8C=96=20(R20)=20=E2=80=94=20=E4=B8=B2?= =?UTF-8?q?=E8=BF=87=E6=BB=A4100%=E5=91=BD=E4=B8=AD+=E9=87=87=E6=A0=B7?= =?UTF-8?q?=E9=9B=867=E4=BB=BD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - hook_str_magic.js: dfpReport/hyudbwebuif字符串过滤替代魔数(不漏轮次) + 全量请求dump - 采样集: golden+f1..f4+新身份B(0647) — 新身份头12B=旧身份一致(nonce与身份无关) - nonce块: [7cda][版本][69c9f5][计数递增][稳定段] ; 运行时路线终态(Java桥/co-located/回溯全闭) - 触发-捕获-存档 ~40s/轮 全自动; evidence/dfp_live/ 齐全 --- docs/HUYA_HDID_ALGORITHM_GEN.md | 28 ++++ evidence/dfp_live/dfpReport_post_0647.bin | Bin 0 -> 4258 bytes evidence/dfp_live/dfpReport_post_0649.bin | Bin 0 -> 4175 bytes tools/frida/capture_20260829_063141.jsonl | 167 ++++++++++++++++++++++ tools/frida/capture_20260829_063255.jsonl | 1 + tools/frida/capture_20260829_063458.jsonl | 2 + tools/frida/capture_20260829_063725.jsonl | 0 tools/frida/capture_20260829_063845.jsonl | 0 tools/frida/capture_20260829_064300.jsonl | 0 tools/frida/capture_20260829_064653.jsonl | 34 +++++ tools/frida/capture_20260829_064833.jsonl | 24 ++++ tools/frida/capture_20260829_064937.jsonl | 33 +++++ tools/frida/hook_dual.js | 77 ++++++++++ tools/frida/hook_dump_magic.js | 67 +++++++++ tools/frida/hook_str_magic.js | 70 +++++++++ tools/frida/hook_turing_enc.js | 53 +++++++ tools/frida/probe_turing_classes.js | 32 +++++ 17 files changed, 588 insertions(+) create mode 100644 evidence/dfp_live/dfpReport_post_0647.bin create mode 100644 evidence/dfp_live/dfpReport_post_0649.bin create mode 100644 tools/frida/capture_20260829_063141.jsonl create mode 100644 tools/frida/capture_20260829_063255.jsonl create mode 100644 tools/frida/capture_20260829_063458.jsonl create mode 100644 tools/frida/capture_20260829_063725.jsonl create mode 100644 tools/frida/capture_20260829_063845.jsonl create mode 100644 tools/frida/capture_20260829_064300.jsonl create mode 100644 tools/frida/capture_20260829_064653.jsonl create mode 100644 tools/frida/capture_20260829_064833.jsonl create mode 100644 tools/frida/capture_20260829_064937.jsonl create mode 100644 tools/frida/hook_dual.js create mode 100644 tools/frida/hook_dump_magic.js create mode 100644 tools/frida/hook_str_magic.js create mode 100644 tools/frida/hook_turing_enc.js create mode 100644 tools/frida/probe_turing_classes.js diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md index c06c11c..5db60b5 100644 --- a/docs/HUYA_HDID_ALGORITHM_GEN.md +++ b/docs/HUYA_HDID_ALGORITHM_GEN.md @@ -1166,3 +1166,31 @@ dfpReport: tReq = [10B 魔数 57 18 82 cf 66 4b b3 94 01 ee][3988B 加密采 - 组件: libturingga.so / libturingmfa.so / 32hex mpdc / 81B config / ga2 / turing.dat - 工具: hook_ssl_magic.js (全双工) / hook_turing_jni.js / run_capture.py 自愈 - 触发方法: 清 turing 状态重注册 (备份 tar 可回滚) + +--- + +## §11.50 R20: turing 运行中 dump 工程化 (2026-08-29) + +### 捕获工具定案 (hook_str_magic.js — 每轮可靠命中!) +- **字符串过滤 > 魔数过滤**: SSL_write 明文含 "dfpReport/hyudbwebuif" 串才 dump (魔数过滤会漏轮次, 串过滤 100%) +- 每轮: POST wsapi.huya.com + hyudbwebuif/dfpReport WUP (libjavacrypto okhttp) — 全量请求快照 +- 触发: 清 app_turingdfp/fd 重注册 (重注册稳定); pm-clear 全清+登录 = 新身份再注册 (也稳定) + +### 采样集 (7+, 同设备多身份) +| 样本 | 密文长 | 头 12B | 身份 | +|---|---|---|---| +| golden 3908 | 3898 | 7cda0169c9f5 489d4c4695ef | 08-24 | +| f1 3531 | 3521 | 7cda11 69c9f5 289c4d46956f | 08-29 A | +| f2 3931 | 3921 | 7cda11 69c9f5 289c4d46a1de | A | +| f4 4310 | 4033 | 7cda11 75c8f5 349c4d0390de | A | +| 0647 4258 | 3991 | 7cda11 69c9f5 289c4d46a1de | **新身份 B** | +- 新身份 B 密文头 = 旧身份 A 的 f2 完全一致 12B → **nonce/加密流与身份无关(设备公共)**; 计数位 28/34 递增 +- nonce 块结构: [7cda][版本位 01/11/13][69c9f5][计数位][9c4d46...稳定] + +### 运行时路线终态 (明文未获) +- Java 桥 0 调用 (加密全 native 内部) / co-located 扫描 0 (工作缓冲已回收) / SSL 回溯全 Java 帧 (加密提前完成) +- 明文/密钥获取 = turing native 静态破 (OLLVM) 或 harness 装载同库直调内部偏移 + +### 工程交付 +- 触发→捕获→存档 全自动化 (清状态+spawn+str_magic+杀) — 每次 ~40s +- evidence/dfp_live/: 请求全文 ×5 + 采样集 + 组件 + fresh 状态文件 diff --git a/evidence/dfp_live/dfpReport_post_0647.bin b/evidence/dfp_live/dfpReport_post_0647.bin new file mode 100644 index 0000000000000000000000000000000000000000..fbbfbc4b2341f51ff54c787e02ee82ce43d94617 GIT binary patch literal 4258 zcmV;T5MA$3Pg7JNFCa)%R8TK5E-?)XX)ShTaylR}4GKeVZggdCbS+eQaAi6mVQ_G4 zX=7n@X>V>XZ)0?2bS-mqa%Ev{4GKeVZggdCbS+F}ZfA68Iv_MKH!%$gNN;m=Iv{s* zVQ^_KXmxpEE@N+P4GKeVZf<2`bZKvHIv`7BWpFJ)Y-x674GKYHV`Xr3Ek$l)Z)9n1 zXF4EfdTDSC3RQDuaxFn;Wo~pjAa84EbaZepGcGYSE;$Vf4GI7N59bgAEIdqB3}|(E zVRd9;cV%LAX=VvzW^htvaBp&SeEc0)qTG>(}T5 z*-b&mv?{r)cWx?j zIjG3t#>EIh#p3`0n?oTvLhZLErhmk#u~jg%X0mU~h)$5qG#V4l;A*k?&U?tj?!F&x zTBk#7g&jvi%Spfdtx7-f;x%;N`qSYJKS^L8g9Upzwpobgwh`l&vIarW3zojALlhiI zBHjBjE_C|6Su98A^J9_`?C#&m#Zr+Io-CDZu-12}Zm%4Nw*2D3Uc4?8d`=O8jMOMT zN4XOFwhm-n*Ty5BSMdr4Oas1{QJ$UKW{}FPQ<8CDYozGw!Z3cLfvLvb^vBVO#DfZ{ zWVt1w(SPf;=})hFeVP$_mk~&3YtaL}?A+y^4;@#>o<44%=BZ!?bdFYfgn!#xNS%RpRIicA$|%qNAT(;wLVtqNTtNoHm+-6~sPW`Up2CXFkm)bYLoqQRwx&P< za;I%vV!Y*}%G#!a-}eRWY2o*!NJO=wS_$O}QwUTKp49W>H#24{rEa{vtZqF9TqITq z0p{2&L6!xL?u~Xs1n}8^_EN=_*el#<`hr^Q-4g^7oxXW**57!%=wXgeT59r^KNvoI z7^|SD)5`V6=tnJxJNJ42q%rRyM}9#YmitXuuhyLe%vMJ1y+KgldS0kgkmjpo8JQ}_ z!qxDGl_FG35T}PpEfFDOS|=aj*L43?5YhYM9I5ky_jT7n}=&JP6%0|`>Y;~-iJ))wk9dxL3r z=!BJnEjZ&c!;NA0c1Z@_RLxy3wbD#AE6h7@EeP&N05(2rG(H}yz4QlS&RBPpesc|i zM6IW~-&l@ZvM0Tov)%78p?;lb1%|v7*VP)!H0`@3K0$MMhDqt(X6B_oF1uy=S|0A- zz>!QIJ0Z*9>q;cmw-pLb&rOmPR9jF?&J(m)m`}@Tfu^wny2+Rz7j4bwoF&Dp9_W<_ z)#?t@x>d+g7Y-USr!%@9O+@0dhL#J(2UTmlgSU2{;M6$spU#lYWD959rca^6@yUMb zZUy)%t;S|d2R!Af35@2$Hj|86)b)4-=&Thj{OC%Nv@=FIn7kj z3X-EqIQuV-a#3TOYReaKU0$^%CihnvM&Bfj=E?k`$1~DRmIN${OXM{xJq^8fGJ9vc(5MZYPKN^S7C0@p}a&9ySgseYB-QW?u;q(v&O+>-^`RM~waz zaU^;g4-;?z5rXl5=*W+}xoav3;&0AY$jRxrK0$N=H2XUs+VZI@KK213e)taXj};Sm zeFwZ8p;9qyXC*rh_Ui$!8mc<6C05o7EnM|qH(>wwkF{%^n{*!7(}wr0*&9QwWydI%fU!9>|U48lMI=nwN&4sry~555el;L8CgzB<2TR*v;E$MVvIX9!?@sL_ zUW)P~XVZ#FGwmJLYdY%Qk6bB`E4|qUCjFvRq6umKn7DI82B4OX`!cAm)!|!;v7XSB zN%bUKgmtNzx4gq_@&QAMN#+MqcEN$czj7}XV?^*@{siE=QgQ|dm>|gB!{lk*4sZk1 zJyLzCRUQrsMA~j@7$%Tjq8?46>|T8+$%sYM{j-b<2n_=}hOv$dpda3R&O4DI$Dcjl;{oa~oBT*BRKQpvnR+u$ry1~dVqlY;VvwYMC{%VpZ|>h?)upll%b~r zcpTtBGyEt$&VOV_R^dTMr9Oz(lAT2GZ6Zt&ck4LVadq+*mX?Tc44QLz?VazPdFWv3 zP=WC9TH7@`9X4%V0p@|?rjpHX0RlejSb$<1ix#hqiOXG6(Y|-ddcxV{u75`I*I7#w zi5H2{{)v&2@0k3Fii%JNk3>u9ns1xZk$;(wuMnFM&tEK zO;fCg?C&S=39k7^vUH8x76a9-)%44|GO=@YQ=fnLtEj_hr|1|Xssx77$9sP#J?pkY z+x>Xq<4}I85k>pJiHKDD`xwQLp)}ARmoqfYGlWOGHX43Z_T&Nrfk8>YX>8A)X7!Pj0kxNU!+5Ua`yf5j)zMx%Kl;Jrp&+9jRmLMCw zFIna|w+HB`qniJVy>I)##@OQqVYe851V>k;w=NrAe{Dg#A)P=C$U5M@k&sw|s$_sT zw3kTow(`S)#x!U%faH-;(~x?ou5UvgMEwP+qWTCo)bWEPa(#@sVy|oi0QRn#=~dC4 zPSdqL6pSrc3-~jo_76J#cXJW5hAO*tsrOmo69zE9E>k>jynO~Ym(c_sC5Y-8fyI4z zK72*hmta0u+fk5sL4zsYL(r%z+Pw+)LLW9ogK2Cv!HQ?~SRb47=&l*+#EDZ6F>LT5 ze_udXt|kuR5!UHu8oQNd9Qov$x&i|1GjGN4zaI;cj<(y-jQs=K#vyG-l~F?fh|JQ5 zkJZI;_iKyB`%k|;yg`TO%zy%aiNnG8UxRGp|NZ=6^s47wmcnn}&DE*76SyqO8sBpe z(GrLWGMB!h3*1_e23ji3oYx+>Yg||$JLqe$k=8_fmzp3j)*k-7aO;lX5jsF3OfmDN zwSU`O0luh&0&2|AmKJVX6th$tc4Jb%7Yyq)Owj8suDJy_?h`dmm0jWH^!>u2e}W~0 zUZMTi5CaWNP@E7?msPK{-XxV+B0L0%=}@ZViPapy$k}Xm?6MrF#|N6gM2hypzX8oQ zM{#=mRDz+@Z4T70tf&k7J$*G9%&*Xs&Xb`F^QUhe$%NbN1t=DAOc_f(ST?EIwn9~z|)+a;#zUqDAHvQdj4`x)0C}&7*P^c`kQ;+!dkE~9CuRNXbY)-0HXEV*HXxCXkC~dU}(9Di0?KR0oD_# zCO`6gY|cJ69Zr=l5ZB=VwWU!V*gKvPRAO)n&mh{zJLmI)$(2v`KVn#c*c4Om9{}BF9{tLX2YcOijhIh zVmu9@Q%m;J>K@e;+&=(VCF8dVp&inwbhC?jVRMEKuJ=l8c0sTp+)uVOWb#>?!6`53 zwiQx9LhG>F5z|UN-a#b)3SiD5FPFWC;U+9I-ab8aMRc)sX7TOhUOAmt&H+jKpn1gu zgvy7_oU*&I12{3qKG-;r!hie}T5Ci*H{UfeEB!PF=!POfnlYg-Kk zy!{d8EB;?jME;RH=n~sx!}Z6>5g&!?{KxwLjMTLxM!pDC;?|hc*1F5z2i`G}*R56Q z2*1~C(lsx?g+ivbJb(hc4UgQ&OF8QAwWXBvIJnF$yRnFJ8da!*$RgdVYb~BUPs|CY z`N2_Y~xoI5IUJ|2lWw zH4VXC-qYGHSua6BOG6RIHA3#_W{S$ue9O+w8UOHle6-x{_};l!#5WBqYlQ7+!D^}z zEHLBwsWnUQQ~OAYRqFof;539d#O7?999Di`^Z}%_bE#+|0bQ$-8!J_+^&{(mJl4m7 z*()ZM70M`jb@2V6&VFi1(EUN3wM;(mj-}uv+h;N3YEzT?V>XZ)0?2bS-mqa%Ev{4GKeVZggdCbS+F}ZfA68Iv_JSI5-UoNN;m=Iv{s* zVQ^_KXmxpEE@N+P4GKeVZf<2`bZKvHIv`7BWpFJ)Y-x674GKYHV`Xr3Ek$l)Z)9n1 zXF4EfdTDSC3RQDuaxFn;Wo~pjAa84EbaZepGcGYSE;$Vf4GI7N50nrCEIdqB3}|(E zVRd9;cV%LAX=VvzW^htvaBp&SeEi;bRzH~Lr9F=)m{J4C(?i^k1UZLr21dM^ro4gbbQT!UP4v-(+C?dN9tDv|YWyFF zSHe9U7leS+3oVW* zCU`~xo@~lDaO{SN5l!jDKRz8!Z(yCIE}J^BJM*W4h9S2#zkHh|ma8aWWD%#>EM!-y zwc;j-?dS*Ld;lSkcc}{S&j}K(&U~)>#kNNTLs-uddn_DT*#zLd2Qfq|NfFA;i+W*P z%@Kc~)rEUt0Dy32=$h-?fDIvzdHCz52Qx5x@WT|{W#5!Zy+-lD^Tg2prg1XQrGxDQ z)J*pK8+B_2HqiP+u@@O1TBdiT8rf&vZ|-iB>pk7h+VSY?QWB&7hJ`_Xa>E z*SX$SvaadP@=N@9_DJhoPdzLxu&edyWm9%t70lE;y(58O#2HX%3*-Uo_B&xV=U(LtlI5re17nE0)UuvQIkRoao!K?Q1k>{Ji( z{T|(bFN3WdxI1koD7`6Qd3OTyA7TVJkcK;Ve@M?)lj_f??VMfqd= zQWE_p^8y)%2NJhaiB4dMhw!|r`%kG`RwaNd=0UHviR59pkc#LRuc+lEWiD z_8^tyxj*eI-U!Ivx0MS{&rK2()Z2%~ko}rs4?N#NJRIG1<|!4BQJlsobQw|qaYd_G zQkQuPw+s~8dhV|XS`#ya>a>*bkuW+PIwd@<%~>`z>cOM+`6zDHiZ9uv_z4*FDE7Av zQ7w%d3)11|cs7LL+RKjmc zIwsZVc&6&gb$6Qpw=(Dbk1r;XZBwljTiOb3xaGC`GJ#>47U=7IKv7pa&9k1d9lDEilJTT|Hq zFa^}8#u)O>3D^-+U`Q;E_gSSm0seZ|*6`)p@W4LwLULAq7cFvV(Q+heUyE!eGG0p z>c)O!cUvR{_l%cTugq{nIDl5$-?KqimBPs*k1>eyIKsdfSdB7>YzWHg-!5bD?&mld zYo@z5&YVBZb;SsRj4EoJ<(Uy#^4fHp*a6v;tBJjHp7ssE)xG+{0UmVd>XzJ+IYgRt zRLr*T4K8A;UWg@*s05nVFsU#VXSKf+GBbk-W6dfRrnm#cyIwc=2>HK`iJc_A_B^#a z3c1ku#qp>uR#L}i;53J-`T=2^+xC6T5BKHooP*k21zRP-9d1aP$Y`hsFV@_!)g*|< z1|ael%g#o*Y7%Pc#c7?o;fQHl0Ci3exv<0ZyGet?smWh}QMye_-gXyl$;{Z*v>uW5 z`2oR}Zw)<@5W)dDRgd1*F7qte(|Tp~iIzih&nv0k2{1OyfhnvtBJ4 zInQ`23)PMENd8O4*x?}Au#9wptys^rzK!P24?LB*yjV5>`KZ|2to^nU#!LT$j#@HM z57f;7y3Cbp|HGgDW4>?j3+q#ctu|==eI*`WMVPDlKw>QSxuMd|^QKqyzp%Lum&!exdtGY+{%cS*d}i_QNkecLTnb~z6g8UYc5Q5f}T~KaWpYFYBXSs zcTD*wNtN?ag%xP4d*0TAO90{6;71!ni{Gw0?HtE4b41_sX+w0rxpz>pUU0bjKESXf z?|Y77U}t*KCy4ZNrS_LOl`3gT2A9!Z79BVK^qCyL`8ZZd%cmuA_*u0ceQnDGTUFU6 zALhcgUcNs?OVX%yWF-}fXR?C<{LXGaRcT~Wa~BFBv+xe;Qh8jEaFWX7)^C=gnv5>n@ zk~yA)K=L`}mG!VLzS_p1hf|nW$zO6~DHFpsbb8e^clfuJScZc9cD>b0I!f&0p53Eb z>!89I1$45swW*qKTA|ab=oqYn*D`78wN^dznNk-)EwI2n;~lqzbyG!r>r8T_|9pl4 zCXL6BH0%NK53;?_0bIFu&BA1Xu9+wc2r#duf?miwq39JHZG|(uycPk=mL4z2NN&Z6H@%Y2 zWP9y}yu>=*Ko0`6RF$xj`qR%bg%MRWmpz+dX3Rxb4?31HGm&O!@BWwoM;MuIZ17<; zRi@SwCM?{i0{A2o%+A*a9S7E%7pg zhocDD@$G+FYV{%aEj$3Iom?S1>XI?d`2ZIxOM(Z(a5~bQGJFpgoMx8$-wTTce+kes zbdPHnO(jiq63;RhC`tnf4;T_yIn3PD`cw>l^;Gz!>xyC98d-8>pGBgimw@uo3v#tL zVr3%*(+Ej1b;IxWn2qlqVw*=QEN!x@Zuxc${F0-2PlXxGS-pF61F>vrqX6zO-EA-Am(I)V z1+4c2yU+T3tJ$oF{Z7E0=q2XwZ$9t3bu%uxfO#zlm`ApIzN=5ObN7GJPUJA&j|Uir z<8BqG>tGNMK%s@dEN@bTu#$Qp;D?0$mEk&oMz1o2Hf7K|J(N7gbt-iiD3!mJV(1Z* z8;SH-oWPx;JYb0D0Ikgn6uwYgmE1($mZ;=ukB@_ozzlAfCgC0ld0m`8gM}50NdF-& zf4tQYT-C0Z*-N`EF=8PW8Xlm>qeUyaXrMA**y$~O>y=oQ^MEFWr{He?i#1Lug?&A- zKO$M;EPFHdl{lD+WalEdYu)|WSWDFjV%VB$B6fSDSdXu{ZGR9==d%@70_3lJoh}Hy zS^Bppr`I^wUw~J}20nGg5+7J(E;>~mnPc+b^I{+?$K$>k2M-*fOWUK3Zo%D!<1O6P z>!gf_b5q~S_HWSV2JMZyJ9l;0I8aIR3)ZULY?W#8401XVldB5$1u$GqeDzBw-Chk6 ze!3iX=W!r94{v;>Ld`x|P}52^;}M(x#1;G_QL(>qi+UQydq2lFf;hZs>cKF6EG8LN z?g>hE`*xcD1bDj+iB_Jhj%_#p@3PoXlg1m3E(FyNT%5}JA@|Cpi%pt(;0P9N04`}W zmGk4Gfn!+1xHrO7og9lKADX)ULt12QdD{e`)ElFcuYNpsQ~~mtQmo_%dUyz}F7Uq} zalNuQqQqpg%NE_q=lEy3hNqprDYP$@t+0YaoGAolv2TVJ0zd7CC-1gFUmAC5Vs<`~ zCUrt~-kXzCFJvkSarKQT(Is;1b4?Cnez5Sc15@y^Fc0<$4sD;n4BR?jo#DI@72Dw1 z9@PcpR#W6NVuIP;2Rclb*~pmZVle0zX!{(o1-a2zHTBF1uH3q(t30)ZsBnS^oA`NM zP7|0ah?JfdvI6*)y>!RM_OUIYp0?QjJvP#ssj+|)oligLsI#x|YUhBD;l>qwAqz3m z1f`+n!K^h1FmwN$(K1O)iqNM}wpulsgBAD=EpmVbp_G!J2Mlb=)Fz=sewa_j`7I8A z6vjR`#(z)b7vxYoSF*DOSp)zxL?^PM(5iv8i-U2G_2ZhD5k{ zO!#^W?odVho`16UunQIo<_rJ; literal 0 HcmV?d00001 diff --git a/tools/frida/capture_20260829_063141.jsonl b/tools/frida/capture_20260829_063141.jsonl new file mode 100644 index 0000000..b527eab --- /dev/null +++ b/tools/frida/capture_20260829_063141.jsonl @@ -0,0 +1,167 @@ +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Lemon", "methods": ["- void a(long,java.lang.String)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Sultana$do", "methods": ["- int a(com.tencent.turingfd.sdk.ams.ga.Sultana$do)", "- int b(com.tencent.turingfd.sdk.ams.ga.Sultana$do)", "- int c(com.tencent.turingfd.sdk.ams.ga.Sultana$do)", "- com.tencent.turingfd.sdk.ams.ga.Sultana$if d(com.tencent.turingfd.sdk.ams.ga.Sultana$do)", "- com.tencent.turingfd.sdk.ams.ga.Norma e(com.tencent.turingfd.sdk.ams.ga.Sultana$do)", "- [B f(com.tencent.turingfd.sdk.ams.ga.Sultana$do)", "- com.tencent.turingfd.sdk.ams.ga.Norma g(com.tencent.turingfd.sdk.ams.ga.Sultana$do)", "- com.tencent.turingfd.sdk.ams.ga.Eridanus h(com.tencent.turingfd.sdk.ams.ga.Sultana$do)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Blueberry$do", "methods": ["- java.lang.String toString()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Solar$if", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Segment", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Sorosis a(int,[B,int,int,com.tencent.turingfd.sdk.ams.ga.Eridanus)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Pineapple", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Pineapple a(int)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Cumquat$do", "methods": ["- java.util.concurrent.FutureTask a()", "- java.lang.Object call()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Perseus", "methods": ["- void a()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.default", "methods": ["- boolean a(java.util.Collection)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.White", "methods": ["- boolean a(android.content.Context)", "- boolean a(java.lang.String,java.lang.String)", "- int b(android.content.Context)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Nectarine$if$do", "methods": ["- boolean a(com.tencent.turingfd.sdk.ams.ga.Syrup)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Rambutan", "methods": ["- com.tencent.turingfd.sdk.ams.ga.synchronized a()", "- java.lang.String a(android.content.Context)", "- java.lang.String a(java.lang.String)", "- void a(com.tencent.turingfd.sdk.ams.ga.synchronized,boolean)", "- boolean a(java.lang.String,boolean)", "- com.tencent.turingfd.sdk.ams.ga.synchronized b(java.lang.String,boolean)", "- java.lang.String b(java.lang.String)", "- java.util.Set b()", "- boolean c()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Sultana$if", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Guava", "methods": ["- java.lang.String toString()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Pitaya", "methods": ["- void run()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Bryony", "methods": ["- java.lang.Object a(java.lang.Class,java.lang.String,java.lang.Object)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Core", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Solar", "methods": ["- java.lang.String a()", "- void onLocationChanged(android.location.Location)", "- void onProviderDisabled(java.lang.String)", "- void onProviderEnabled(java.lang.String)", "- void onStatusChanged(java.lang.String,int,android.os.Bundle)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.native", "methods": ["- java.lang.String a(java.lang.String,java.lang.String,java.lang.String)", "- java.lang.String a()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Shaddock", "methods": ["- boolean a()", "- java.lang.String toString()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.synchronized", "methods": ["- void a(com.tencent.turingfd.sdk.ams.ga.Lynx)", "- void a(com.tencent.turingfd.sdk.ams.ga.Lyra)", "- java.lang.Object clone()", "- boolean equals(java.lang.Object)", "- int hashCode()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Pistachio", "methods": ["- void run()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Sorosis", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Pineapple$do", "methods": ["- java.lang.String a(com.tencent.turingfd.sdk.ams.ga.Pineapple$do)", "- long b(com.tencent.turingfd.sdk.ams.ga.Pineapple$do)", "- int c(com.tencent.turingfd.sdk.ams.ga.Pineapple$do)", "- java.lang.String d(com.tencent.turingfd.sdk.ams.ga.Pineapple$do)", "- java.lang.String e(com.tencent.turingfd.sdk.ams.ga.Pineapple$do)", "- java.lang.String f(com.tencent.turingfd.sdk.ams.ga.Pineapple$do)", "- java.lang.String g(com.tencent.turingfd.sdk.ams.ga.Pineapple$do)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Quarenden$do", "methods": ["- void run()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Flat", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Norma a()", "- void a(com.tencent.turingfd.sdk.ams.ga.Lynx)", "- void a(com.tencent.turingfd.sdk.ams.ga.Lyra)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Auriga", "methods": ["- java.lang.String a(android.content.Context,java.lang.String)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.private", "methods": ["- void a([B,[I)", "- void a([I,int,[B)", "- [B a()", "- [B a([B)", "- [B a([B,[B)", "- [B b([B,[B)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.this$do", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Watermelon", "methods": ["- void run()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Pyxis", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Pyxis a(java.lang.String)", "- com.tencent.turingfd.sdk.ams.ga.Pyxis a([Ljava.util.Locale;)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Dew", "methods": ["- void a(com.tencent.turingfd.sdk.ams.ga.Lynx)", "- void a(com.tencent.turingfd.sdk.ams.ga.Lyra)", "- java.lang.Object clone()", "- boolean equals(java.lang.Object)", "- int hashCode()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Pomegranate", "methods": ["- void run()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Sultana", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Syrup$do", "methods": ["- int a(com.tencent.turingfd.sdk.ams.ga.Syrup$do)", "- int b(com.tencent.turingfd.sdk.ams.ga.Syrup$do)", "- int c(com.tencent.turingfd.sdk.ams.ga.Syrup$do)", "- [B d(com.tencent.turingfd.sdk.ams.ga.Syrup$do)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Banana", "methods": ["- int a(android.content.Context,java.util.concurrent.atomic.AtomicReference,java.util.concurrent.atomic.AtomicReference)", "- int a(android.content.Context,java.util.concurrent.atomic.AtomicReference,java.util.concurrent.atomic.AtomicReference,java.util.concurrent.atomic.AtomicReference)", "- com.tencent.turingfd.sdk.ams.ga.Almond a(android.content.Context)", "- java.lang.String a(android.os.IBinder)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.protected", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Tangor", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Gooseberry", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Norma a()", "- void a(com.tencent.turingfd.sdk.ams.ga.Lynx)", "- void a(com.tencent.turingfd.sdk.ams.ga.Lyra)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.case", "methods": ["- java.util.List a(android.content.Context)", "- void a(java.lang.StringBuilder,android.accessibilityservice.AccessibilityServiceInfo)", "- boolean a(android.accessibilityservice.AccessibilityServiceInfo)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Date", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Equuleus", "methods": ["- boolean userAgreement()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Nucleus", "methods": ["- void a(com.tencent.turingfd.sdk.ams.ga.Syrup)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Blackberry", "methods": ["- java.lang.String a(android.content.Context,java.lang.String)", "- java.util.List a(java.io.File)", "- [Ljava.security.cert.Certificate; a(java.util.jar.JarFile,java.util.jar.JarEntry,[B)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Shaddock$do", "methods": ["- java.lang.Object a()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Pomelo$do", "methods": ["- void handleMessage(android.os.Message)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.TNative$aa", "methods": ["- android.util.SparseArray a209202_2A742FA224BA8A2A(android.util.SparseArray,android.content.Context,java.util.Map,java.util.Map,int)", "- android.util.SparseArray b209202_2A742FA224BA8A2A(android.util.SparseArray,[B,java.util.Map,int)", "- android.util.SparseArray c209202_2A742FA224BA8A2A(android.util.SparseArray,android.content.Context)", "- android.util.SparseArray d209202_2A742FA224BA8A2A(android.util.SparseArray,android.content.Context,int)", "- android.util.SparseArray e209202_2A742FA224BA8A2A(android.util.SparseArray,android.content.Context,java.util.Map,int)", "- android.util.SparseArray f209202_2A742FA224BA8A2A(android.util.SparseArray,[B,int)", "- android.util.SparseArray g209202_2A742FA224BA8A2A(android.util.SparseArray,android.content.Context,java.util.Map,int)", "- android.util.SparseArray h209202_2A742FA224BA8A2A(android.util.SparseArray,android.content.Context,java.util.Map,int)", "- android.util.SparseArray i209202_2A742FA224BA8A2A(android.util.SparseArray,android.content.Context,java.util.Map,java.lang.Object,java.lang.Object,java.lang.Object)", "- java.lang.String j209202_2A742FA224BA8A2A()", "- [B k209202_2A742FA224BA8A2A([B)", "- void l209202_2A742FA224BA8A2A(java.lang.reflect.InvocationHandler,java.util.concurrent.atomic.AtomicReference,java.lang.ClassLoader)", "- android.util.SparseArray m209202_2A742FA224BA8A2A(android.util.SparseArray,android.content.Context,java.util.Map)", "- android.util.SparseArray n209202_2A742FA224BA8A2A(android.util.SparseArray,[B,int,java.lang.String,long)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Herbaceous", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Blueberry", "methods": ["- int a([B,int,char)", "- java.lang.String a(int)", "- com.tencent.turingfd.sdk.ams.ga.Blueberry$do b(int)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Tangerine", "methods": ["- void a()", "- void b()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Bagasse", "methods": ["- java.lang.String toString()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Longan", "methods": ["- java.lang.Object a()", "- java.lang.Object b()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.this$if", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.abstract", "methods": ["- void a(java.lang.StringBuilder)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Cassiopeia$do", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Draco$do a([B)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Peanut", "methods": ["- java.lang.String a()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Almond", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Almond a(int)"]} +{"event": "turing-class", "name": "com.tencent.turingface.sdk.mfa.TNative$aa", "methods": ["- android.util.SparseArray a87_D2D99D56FECC73FD(android.util.SparseArray,android.content.Context,java.util.Map,java.util.Map,int)", "- android.util.SparseArray b87_D2D99D56FECC73FD(android.util.SparseArray,[B,java.util.Map,int)", "- android.util.SparseArray c87_D2D99D56FECC73FD(android.util.SparseArray,android.content.Context)", "- android.util.SparseArray d87_D2D99D56FECC73FD(android.util.SparseArray,android.content.Context,int)", "- android.util.SparseArray e87_D2D99D56FECC73FD(android.util.SparseArray,android.content.Context,java.util.Map,int)", "- android.util.SparseArray f87_D2D99D56FECC73FD(android.util.SparseArray,[B,int)", "- android.util.SparseArray g87_D2D99D56FECC73FD(android.util.SparseArray,android.content.Context,java.util.Map,int)", "- android.util.SparseArray h87_D2D99D56FECC73FD(android.util.SparseArray,android.content.Context,java.util.Map,int)", "- android.util.SparseArray i87_D2D99D56FECC73FD(android.util.SparseArray,android.content.Context,java.util.Map,java.lang.Object,java.lang.Object)", "- java.lang.String j87_D2D99D56FECC73FD()", "- [B k87_D2D99D56FECC73FD([B)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.ITuringDID", "methods": ["- java.lang.String getAIDCode()", "- java.lang.String getAIDTicket()", "- int getErrorCode()", "- long getExpiredTimestamp()", "- java.lang.String getOpenIdTicket()", "- java.lang.String getTAIDTicket()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Cassiopeia", "methods": ["- java.lang.String a(android.content.Context)", "- int b(android.content.Context)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Triangulum", "methods": ["- java.lang.String a([B)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Nectarine", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Hydra", "methods": ["- java.lang.String a(java.lang.String,java.lang.String,java.lang.String)", "- java.util.List a()", "- java.lang.String b()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Nectarine$do", "methods": ["- java.lang.Object a()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Aquila", "methods": ["- void a(int,long)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Carambola", "methods": ["- [Ljava.util.regex.Pattern; a()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.UrsaMajor", "methods": ["- int a(android.content.Context)", "- java.lang.String a()", "- int b(android.content.Context)", "- java.lang.String b()", "- java.lang.String c()", "- java.lang.String c(android.content.Context)", "- int d(android.content.Context)", "- boolean e(android.content.Context)", "- java.lang.String f(android.content.Context)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.ITuringDeviceInfoProvider", "methods": ["- java.lang.String getAndroidId()", "- java.lang.String getImei()", "- java.lang.String getImsi()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Hickory", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Norma a()", "- void a(com.tencent.turingfd.sdk.ams.ga.Lynx)", "- void a(com.tencent.turingfd.sdk.ams.ga.Lyra)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Cranberry", "methods": ["- void a(java.util.HashMap,java.lang.String,java.lang.String,long,com.tencent.turingfd.sdk.ams.ga.Andromeda,int)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.break", "methods": ["- int a(android.content.Context)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Quarenden", "methods": ["- long a()", "- android.content.SharedPreferences a(android.content.Context)", "- java.lang.String a(java.lang.String)", "- void a(android.content.Context,java.util.Map)", "- java.lang.String b(android.content.Context,java.lang.String)", "- long a(android.content.Context,java.lang.String)", "- com.tencent.turingfd.sdk.ams.ga.Phoenix a(android.content.Context,int)", "- void a(long)", "- void a(android.content.Context,long)", "- void a(android.content.Context,java.lang.String,java.lang.String)", "- void a(android.content.Context,java.lang.String,java.lang.String,boolean)", "- void a(android.content.Context,java.util.Map,boolean)", "- com.tencent.turingfd.sdk.ams.ga.Pineapple b(android.content.Context)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Draco$do", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Melon", "methods": ["- java.lang.String a(java.lang.String,java.lang.String,java.lang.String)", "- java.lang.String a([B)", "- java.lang.String a([B,java.lang.String)", "- [B a(java.lang.String)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.instanceof", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Arbutus", "methods": ["- byte a(android.content.Context)", "- java.lang.String a()", "- boolean b(android.content.Context)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Vulpecula", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Almond a(android.content.Context)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Ginkgo", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Norma a()", "- void a(com.tencent.turingfd.sdk.ams.ga.Lynx)", "- void a(com.tencent.turingfd.sdk.ams.ga.Lyra)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.TuringSDK", "methods": ["- com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder createConf(android.content.Context,com.tencent.turingfd.sdk.ams.ga.ITuringPrivacyPolicy)", "- java.lang.String getVersionInfo()", "- int init()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Marc$do$do", "methods": ["- void run()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Eridanus", "methods": ["- boolean a(com.tencent.turingfd.sdk.ams.ga.Syrup)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Nectarine$if", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Syrup a(android.content.Context)", "- com.tencent.turingfd.sdk.ams.ga.Syrup a(android.content.Context,com.tencent.turingfd.sdk.ams.ga.Sultana)", "- void handleMessage(android.os.Message)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Pear$do", "methods": ["- boolean userAgreement()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.super", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Norma a()", "- void a(com.tencent.turingfd.sdk.ams.ga.Lynx)", "- void a(com.tencent.turingfd.sdk.ams.ga.Lyra)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Fig", "methods": ["- void a(com.tencent.turingfd.sdk.ams.ga.Lynx)", "- void a(com.tencent.turingfd.sdk.ams.ga.Lyra)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Lynx", "methods": ["- byte a(byte,int,boolean)", "- double a(double,int,boolean)", "- float a(float,int,boolean)", "- int a(int,int,boolean)", "- long a(long,int,boolean)", "- com.tencent.turingfd.sdk.ams.ga.Norma a(com.tencent.turingfd.sdk.ams.ga.Norma,int,boolean)", "- java.lang.Object a(java.lang.Object,int,boolean)", "- java.util.HashMap a(java.util.Map,int,boolean)", "- short a(short,int,boolean)", "- void a()", "- void a(byte)", "- void a(int)", "- boolean a(boolean,int,boolean)", "- [B a(int,boolean)", "- java.lang.String b(int,boolean)", "- void b()", "- boolean b(int)", "- [Ljava.lang.Object; b(java.lang.Object,int,boolean)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Casaba", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Olive", "methods": ["- java.lang.Object a()", "- void a(java.lang.Object,long)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Cumquat", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Date a(android.content.Context)", "- com.tencent.turingfd.sdk.ams.ga.Date a(android.content.Context,[B,com.tencent.turingfd.sdk.ams.ga.Core)", "- java.lang.String a(android.content.Context,int,com.tencent.turingfd.sdk.ams.ga.Andromeda,boolean,boolean)", "- void a()", "- void a(android.content.Context,com.tencent.turingfd.sdk.ams.ga.Core)", "- void a(android.content.Context,com.tencent.turingfd.sdk.ams.ga.Date)", "- [B a(android.content.Context,java.util.Map,com.tencent.turingfd.sdk.ams.ga.Core,boolean)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Haw", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Norma a()", "- void a(com.tencent.turingfd.sdk.ams.ga.Lynx)", "- void a(com.tencent.turingfd.sdk.ams.ga.Lyra)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.extends", "methods": ["- [B a([B)", "- [B b([B)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Virgo", "methods": ["- void run()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Draco", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Lyra", "methods": ["- void a(byte,int)", "- void a(float,int)", "- void a(int)", "- void a(int,int)", "- void a(long,int)", "- void a(com.tencent.turingfd.sdk.ams.ga.Norma,int)", "- void a(java.lang.Object,int)", "- void a(java.lang.String,int)", "- void a(java.util.Collection,int)", "- void a(java.util.Map,int)", "- void a(short,int)", "- void a([B,int)", "- [B a()", "- void b(byte,int)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.else", "methods": ["- android.content.Context a()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Filbert", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Norma a()", "- void a(com.tencent.turingfd.sdk.ams.ga.Lynx)", "- void a(com.tencent.turingfd.sdk.ams.ga.Lyra)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Mandarin", "methods": ["- int describeContents()", "- void writeToParcel(android.os.Parcel,int)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.ComaBerenices", "methods": ["- long a(java.io.InputStream,java.io.OutputStream)", "- void a(java.io.Closeable)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.GalacticCore", "methods": ["- java.lang.String a()", "- java.lang.String a(android.content.Context)", "- java.lang.String a(java.lang.String,java.lang.String,java.util.regex.Pattern,java.lang.String)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Ara$do", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Bergamot", "methods": ["- java.lang.String a(android.content.Context)", "- java.lang.String a(android.content.Context,java.lang.String)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.volatile", "methods": ["- java.lang.String a(android.content.Context)", "- java.lang.String a(android.content.Context,java.lang.String)", "- boolean a()", "- java.lang.String b(android.content.Context)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Lichee", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Cherry", "methods": ["- java.lang.StringBuilder a(java.lang.String)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Codlin", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.volatile$do", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Marc$do", "methods": ["- void onServiceConnected(android.content.ComponentName,android.os.IBinder)", "- void onServiceDisconnected(android.content.ComponentName)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Pomelo", "methods": ["- java.lang.String a(long,long)", "- void a(com.tencent.turingfd.sdk.ams.ga.Pomelo)", "- int a(com.tencent.turingfd.sdk.ams.ga.Pineapple)", "- com.tencent.turingfd.sdk.ams.ga.Pineapple a(android.content.Context)", "- com.tencent.turingfd.sdk.ams.ga.Pineapple a(android.content.Context,boolean,int)", "- com.tencent.turingfd.sdk.ams.ga.Pineapple a(android.content.Context,boolean,boolean,int)", "- void a()", "- void a(com.tencent.turingfd.sdk.ams.ga.Pineapple,boolean)", "- com.tencent.turingfd.sdk.ams.ga.Pineapple b(android.content.Context,boolean,int)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Lacerta", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.ITuringPrivacyPolicy", "methods": ["- boolean userAgreement()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Raspberry", "methods": ["- long a(android.content.Context)", "- com.tencent.turingfd.sdk.ams.ga.synchronized a([B)", "- java.lang.String a()", "- boolean a(int)", "- [B a(android.content.Context,boolean)", "- void b()", "- void b(android.content.Context)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.static", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Norma a()", "- void a(com.tencent.turingfd.sdk.ams.ga.Lynx)", "- void a(com.tencent.turingfd.sdk.ams.ga.Lyra)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Cepheus", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Almond a(android.content.Context)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Bullace", "methods": ["- java.lang.Object a(java.lang.Class,java.lang.String,java.lang.Object)", "- java.lang.Object a(java.lang.Class,java.lang.String,[Ljava.lang.Class;,java.lang.Object,[Ljava.lang.Object;)", "- java.lang.reflect.Method a(java.lang.Class,java.lang.String,[Ljava.lang.Class;)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Mangosteen", "methods": ["- void a(java.security.cert.X509Certificate)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.TNative$aa$bb", "methods": ["- void onServiceConnected(android.content.ComponentName,android.os.IBinder)", "- void onServiceDisconnected(android.content.ComponentName)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Ara", "methods": ["- void a(java.io.Closeable)", "- boolean a(java.io.File)", "- boolean a(java.lang.String,[B,boolean)", "- [B a(java.lang.String)", "- [B a(java.lang.String,int)", "- [B a(java.lang.String,boolean)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Sapodilla", "methods": ["- java.lang.String a(android.content.Context)", "- void a(android.content.Context,java.lang.String)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.switch", "methods": ["- java.lang.String a()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Marc", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Loquat a()", "- com.tencent.turingfd.sdk.ams.ga.Loquat a(android.content.Context)", "- com.tencent.turingfd.sdk.ams.ga.Marc$if a([B)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Seedless", "methods": ["- java.lang.String getAIDCode()", "- java.lang.String getAIDTicket()", "- int getErrorCode()", "- long getExpiredTimestamp()", "- java.lang.String getOpenIdTicket()", "- java.lang.String getTAIDTicket()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Crux$do", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Marc$if", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Persimmon", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Apricot", "methods": ["- java.lang.Object a(android.util.SparseArray,int,java.lang.Class)", "- [B a(android.util.SparseArray)", "- int b(android.util.SparseArray)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder", "methods": ["- java.lang.String A(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- int B(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- java.lang.String C(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- java.util.Map D(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- android.content.Context a(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- java.lang.String b(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- int c(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- boolean d(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- java.lang.String e(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- java.lang.String f(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- boolean g(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- boolean h(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- boolean i(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- boolean j(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- com.tencent.turingfd.sdk.ams.ga.ITuringPrivacyPolicy k(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- com.tencent.turingfd.sdk.ams.ga.ITuringDeviceInfoProvider l(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- int m(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- com.tencent.turingfd.sdk.ams.ga.ITuringPkgProvider n(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- com.tencent.turingfd.sdk.ams.ga.ITuringIoTFeatureMap o(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- boolean p(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- boolean q(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- boolean r(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- boolean s(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- boolean t(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- boolean u(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- boolean v(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- boolean w(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- long x(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- int y(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- java.lang.String z(com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder)", "- com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder appid(java.lang.String)", "- com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder autoRequestBg(boolean)", "- com.tencent.turingfd.sdk.ams.ga.TuringSDK build()", "- com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder channel(int)", "- com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder clientBuildNo(int)", "- com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder clientChannel(java.lang.String)", "- com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder clientLc(java.lang.String)", "- com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder clientMetaDataMap(java.util.Map)", "- com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder clientVersion(java.lang.String)", "- com.tencent.turingfd.sdk.ams.ga.TuringSDK$Builder disableAppVirusStateCloudCheck()"]} +{"event": "turing-class", "name": "com.tencent.turingface.sdk.mfa.TNative$aa$bb", "methods": ["- void onServiceConnected(android.content.ComponentName,android.os.IBinder)", "- void onServiceDisconnected(android.content.ComponentName)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Avocado", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Almond a(android.content.Context)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.catch", "methods": ["- int a(int,boolean,int)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Loquat", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Loquat a(int)", "- com.tencent.turingfd.sdk.ams.ga.Loquat a(int,int)", "- java.lang.String toString()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Octans", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Norma a([B,com.tencent.turingfd.sdk.ams.ga.Norma,boolean)", "- [B a(com.tencent.turingfd.sdk.ams.ga.Norma)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Sorgo", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Sorgo a(int)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.this", "methods": ["- [B a(java.lang.String,int)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Norma", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Norma a()", "- void a(com.tencent.turingfd.sdk.ams.ga.Lynx)", "- void a(com.tencent.turingfd.sdk.ams.ga.Lyra)", "- java.lang.String toString()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Phoenix", "methods": ["- void a(java.lang.Object)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Chamaeleon", "methods": ["- android.os.IBinder asBinder()", "- boolean onTransact(int,android.os.Parcel,android.os.Parcel,int)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Scorpius", "methods": ["- int a()", "- java.util.Locale a(int)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Grape", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.throw", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Norma a()", "- void a(com.tencent.turingfd.sdk.ams.ga.Lynx)", "- void a(com.tencent.turingfd.sdk.ams.ga.Lyra)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Sugarcane", "methods": ["- int a()", "- void a(com.tencent.turingfd.sdk.ams.ga.Pear)", "- int b(com.tencent.turingfd.sdk.ams.ga.Pear)", "- java.lang.String b()", "- int c(com.tencent.turingfd.sdk.ams.ga.Pear)", "- void d(com.tencent.turingfd.sdk.ams.ga.Pear)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Bennet", "methods": ["- java.lang.String a(android.os.IBinder)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Serpens", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Pyxis a(android.content.Context)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.TuringIDService", "methods": ["- com.tencent.turingfd.sdk.ams.ga.ITuringDID getTuringDID(android.content.Context)", "- void getTuringDIDAsync(android.content.Context,com.tencent.turingfd.sdk.ams.ga.ITuringDIDCallback)", "- com.tencent.turingfd.sdk.ams.ga.ITuringDID getTuringDIDCached(android.content.Context)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Crux$do$do", "methods": ["- int a()", "- int a(int)", "- android.os.IBinder asBinder()", "- int b(int)", "- boolean c(int)", "- com.tencent.turingfd.sdk.ams.ga.Mandarin d(int)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Mango", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.throws", "methods": ["- java.lang.String a(java.util.HashMap)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.ITuringPkgProvider", "methods": ["- java.util.List getPkgs()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Codlin$do", "methods": ["- void a(com.tencent.turingfd.sdk.ams.ga.native)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Foxnut", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Norma a()", "- void a(com.tencent.turingfd.sdk.ams.ga.Lynx)", "- void a(com.tencent.turingfd.sdk.ams.ga.Lyra)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Gemini", "methods": ["- java.lang.String a(java.lang.String)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Pear", "methods": ["- void a()", "- void a(android.content.Context)", "- com.tencent.turingfd.sdk.ams.ga.Equuleus b()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Andromeda", "methods": ["- java.lang.String a()", "- void a(int,long)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Solar$do", "methods": ["- java.lang.Object a()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Canesatici", "methods": ["- int a()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Sculptor", "methods": ["- int a()", "- java.util.Locale a(int)", "- int hashCode()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.continue", "methods": ["- void a(com.tencent.turingfd.sdk.ams.ga.Lynx)", "- void a(com.tencent.turingfd.sdk.ams.ga.Lyra)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Syrup", "methods": ["- com.tencent.turingfd.sdk.ams.ga.Syrup a(int)", "- boolean a()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.const", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Raspberry$do", "methods": ["- boolean a(com.tencent.turingfd.sdk.ams.ga.Syrup)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Bilberry", "methods": ["- java.lang.String a(java.util.Set)", "- java.util.List a(com.tencent.turingfd.sdk.ams.ga.ITuringPkgProvider)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.interface", "methods": ["- java.lang.String a([B)", "- java.lang.String a([I)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Dorado", "methods": []} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.strictfp", "methods": ["- java.lang.String a()", "- int b()"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Leo", "methods": ["- java.lang.String a(java.lang.String,int)"]} +{"event": "turing-class", "name": "com.tencent.turingfd.sdk.ams.ga.Crux", "methods": ["- int a()", "- int a(int)", "- int b(int)", "- boolean c(int)", "- com.tencent.turingfd.sdk.ams.ga.Mandarin d(int)"]} +{"event": "turing-class", "name": "[Lcom.tencent.turingfd.sdk.ams.ga.native;", "methods": []} +{"event": "turing-count", "n": 166} diff --git a/tools/frida/capture_20260829_063255.jsonl b/tools/frida/capture_20260829_063255.jsonl new file mode 100644 index 0000000..3a1005c --- /dev/null +++ b/tools/frida/capture_20260829_063255.jsonl @@ -0,0 +1 @@ +{"event": "turing-enc-hooks", "n": 11} diff --git a/tools/frida/capture_20260829_063458.jsonl b/tools/frida/capture_20260829_063458.jsonl new file mode 100644 index 0000000..388d170 --- /dev/null +++ b/tools/frida/capture_20260829_063458.jsonl @@ -0,0 +1,2 @@ +{"event": "ssl-magic", "module": "libjavacrypto.so", "num": 4310, "off": 257, "full": "504f5354202f20485454502f312e310d0a692d7665723a20310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6f637465742d73747265616d0d0a436f6e74656e742d4c656e6774683a20343132330d0a486f73743a2077736170692e687579612e636f6d0d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a557365722d4167656e743a206f6b687474702f332e31342e390d0a0d0a0000101b10032c3c4c560c68757961756462776562756966096466705265706f72747d00010fef0800010604745265711d00010fe10a06001607616e64726f69642d00010fcb571882cf664bb39401ee7cda1175c8f5349c4d0390dea18b3eca7a2e271415c04f657dc54fce23cd6b9ded8fbd5d3b0c776dc312071b9b69f2bb549a6a7c873f33ab009d69a5215194454d0e3a53b8fb5b58a2a5819e69913fba9ea80a0f6c5adca29b800bcb3dbb7a5ab6f79575422ec57856e62ec34a39ed5ad062a014acfac92e7d7842486535ae7005435a092d91b75847798efd858423eb59ddfa13de7a04c18413b1e96716245f028ba1f4d1e42becbc7c4f158457a07938f7eaf3f7f25d60ca1ec30dcb834eb8006471279c3d76adb391be7ac39aa86dd5888bf87a89f8f43d3604b2a3b166eb0e264c83b4161f26070ede0d1885f55370c4be32070c95d9b6512f865d7dd41db96e7bf295020a5f23d1ee7e0ca371ef8e034dbbdcef0cc560cf413be0ec9ebf9caacb885ed059fc532c489101227b24aa0c179f455ef28985cbd931b732846e5f9a601b3bff059dee98d3f7afaadcdb9afac54eec80f21660662cca37ba032fed43235b6507b8c0c257b5ed568b1ab30376969c3f383554fd630a7550d9503eadc578f79b7d20677ec374d61328df6efa633301418c308a9cb55021d043c1f295f709ce34d4b515024c7045bb9f43cbdbb56c117268ed0ddd93ed9024ae6861763ffc43f3318c9727c2b660c3735d8d99babac7d219569f434efcd4f900a1b89296e9b05c31e2ac1be19bdc3699439758ba4eb128c12ce1c19b8488ea27a6a45ab6f09609cda4f3248d30c8ef857dd7997bfbfb0b8a8a9e2ec93cb7daf77068d7e46c4d0682c5797b738a34e473cd4db93c31f9d9cc5fd731d0db104a93559ff49dd3335c53c8bd46d9b8b2059b0590946b5392f3bfb048f4569ffb3b9cdf8bb28a192dc0d20b1b801037ec3d49ccb4a46a04f923851518f9314ae2fdd6bcfeafeb4c86d968e767d7529b2cb064fa3c15771591b8e5caf24b2a2db64d6d1ff76cd82eef94822b50b3482b974fbeae7e3abf19e08bdc4ad74b64a995fc0f5f590f25c09b427b101063edd8b296b302e085b1683d47ceae55d939b762d4a97cbd1d694f62d0ebf5cd7c4fe2ec8dfd64b287e7652f8acb21c7c0436a444dc08fd21d3bedd4d62eb9d334fe918d86b1fb9d8a276c5065ec4829a1dc13272387e2a5a4e85cfb6a901407e6ac75be8bbedb0f4e0be67d79c1d7dadc8019c9c20a5f52a61e4d44631fd00a160cfa73aaacde4764aee5b5a997eabff581a1fffb3ee77664f5431c28ef4fe786b087acfa6c0b00345ff9ae3e112247a27af76d63d51b1e128c6938f965be33b30cecc7cdb77e83d4f8b83de442b39aa77c12f7fc3a15c2d250e75d818511b463f889c632e352da321201f9c8c8152bd418acc70bd698b7c518d33067baf9782446395cef3d13309ff235e21671a3fd886daeb119424f69cb4943f387728d9c433c41d3a9acfec8bca7e358a7357bdbc2b19e5dfa2bff415b9b99cb6791d73193016f17b1d182b54b3cabd2219d688a5edfb0e4945c49db3794a5daec227a0e32408ede7d325b0e1eba2332f27289eebcb33b010a593dd058a45ec94b40c044e93f83ef9746bd30f0628373dd17444b22d49aefc102133ead0753b599072d64b26965edc207c09237e40e0e52b51e6531f4abb4f66d58b73d0005edd9d5235b68e30757501b03cf1eb407a8dc04d3c82d3835491435f7094a6fe0ec3a8494eff942fc54a6c8bacf0fee898d7470cc5d3fd7cd9b8a2441244d3895b751b799ad7ad2eac1a713ebd81dcfa6431ecf2533d1e892b8e24947d03b9afeebca08c30b12df0e00ededceab680e3e4b38ceaf1f4b9ac41635d9092f67366d3f8e6ce78a471eb692622329799752261681e5986f80320550353f00471ec44ff2059279fe6e8cb944a395a7ae097b25a66040fa79717d2fb0965964d1a5f776a14bd06cdecab564621ed84c5c6c79c8c93e87f09f3238f092698d19c88591a6ce9254c99d7f9b2f737988f75b178e8b54b1af21dbbc9ad92ca56758f30043039459a55617749e2ef419d8a4db82a71b6c6eae8ad65010f960537d5d065c28cf758b2f964239fbc5936adbfbbacdc134b8b047b2169f5bc2308517d4338bb26a798313dc2e4a4292cb5ab8f60c55e65a883a06040ebdd3201c9f1153c759f37976d7b6a84a1e00630d786754cd14d5da9fc19f25e2a6876eb623c68646d64dc38b3458422676c581d8ff46d1818e098189c27b737f59a39a1b89f66b73922596f04d923615f5723edea410689adf6f20cea39fbbebdbcdef1f3b8f2be106e422c9305dd143065e543dab4e3f607faac63bd045495cb70dd13ca7a22c6827299b9bd75d813acd5dee6a996cf6fbaf484a0b561a355daf2f55ed49ea9e039a0b47816bb9106e19771bba0c0d7cf4925462166e306e3cd04914ead256d97e1a16464e0f6d039b1b7b9116a1419c590abbcc1ea795398241d3990b49e47e036aae6e0285cffd5367111b685a586a798bd5155ace0af85caae1211b21a3f1cc8350013e5b9c09f8bbfa54310997d0efec21f64115edc64d5c2aceecbca09cc16bb35db37e268154d5549ca28586af73c4d5464ab4a19654c11f39f112a4235551436b975dc8f77d054beeace7eb2a57ad7d7eb8a4edb655d83d7e6b9d7a2e9c29068075ab8521031d4d6bc1529f9af94373d3455cb5a7300c741e76f4fdc59004bf25e6d85450c72c46379b9d9a6afcb6dba1f47742d5da8db14b0d8eb691d04c1477ebc9acc112d9b4d5880eb5b734886c0374969f6216151ae7b0d8520c0cc1c76df368ab4901bbbbb76893417507ce285f8a084fc2efd0fa0ee62714f7388f0525b8573a1eebdaaedbb269f1d051229b0ef405c3f1089d242569e717e77d77559185f710bee05f7ce91676ab21c7f54c7fd3029c26a45c7453ab6bd78213f07a6e99ec839c39c6305e5ae707ea1a192655af175e8a6711f18020858775431414b72d1a50959e929db526d2682ff6f8f61ecec08c474f81c20e8f282dd4a28e139354247b086a72956fe832b8f01d326afb75d527b9a4c62bdfae5613d4b56c6c172205cbaff764e49d47ae2153786543656ad4fa15e963a7dac93ef2835a733d7d3a98eb0c5f9d75f66797a795b2485d47aa7ea3bc0e7f96dd3a299c88193f12e6c03a62ad0d82080e1e5047e47b0c72168630e858081ff95398036603a458afc39112bb353056d54a66f78d5cc75ae7cb260d4436edd24653b8cfc732766efb3d52a799fcb8312cb6e68c4e3587359ade7685279f93dfbd3e0521c35171fbb26b905ef59e5ce6734a1e69a695eab6a6311293af55025365eb58869375a272674ce3036e475fce49b26a6355961cf167cdfb9c8989a3ed4c54fcaa950ebc653e3ef474d1bd1c5edf2bd10a499e1b70248c22125d94cd18094e26e95960c4e560e16afbaa7be87701997ae58a7dfe0b37cd99f85aec24d4ec50b6f288a7272a8ecd27a1094736801e0b241bd82ec517aa9ffc3a395285344d17ed08f0ce4c67575cf0bac06b5a07bdd9a9d77185b8d2a2f71e241f458696d1a9f1ffcac075f47a1ba675662879ad5e3471cdac259e9513e1d292698679583bb7aac20eef9b44ad5bebbeb1260a289ffac8f37d90db165d04e569f308acb53bc95055a28883635b605b84077b368e311e01b819d1789d40b3b340d397f9c35a05e617ed735f11d1bd9db896ae351a76ccffa631d6cc54966e66dd5c1518129188f582b42dd48b12c3ca932c2ff30f9dde9f9a30fc0bb53419075346ad720bf46ca503334fffb0cb53a4f085934e0a49d2f11c358e17ddcadbe05b7b394585c2e4fe41b08371c3d9230e4c120aeac447986cd0d269f423863fdfa3e094dea16c0fe75a1566f7f3ce4abf2be7b796fd4e92b9929a147d3cfe5088c0dc6fe0b3774a0b51c0b5924d6d2ff4109a09d369f29e8dfb6cf7f26c57fdc7417447c8749a6c3beb89a2d8228425062d15a49739a2796de62862571fa667cbf047a80258342f11310a3cc2433e0cc67fcf703ee32caf1e724d945e770cca9c146212abc25b537ea1baf908e79a5febf3685cf6bbdc297b6040d0462743995d77f43a4a4fe8d3c95e4d2707a61ae4dfd1f816e0ad40f8330babc3c88e88fca08136df484f6fd55bfb24ead0fd25c60c3db70380babae408e3547cd908d5e1500885f5cbff7d6b793f01e961ffdf8be206fb29b3cbb11cf185721ab4c8062431307a9c9b24f4a32914936a1d63577fd33c38752da742c5f4b856dc93dcfa207c6094d6c0186489c55d1167e1bbc8fb222f687c67151bbf01d2e780ff4968390f14b473cd67a01066d80964d4cadfd65cdc77cc7b14b263c986442cdda718d6d1a65135b8141445c3e956abc145234368731f7a2cbc67826cfd0c369218be3b717af83507ece71118887523c7a2308ca2639aac9e0acbe3f4d58fb5694499f5ec29df29284aea33206aeeaa61acc876c193a3af7296dae14b3abfe03fd725d06ecf76c4cf2bf48e783d703cfb4717f4cfe1592d32e8192bf14e47ed1b6e899f38f246d2557c736c56e704a76ebfa61ed70f7ba5674e1288491adc1d3bc4a90fbef39c2f5b0fc154991265772034f6258ea0d2b98176ee7644e485b823300274497998a63dcf9920a3a3ac142bc56975b9321431a4b3394bad6e7ee6ba905c307aadc74d433d57eb08c0782dd19838fdcb602643398fcd92960668f22f42eeadbe307d8a060d75facf66ce75ce5d066b7651cd09b0dd69ead18b2bd37c8598c66f82f61af82d34b179cabde248ece75cfadf6a2e83a6c6d805fc0e51ca009d2411c2ed6dd2d28aadf2d7a3f8bfe7eddeacb838f1ab3e2544164bff56ff9b7f1d5ce7aaa65153c2be39fb0781210beb1bca477faceb6944d20fb7b2cb5097f94c5682bc8d75c77ec8b168fa2bd9bfebb602812aba0c015af6e5902aebf6e122a3f989a6cba8ea30f22aec2fb4b04e9525b625a4368922d9f023f941fe1b7d28e040b2df75208fb8b49e481e62ec630085eee3e26d8c6ac0740a0c9ef4bfc021c7a5705b58d15ff926e9112b99b9853a273c2cc5f170aca8dcf4a2d7389b3a609c4b11f61ce74e470e2ad3e7ac8ee2cd2cdfe252429ee6d9690e7f0d417d09d961ace3205e71dd96867d82a2deb21a514cac2e7e02b163f6d1f6f00bb17cde1f87d78ce5e45d739d2d3f919321e1dd18d36f76d0327f21d04c7e8892a3d2c1bd6950bc1782145a5acdcb93c611fde2c8cb6b2351f875436043892c688799411314619151ba25c2aa2fb0baa788367916d7507c1ff0b49ce07bf8c5bee5ed625d657200fca72a154370a67bd5bba3cafaad6561aebe41e6d2ce543e77c73d4473b709463080e429cba6fbb16f87e0f73e0fe91c5d8be3c81367dcf9b1c113e46c87231d2ad5a68be7634e9345de88f1092a46ecf76d9059679845052eb4f67d4c326595391c88c5ddbb0d396053708682dda377937c4944ff1a074b4c65dd41cce3c078b170e82a8f92ca7f424d791a4978ba15b237e341ba20df302ca8f90ab399e556976c8b520ced11d0049d24e13208141480677effd3fcaeeafe68b0752a70ffd8ae85e2a1959649d1de1fc1699e0171dd92fadad4571f98389ee8896817d0dd5c82c736f51d642e0df8692b9fa693d42f805fd26940dd3f265791f16ff7dbec1f78dec62c729951767850722ce26ab2aa33c58078a8d347253c8eea7cbc1ace4f499df907444b9748d4e4e9a83600400c0b8c980ca80c", "bt": "libjavacrypto.so!0x38c48 <- libart.so!0x13ded8 <- libart.so!0x1347ec <- libart.so!0x1a9a98 <- libart.so!0x31b110 <- libart.so!0x3124fc <- libart.so!0x685858 <- libart.so!0x12ec98 <- libart.so!0x67f940 <- libart.so!0x12e818"} +{"event": "turing-enc-hooks", "n": 5} diff --git a/tools/frida/capture_20260829_063725.jsonl b/tools/frida/capture_20260829_063725.jsonl new file mode 100644 index 0000000..e69de29 diff --git a/tools/frida/capture_20260829_063845.jsonl b/tools/frida/capture_20260829_063845.jsonl new file mode 100644 index 0000000..e69de29 diff --git a/tools/frida/capture_20260829_064300.jsonl b/tools/frida/capture_20260829_064300.jsonl new file mode 100644 index 0000000..e69de29 diff --git a/tools/frida/capture_20260829_064653.jsonl b/tools/frida/capture_20260829_064653.jsonl new file mode 100644 index 0000000..2f3caba --- /dev/null +++ b/tools/frida/capture_20260829_064653.jsonl @@ -0,0 +1,34 @@ +{"event": "ssl-hooked", "module": "libjavacrypto.so"} +{"event": "ssl-hooked", "module": "libssl.so"} +{"event": "ssl-hooked", "module": "libhyssl.so"} +{"event": "ssl-hooked", "module": "libmarsstn.so"} +{"event": "ssl-hooked", "module": "libhyquic.so"} +{"event": "ssl-hooked", "module": "libngtcp2_crypto_boringssl.so"} +{"event": "ssl-hooked", "module": "libposix_quic_ngtcp.so"} +{"event": "ssl-hooked", "module": "libhysignalcore.so"} +{"event": "ssl-hooked", "module": "libhymediatrans.so"} +{"event": "ssl-hooked", "module": "libYCloudLive.so"} +{"event": "ssl-heartbeat", "module": "libmarsstn.so", "writes": 40} +{"event": "ssl-hooked", "module": "libhydt.so"} +{"event": "ssl-heartbeat", "module": "libngtcp2_crypto_boringssl.so", "writes": 80} +{"event": "ssl-heartbeat", "module": "libmarsstn.so", "writes": 120} +{"event": "ssl-heartbeat", "module": "libhysignalcore.so", "writes": 160} +{"event": "ssl-heartbeat", "module": "libhyssl.so", "writes": 200} +{"event": "ssl-heartbeat", "module": "libjavacrypto.so", "writes": 240} +{"event": "ssl-heartbeat", "module": "libjavacrypto.so", "writes": 280} +{"event": "ssl-heartbeat", "module": "libjavacrypto.so", "writes": 320} +{"event": "ssl-heartbeat", "module": "libssl.so", "writes": 360} +{"event": "ssl-heartbeat", "module": "libhymediatrans.so", "writes": 400} +{"event": "ssl-heartbeat", "module": "libmarsstn.so", "writes": 440} +{"event": "ssl-heartbeat", "module": "libssl.so", "writes": 480} +{"event": "ssl-heartbeat", "module": "libposix_quic_ngtcp.so", "writes": 520} +{"event": "ssl-heartbeat", "module": "libhydt.so", "writes": 560} +{"event": "ssl-heartbeat", "module": "libngtcp2_crypto_boringssl.so", "writes": 600} +{"event": "ssl-heartbeat", "module": "libYCloudLive.so", "writes": 640} +{"event": "ssl-heartbeat", "module": "libhyquic.so", "writes": 680} +{"event": "ssl-heartbeat", "module": "libhyssl.so", "writes": 720} +{"event": "ssl-heartbeat", "module": "libhyssl.so", "writes": 760} +{"event": "ssl-heartbeat", "module": "libjavacrypto.so", "writes": 800} +{"event": "ssl-heartbeat", "module": "libYCloudLive.so", "writes": 840} +{"event": "ssl-heartbeat", "module": "libssl.so", "writes": 880} +{"event": "str-magic", "module": "libjavacrypto.so", "num": 4258, "full": "504f5354202f20485454502f312e310d0a692d7665723a20310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6f637465742d73747265616d0d0a436f6e74656e742d4c656e6774683a20343037310d0a486f73743a2077736170692e687579612e636f6d0d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a557365722d4167656e743a206f6b687474702f332e31342e390d0a0d0a00000fe710032c3c4c560c68757961756462776562756966096466705265706f72747d00010fbb0800010604745265711d00010fad0a06001607616e64726f69642d00010f97571882cf664bb39401ee7cda1169c9f5289c4d46a1de0511bb80cc0d46f6f28f6b42472b34e27be80282fc39ebd7e803d94d41c7e40694a7e3c98c93ed2cf78eb42ac04549e73e994872130f322bf86547b3dd3e3537d487b9a6a5a28083dc0e776e2a7239a8c8e1c6c50841c5e300019b43213942edb726a67fc4a9b15530b466b26fcb884e90cc341a13cde06ab1f9ce7bc8c4eebe1f6e5aa7436c851d4742cb49bffcad4a3ff1e23574dffad3e10d3f49601f83057b39b65988e6b611e396b20641d00b96bea943141c4922ddfb312e74fabd592c47e7f3639211eceedfc9c55291139e2c956db0d677a96eaf1c87b6fce2c15ebc2e147c4e11818cd4283e47b912fbb60e645dd7c6239e57f10a064c03be98519e9ddb6690caac539271606ba4e8ebc2307ea381a9c6ddf4c7d189c4830aa964b925a1d17febb5e94faf7b7d9a117b971148676bd103bdecdce59e0f1d57c79e3e6ea0e6a96006748e567a847fdb5b489e6b0cb291dbdbcd03b40354af91c9ca28cffe20346ad0427f82d25c4106c297f0ac1fa8f1e4499ec28acd90e92fcd43313120b6a6400172a76d5c62bce5a3cadaa682dff705ed69e1f7a54844b5a25a09e50a5308540f9ed4f3e33733662ba56ebcbdac6e3d065c24560801e6d82c4196058dee8d764304f0d97ff652c595d82bdc68fa825aecdd1304129dbe796fd6df78bce8618e4f5a6af2963f183e7c18aba0a8d3caf5c6e8472d883bf779ffa431ef21477e411b96fb4d58afd69d04cc5646ecbd4150df7a5ea85390e6ab6419992ac7c2d5f0869522544c10a787492d1121635a271fe1d774ff5510d208d373fea031f232a1be5911aa3097f09e432b5921e9bcab5685fc0e1d718fb23ec4311926b1cef4aaed287ee2bfea9beb4a11445dcf5a82234ace0f0509030952c3e3205a0ad616ea317b836977e88495832d38e332c38d61f7764906de54cd5d2eb5d24c352bcc3b6f2d08ee4800363e6b343e1eabbdf40762ce5877947e730d8244ada7badf588e5cb227bd9ab3ddef31a17e9d670586bc14d7d51acb34edbb253e4173788649e9de66e6a53f2ebb65fa5a1eeedfc0914c1e3b21cbe0eb4a24d5b7150a4ecf4d9214545b504cce13b458984fcb6981a6b102bac99820176dcde79c25c5ab1ee89508d5ea0ed3ba55c851170e1a32a733ba1e4d44e2b286960bc507556bbc83b7769fe0d438f29fce90cd640b67dca64fa1c3f1c97eea6e05f82aadc6664c073ce5aa098ce6c3e393bd33b4e93207161abf44e9ff3edf152c7defdfa58e178efd05af49aea47239cd54d10a92a34938fb2f8e7251639b6acb17715d5eb52526f7571946df248de6c9fca2c733d24d96042c8a4be4352b3d0dbd76327b6cfbf1ff952ea4110cc30aabb88251f187a576c61d99d167aaa472e3a08dd6295fe699b80f0c5b94cd4e4486b07d493dba342b80e9f6bd130c31e46c65ee468c0559c13fd658cc193a21aaa283c7b340072a289ce68271bb18c9ef78725a813774d059ebe00dd5501723bb935e284b4df617250ce085c59e7f1e03878970f0c022f4b67cadfdc78e67482bde6e8d0aae2c09e3363ca8a31c249b33876230a7b0d2f6b1fe8ae817a667186f725a0cd2a00c3c081bd967fe67a0f795786c5f0ac3f3dfb393a3fcb1bef4db20051fe22b431a0a8f60fde552797222e856caebb2c507416e2787f9f3b79965f17b05251e360e297db4a542665f0910d2942c08ebfce79f478cfe1571247a1a0f1370001182f17fe8c88fbcb96b2a09e26fce56c8c9e9b83e41740134fb3b20daf2a92b3ef601227ef80ef08f1513787d07bc1ca152316c67253b0ef6eb01af1aaa3ab12556d60a2d5cf55f3760fff78fb56b9d9b741ed8d38892e460be943eb39eef543f36bf25d8db9c7746b5d25c637d6b228bbb067bda721a59cc021fa1a4ef29f5530896df3a66fdf41ec88de41a9f0635e3c743a015c70a4bc9a0b1b56779db1b3d4dd9c3dec5ac9349fae808bdc2ce0b7e35203426e688b3074bdb60e08f986bb205dea7ef4eed235e8af22367d38a4933ed1dd66b3aeade8f5c29902bbdd90626fda254a20969fe98b8734306a0968efb32a8aed5e15b8ab19ed09449f5245b8475a999b7bcc36cf201438949e6075276c181c1bf722f156344f05ffe04e0bb527206079820c8dec3e469dd0e7003d43d527da9551e0e0a44da6e6a1826905ea21e4da2e422151a9d7662e5b0c556f6571f89982ac7996c2cf0eec60aac3211e315d165ba59c4441b7b3e616aa0c52175cb8830e94ce7c5c8944ecd0a59dfc029227c5e8dc3cbbf731b558ed719d8a5a15dd7fa9669a5cc64c6e54c6f571d5755ad1e04d784092891a6cc408d35ce1197d51ef2f0a78df0fda960560efa4363c6b2c56bacf81245dec949b98987015ff8953db1c58142d44534313912062266b327c83fc91871567a8080fbe12e2c9044ecde0f9fff8cfeeefad91694a1a702781ce04033fc283dce7f644756e14147a53e88d6929d44f06d224c1177eb38d87175f216969688700c9a7378ed9def9d79e860ea5081f0f05adb353a1d366d5e01e681e2a692cd6f01023eeb5880621b8b16af8d89cb5d53d1be77c97ac2d9e4ae7f46f2d7594b13891789d1fe899192ef98fc898a8a50078f444be99a6f9bd2917f998faf109b10cf5f3e2444c64dd63fd81dd331eea106a4fb420136b003994d0ccd34b86625715a602dec9a3f1f9334f769bd7d97f474f1f225adf6968681ddc5ea5ee7df1834ee34d221b8a8330a9eedcaf96b00246999121bc4ae82325d11605f59c43f8eff0e86f207b945cd772ceeb92386ced2dc4517f8a65bf9e67116a13d1f4d53ac87ecef27f009aef947b2748ddb1603d5add5f4cbbb32b17375539f7ff7aba8c368a7e81823aa0486d1c77b7f273debb642dbfd78e1e3507eaa1145fbc0898854fbfb18c590a134d01f973334cd338447bb361a7e54f6e40202814149c0696ccf9e66f5a17e94869dcc799aacc92f080c2221e848ad62703c1a8bfdac1b11b4ceb4afb0ff6ced11a54075925b3a0eb55e8f66ee5956ffa8b17b9bfa17fd9c28bc504136e4639042c2c49d20988816fb2d924091491851d86b452ec490da23c5994d8c74cd78dc957379299a59f7b4ebe22c64b4e78229c6703acf3d93ebfcdf7e9dca1402114d242221b68944b63c8a2fe9e1b24981dd4382d69dcec6fd1021f0b15909f4586185f95458d1fb13de326f6dc68be421d3385a44914b4bc0d9fe7df9bc2fe9c3bea05d5794e1392ecfeb377d96201bbd2f59e638b707e8a8a39aff8bbd6ffbc0c6d8e30661b7187e044757a5b72e1b5e7f6d41bb219d400dc83ae0be91905882aa648038b49748f2b6f2c381c634683380e49151d3907aa8ae6f431e44fd05a9a2fa0837d4f18324727d8cb962af6c0300f6ae99e955d19d4ed3b53d148c2d580bf833a5f60f3afe777311b3862abb75a9f759e1130630bf2e533c6fbc7d063797d1041e2588ea1a81c57d783e7c45d597603e57db519078418329de43d0a82bdabd09f7421f364583696c35c18a67f5581f9bf3e8ae19eac489530f316cf0217f5f4057ae260ee211d6e9661abb95661cf9e49aba0202ec336fc5f0bf1f0b918eb6dbd08cfd03dbc6216d47955142ff88ccd2878fd5c572f76b8bc6fb4fbf3dbc4187e7cc80027f89c3c1f85f836ce3fffdfc60f4aae75d96c26fdfcdd5a9b913b82cca1adf7310d11288093297bea20bdc5a90065a2acd9cd71eb86b5c58203be86bb091d6447c979a2030d61efebd70eb8ee0113a40224c31f3a5b57fdb5c01bea884026accd096166e5b14b3541b766352bf170ceb354cd0eb2daeb90537ee13354e955de1e6f4fdc2a17f8225835ea1fdd810030d4c509c104f9755afb4de249558223c0489e950aae489d51cc0c8d96c76ecb21ca8c7079ac0448af6c2bf01cd3647717afc5482a1d46d0ed4afaca80bfb3d7d3519ccafd093ce93a10bf3a76f1dc984dbec052808dc49f50a16b0854b68c858df20b43e473979c996b45eb373dea9b0d6153d4b630d9feec2a920ebab9c9baed6893f8a7c7ab8c9074c0e8f06cbf5694068246e319a5a713cf5c98c81ff591e809c952904f420025ffcd18067fe3a26405ec0d39c9de25a71da28d2650f7afe724fd394ad8820fd2952f4579bfc05befbd718511255fa9b7bdec25ab0311c7752db680ba97f00a2f5dbd752c86e685d981e6068b98a88ef361701d613a9263ff27c6cce3e371d4e952e10d7e100b5a55147ee820417b7946417cbb5f0ff0506148766f13b7883185bc8e72b0ebb3a88082db5a945f8fef692157ec4dd42e1b9aa88ac6e8a8c94119b96ddfb92f7a2a8a6addb954ba49b43d9bbe47cf51c561035251c5cd36f1123ee03192b8ae4ebe61df34ec71abe9ae53843be800a73d5f25e12f9a85d3f78c67a0995b641282f091d1566c3a4f38a9141cd623c0da1534bf6d2ea1ed514dc3f005825e3b709a11dd2a874b38b796173860eaef74a6c7641b020dc4fb63564f2599bc1292fe8b615524042ebb0da11d34a3dde4124ff0a60ce212f97bd87e1262c33de3e3d744574b17566f1ede45e399d57ce0149faa079c50384ca87cd9cb32005d85135d7e1364ee4d91c3928fc27db10df916c4d8a66d39526fa2a5b5edc2e4cc1d4282a4eae71166b5b0d05bcfd11e62bfe5f4e44fe913ce812db64c3f5c7c9111f85ebfcc7faff8cd4b52446be0854e2d698d3d6bacbdf07de3191d7ad55e908bfd76cd2352fbf8542a6b63c8002bc0d8fdcc84b39eaefb5a594f338b8cc2dbbb188721a55a882c822ddab6b2d9e3c4fcc09a7f9c151917ea86c3058c9efc593113605830f19e771c828450e4516194e638541e86d6446cbb1fbe20a80302a63f54234a9e0f718146698fa533eb283a37c14c759b3824c5b7786f8ce09af865a15343a22044c3d620d7dd845eed78bc6efd7997981818f0be978781e44284dd0007e66bc4135b9c3829057da2c3bb7156dc7469c3b2a713e26531433966eee5e5c5c9bf752529c105d02a1de81099bad347ac337736c835cde2b1fe44cb8e3de3ee4d263687bfbe2bc2bbd2dbe5f9e01237b14ab883de57958ca3f89d0a816d23968aff7cc3d701534190699410a08b52299015abec4448afd2ccafe765d140c3289ac643498dc2c00a5195e2ebc90d1be6f6afbcebc28a9a4819bf12f5e715ccc477908a1988b1537ea92247a2ce679ec8a8e9afe274e562abd9ea84f08ac45819a8511e42074db7728838af7d6179f7410950030b7d46e83ec24cfb4bb01c2fbceda44fdee858ee5878aeca5c5988c22b1dd2c81bceafca0fce0e972d706350dc15dded3da2e592f41414b4311c73542eee8668acad17ccbcecd19fff07a7cb4dcedf8deb957c4370d2b6b84ed68c16aaa112c30e3f9a9354bef53fb488a55eafee9e0348438c4e66c9b1c567e5ff401a4b473a96822015dab921b2b55aaf523eb803cd6c781d92b269515ca287a75f0fda1ce7e6a49d0fd419db54c3eef8ea5e024db6731e36a5393fae4028ea69f8ccb276e87aa421904c5564e61c1e938b71cb63ef5b97ce1182e5f3b2fd94e9db02405b7fdf0af933e732e6d9c7eccbec136be0a672c3600400c0b8c980ca80c", "bt": "libjavacrypto.so!0x38c48 <- libart.so!0x13ded8 <- libart.so!0x1347ec <- libart.so!0x1a9a98 <- libart.so!0x31b110 <- libart.so!0x3124fc <- libart.so!0x685858 <- libart.so!0x12ec98 <- libart.so!0x67f940 <- libart.so!0x12e818"} diff --git a/tools/frida/capture_20260829_064833.jsonl b/tools/frida/capture_20260829_064833.jsonl new file mode 100644 index 0000000..de1854c --- /dev/null +++ b/tools/frida/capture_20260829_064833.jsonl @@ -0,0 +1,24 @@ +{"event": "ssl-hooked", "module": "libjavacrypto.so"} +{"event": "ssl-hooked", "module": "libssl.so"} +{"event": "ssl-hooked", "module": "libhyssl.so"} +{"event": "ssl-hooked", "module": "libmarsstn.so"} +{"event": "ssl-hooked", "module": "libhyquic.so"} +{"event": "ssl-hooked", "module": "libngtcp2_crypto_boringssl.so"} +{"event": "ssl-hooked", "module": "libposix_quic_ngtcp.so"} +{"event": "ssl-hooked", "module": "libhysignalcore.so"} +{"event": "ssl-hooked", "module": "libhymediatrans.so"} +{"event": "ssl-hooked", "module": "libYCloudLive.so"} +{"event": "ssl-hooked", "module": "libhydt.so"} +{"event": "ssl-heartbeat", "module": "libssl.so", "writes": 40} +{"event": "ssl-heartbeat", "module": "libjavacrypto.so", "writes": 80} +{"event": "ssl-heartbeat", "module": "libhysignalcore.so", "writes": 120} +{"event": "ssl-heartbeat", "module": "libYCloudLive.so", "writes": 160} +{"event": "ssl-heartbeat", "module": "libmarsstn.so", "writes": 200} +{"event": "ssl-heartbeat", "module": "libhymediatrans.so", "writes": 240} +{"event": "ssl-heartbeat", "module": "libhymediatrans.so", "writes": 280} +{"event": "ssl-heartbeat", "module": "libhysignalcore.so", "writes": 320} +{"event": "ssl-heartbeat", "module": "libhyquic.so", "writes": 360} +{"event": "ssl-heartbeat", "module": "libhymediatrans.so", "writes": 400} +{"event": "ssl-heartbeat", "module": "libhymediatrans.so", "writes": 440} +{"event": "str-magic", "module": "libjavacrypto.so", "num": 4175, "full": "504f5354202f20485454502f312e310d0a692d7665723a20310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6f637465742d73747265616d0d0a436f6e74656e742d4c656e6774683a20333938380d0a486f73743a2077736170692e687579612e636f6d0d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a557365722d4167656e743a206f6b687474702f332e31342e390d0a0d0a00000f9410032c3c4c560c68757961756462776562756966096466705265706f72747d00010f680800010604745265711d00010f5a0a06001607616e64726f69642d00010f44571882cf664bb39401ee7cda0189c8f5089e4c48e3ec071355a75fcdd56d2ec0d581358054ba8c4ddb948b50d3e74780f13ee1b36b6e1c4ce0d82016c4ade4b4188b621f563f98e6a53d8f27e4efa652787d75b66ea240fc98e02e93885d8bb176a39d37c38ed14e37f0fea3d36cea20985203c8d343dc8f043987700646bc9aa6bc81ea741618d04df4d184da4529781e0591486afc1f8857c23d1ce4949071f36a9099a86c59b46e3324eb20857c874e7c5826ef9256c278d3d2fb22bf89f3e85ef50e178480d40b2d8e29267846019e6cca3770ec8688114de9c43f3e1d4e6f609da42e9b3ab13bf3a7828621b735bf7c9b2596ab28606411a7d82c6457a9b5e22688ede807e17c00219077a90af0cf0912adce7caefbc5b647044358cf117b2c1c59d904e0bd0731442b4911cacd8b7a615ccd117fa0d5857b6000807066e89aebdc800d218e79f8eba60733307bf0c314dd65df9449bd46f1c1f3c4d0fea67132cfa583ed03d44cf6fb1b756b0636d0fa44b117191f5aa677a41ad967dd6fee6e93eb3dddcedaf1e8eb5212a4405e904feae9a13c88f7064025d7b9de56b2aee9cdf24bfc78f648eb5c4f3d2c2db0abf5e96553765d15ccd43cbd238160c41950680be4432a68601d5442cb3761bd75c6e2f63b6136e75ee50b92e5a807036388bbd4b2a3ad51946c89c6bb7da171cd1fa3295176d36520015f7a5dfa862f1bdefc58aba0a8d1cabc02b9472d8c3bef79bfa4f1ee214f7e411b96fbc19114dcfb1a50057a6a5f6d2428169b30f40b7ae0838ac5ffd7c2ddf086933c43cc61490c0b0a78534523fd4dcbd93c27148a6698de901563a3f66376e4eb73e69255da91d141056a7dec540ff2fd1edd802f83ad1cb83b6d2628bd29607977117330bf7ac8e146d1369c3c38e2de9307d9168992c94001fcd217032521cf86b91a68e54644414b98c306d476b4d120f6365d98c288f482cdc75e7039e4ea7141695b5fae6740e088f84743247ef755a0db45f963fc5212fd26f30219870712b753894e608887f0bcaafb4fa95b56b0412b8af28b7049058a9a36ffd54e1de3b28b425a1ee092c3233ef62095e4b93fed2bde08c8deb7950b4ecf4d1214d4db87c690fd9a620f3cdf413c1cdd75e6291590519cc628741951ff7145ab585297790bb70c14da7aeeaf085a133383eab494f091303a1d3a253cadcd593635eac1a3f5f9286ed58a2fd9a5f80918f428f6b70d512d8d1b0bd2f9ac5bad08a60d32b13b08013da09f70a63c1eb5242ee36294840ca7fd2f7d00180a4f9a5cb252e4e805127ce6434e2c246c92eb1c39b0ebaf415317b4cdacb40aeaf14714c70251a1671ab2a560d7f0882411aa68d6e013c5aed26e475e3620142e0889593874950b70c2e6a62df6fc518f85a33a52a7f0deb732e94783b582c7833362b37e901a7c1dfe6ee0707762fc7ed9ac96c4e5d2f8ba6ab43445e3c0584fff2eeb9e5f8b0bde7ad2529eb9e1afa12b8e5fc25f158b8f22a2205541b07e9ea8e96ae30fa98b7a9b8cae50449741da4a726c9e9ff1bdae7899ee63bf55d02e4580903d829e496f8d9f7dc9ca05a107124d9e7da847edbd54c26f4a3a26d5e878a6eaca75779b00b732e7fd8f2f26916d53ad145bda0a6db8e5b5fb32816199e3b4d3fea622238d53d12e381f0a3beaa66d155f992b8471028f6dffd50b8383f7bb6679c1eda380cf13c562168b527fe681f68417a998058f2d869628fad76d5b53d9013005d4a8c618f2ce09d8115360482c8ef759a53901fe7ad7d6f0e5daf0c03ef44272567e172d7292542fae3d792d535f4437498f9425e4975a39afee9d13da7f9a0f823289e0e890d963a98e6accb28699f8a4a3839143dcbe308b4d8676ab3239758a20dbe7bd92d4b9c165591af01d1b8d15290b97306b15f7e9bc6da4f4037f554b5bf2854cf6987d39c93de90811c2c00d23e00a91de31b0ad5ce33cfbd851d3c6fee63875bc519debff66886941957e66e06e8e82b56d1e0ac2c8e657d1072171ac857c6912fb1de7fbd172fd2d5cadf934897e4c728e5429a987701414b2f3036f70e4647551cb1adb494f439c5887509f5b7d5e39623d76c25b462739ba074a6227852e3d5fda8a09b2d31e8a82408623174f3e15a761b38921df7f99db63ad4f2e3eb817c3293ad3aa9c139edaaaf7167d0c6e3beac67e63775b2405f78c9756afcc7044388056dbdfb3415795c2c9238f3188f238c2c018588d32886c08caeadf2e63f0eee738186ba6bb37ce9c3fcd75c508828c2a6a9ce5991159f2da749bd801d994ab89bd739ef60dc0d5bdfac2011e74e8ea96dc9239449a7454ccb6ef0d2e62aa5e88258ea8049ad730a9301567b5bf143233830963cd2a15a6b803c3bb5e37f808f9bf8e899d24bef63cb53b0ab9d0f8c5f1a82d5652c766e03487aafa01619bdbf67dcc0ff7e5ef9c83da5c055b25c11d6e489ac868a8072fd6dcb0d52488c60620f216cbce46b96a126ae9c5699dbae188695b00754e0fb9b0c3f4bb4983c3a9c95f8051ba4d4bde76176dc9ccd8d5b41e91f5f901c1966f0d3d9310c20139558fded62ef32cd9d37a6d0d036226a4a6887001a1c6750a8a81176b01af61ee4ce343bdb35e2d1a39cf782b0bd58df448fe4bc6d8e120d9b08c7481ad58cfb4be8de6ce0f3c95b9bc583600f9a8d8dbacfdb612c64bff838e5a32500fd4cd00bacc956bffc39ffe63be6ff00beb5386ad3668fd7d251e5f4598abfa40622cf7b9a1d2cef3a657f4bfb0b90e97cb6bffbb8c8c843dbda5a6016c709fb9062097dcca8896d8266f3651c220f1426c16e4be087bdb6b2e4c74829e559d713431386a34608c774cf9274995f351851568ab7bded6834b00e1d8e0471b438bdfae3bed1cc7327344dff3694374beb97750b15e70b8fa3ec0b024ef7b8e6260677ad12788f472a5f69739952a69490697d15e161d37fef4991cbff9385649cba72571f859b51e7d6dcb045b55d9261fe6c2b65ebe3f454bd2a8756425158a67b28301fcce6e3f5569645273170a21b3f00eea52795c907092cae3d66f96c12e44624b7ffbed023e47fffc073e9689dee9386071d0789f55a6ee047853c50e4f2527470536294469496cbaf76fd2c6ef81343f18bbfb4bb9a3d0271a4b67008b8e3c80556397437ade42bc37f243ccba7306b1f1b0096fa24a3e2f62ecba57b65b429f58b9c801b190bb4f92399e8440f239e695f5b02ebedac6a087539857c95f72632913c336747ad53477f8b795588682fc76bdd54b3a4aece39edda35aeba0c2180574b2b4b5a99a6f5aa1d3aae818ac83d73269e9b5563df3995217412db0c03de31db7847553457ceb4c72a4ff7c8601268dc78f34ec01f10fb2bdcf015cb976cdc26481ae99280b0830afa5825ec83ba1e8151ce4bd838c28f633ab466cca216910812aff13c7611ff3f2bc639a2b1dd6a118fa502ec4ff83e000ab674a126c1231b2f46be3bb62c300fda5dd84ea3edf7db3ff23f2d00be7481418b7e0b795adc355a4c894de7d00a1af2c09155304e5a48b40da4a54d16d8533bcbc1601cb961e2fc8486ec58937bd92cf647bed85bcc43ade400f02b45495b092fad3cf3185115534973d9b6166cc45570f3a963133916668effe98004718996e6cf0613455a6d612262cdca702f82413ccee6e23dc9c3735060f07635143ee024bc82067aa304c5bc36eb200b54708b91ef1f13f05aaf44754de2d0091c36d47f777513ed9d3f12086a9b0c984793c30ec8e5881dafd5af3bd29499fb346d45cb5e28343d802245d2df1328387a308d9f1ed7f5a6af521f72d3c00a89d5c213bea9231cdf900172a4b8207c3703ad29c327c0f179c6696fbdf0b8b057f09d032748f6b174d254d7412cf3217284a03090f18125839ccdcd4fa540c7ef554f8a5eb8a61db1a5972659f45a2a49780f2d10b72b53762652305d308493175c3eff6988def1e629b472a2c6db2ab6ef9760cfc92a43c631dd89258e6976ba92b8ab0102ee65cd32736b4619c614d799da36d87dd19e5bc77062dd982aad8196a928127f2073aae08559a01e357c56938a212d684bed22c0ca05c04c96582c5b5499572084cb1298c25624a925938ef6aa8572dfc96f8a86a0ee04f8519cc59bd7b7303b16c69a300ee30dd6d2fe497cecbec05acf703bbcffa7cabd9ac87fd4ec09de825e6ef6f3eefba75332eb980792d089847b67bbeab4fb373f77fd24ee430de8f071886e36e15a8eb60100f40a185bf2c6f5284b0927a20e08784fd95e13a8046af32843665d03b3d943cc6752a75172895bf9562e811931b89f4589cc09da23c6088e700adcd0b14be505c95dc44de96a8e4698f8f838fc00c6e9826e11e09795d9c3f8385158c48ff212e7fbcd5105cd5ae97d94bbb2d316221161a1ea0c7a3452bba68a0325fd8e92d7deb955895f3802685a7e06eff8b354e29857d3db13f2259e22c7b33f69538988a64e722b86bddfdd8584bd50962d89a6a22767ba3588fafb96d7f104de7b3155602e4af7c9d2e08bd59fab727a7d738d75f8057c6063e75c5121f58642e3a551d9963f2dff362202bc7e3be19070f1ca14bdba38d6ec1dd85e32ddcd5eba48c877353dfcaf66fd0e706ed8dba3b7775d7385049f30bd6aadd6c9569f10c723a1193ab0af605305c4d7cf54b27dd5e0d127eba1c76e771203a0f6f7ca542cd3e5950d34a35e3119bffc415fc2351b1bf718b7a1ac67b3fc7378238bc69eac1307e2c261956ee094a76fb769aff0478bb0e89569eac8e6d37ffefb2d85093c61b8d2e04d50f5c9ccaf921f7caa48b4d9a7ae008166d002e693395f3e3a2816358c3b837c2549d1c8b241f9abafe435a646d79db04a1d41ba392af7e3c765401f29952ace4087a7808ad2ef0bf1f71bdb238a2c464b3cb16ddc9e7f867ba86a79dbe29b42f95adb082439c290465b16f8616023fed8727efb6415f1a776962763e9226754276de9b93532f642a0971f58d28d12572ec734d0e627eb0f0b00353f0b1300ff60a0e6d9fc00cdc3a5f9de1bc1115dbe0d91ed505e45653e4336282d9de073a4c97d9c898e76230e81768fb1cb105b9d15735f5cc09aedcbaa7ab3cb585a87082089bf8795d4e13982a88949e16b202f896bd74c7c6f6b12da19eb6d8fe3d36d29aa9b180139d4f3fe8a8b3aff06ae7808fe1c6157c210b31d204a5a1e5c1ac35083073ff9cd132494c8ad0a750b65a359a8315f80e2d728005a194929f070c6ccad426a1447e984fc6f92d0e7f14c63e37c67f4fe417e4503b57b2b305590400334427b2a2d0aa81b58b83718ff5e3a491dcba559ac06b62e13dab010c8644b8784cf87a0bee5045fb9e7fb2f7b00b160be54448b2916564b25d3f9c8c51718e13a3854217a8e02c82f65d59a79fc75c19f295932715df6678d58a944aa2034062fa1595aca64313eaf14c70fe65cccec8aa929f45e33a5e35997dd4f67e1cae69aa7b69b106bb8215a1189ccd6f4196c8d44310673600400c0b8c980ca80c", "bt": "libjavacrypto.so!0x38c48 <- libart.so!0x13ded8 <- libart.so!0x1347ec <- libart.so!0x1a9a98 <- libart.so!0x31b110 <- libart.so!0x3124fc <- libart.so!0x685858 <- libart.so!0x12ec98 <- libart.so!0x67f940 <- libart.so!0x12e818"} +{"event": "co-done", "n": 0, "regions": 5} diff --git a/tools/frida/capture_20260829_064937.jsonl b/tools/frida/capture_20260829_064937.jsonl new file mode 100644 index 0000000..d82de56 --- /dev/null +++ b/tools/frida/capture_20260829_064937.jsonl @@ -0,0 +1,33 @@ +{"event": "ssl-hooked", "module": "libjavacrypto.so"} +{"event": "ssl-hooked", "module": "libssl.so"} +{"event": "ssl-hooked", "module": "libhyssl.so"} +{"event": "ssl-hooked", "module": "libmarsstn.so"} +{"event": "ssl-hooked", "module": "libhyquic.so"} +{"event": "ssl-hooked", "module": "libngtcp2_crypto_boringssl.so"} +{"event": "ssl-hooked", "module": "libposix_quic_ngtcp.so"} +{"event": "ssl-hooked", "module": "libhysignalcore.so"} +{"event": "ssl-hooked", "module": "libhymediatrans.so"} +{"event": "ssl-hooked", "module": "libYCloudLive.so"} +{"event": "ssl-hooked", "module": "libhydt.so"} +{"event": "ssl-heartbeat", "module": "libhydt.so", "writes": 40} +{"event": "ssl-heartbeat", "module": "libngtcp2_crypto_boringssl.so", "writes": 80} +{"event": "ssl-heartbeat", "module": "libngtcp2_crypto_boringssl.so", "writes": 120} +{"event": "ssl-heartbeat", "module": "libhysignalcore.so", "writes": 160} +{"event": "ssl-heartbeat", "module": "libhyssl.so", "writes": 200} +{"event": "ssl-heartbeat", "module": "libposix_quic_ngtcp.so", "writes": 240} +{"event": "ssl-heartbeat", "module": "libhydt.so", "writes": 280} +{"event": "ssl-heartbeat", "module": "libngtcp2_crypto_boringssl.so", "writes": 320} +{"event": "ssl-heartbeat", "module": "libhysignalcore.so", "writes": 360} +{"event": "ssl-heartbeat", "module": "libhyssl.so", "writes": 400} +{"event": "ssl-heartbeat", "module": "libssl.so", "writes": 440} +{"event": "ssl-heartbeat", "module": "libposix_quic_ngtcp.so", "writes": 480} +{"event": "ssl-heartbeat", "module": "libngtcp2_crypto_boringssl.so", "writes": 520} +{"event": "ssl-heartbeat", "module": "libYCloudLive.so", "writes": 560} +{"event": "ssl-heartbeat", "module": "libhyquic.so", "writes": 600} +{"event": "ssl-heartbeat", "module": "libhysignalcore.so", "writes": 640} +{"event": "ssl-heartbeat", "module": "libYCloudLive.so", "writes": 680} +{"event": "ssl-heartbeat", "module": "libhyquic.so", "writes": 720} +{"event": "ssl-heartbeat", "module": "libposix_quic_ngtcp.so", "writes": 760} +{"event": "ssl-heartbeat", "module": "libngtcp2_crypto_boringssl.so", "writes": 800} +{"event": "str-magic", "module": "libjavacrypto.so", "num": 4286, "full": "504f5354202f20485454502f312e310d0a692d7665723a20310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6f637465742d73747265616d0d0a436f6e74656e742d4c656e6774683a20343039390d0a486f73743a2077736170692e687579612e636f6d0d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a557365722d4167656e743a206f6b687474702f332e31342e390d0a0d0a0000100310032c3c4c560c68757961756462776562756966096466705265706f72747d00010fd70800010604745265711d00010fc90a06001607616e64726f69642d00010fb3571882cf664bb39401ee7cda1169c9f5289c4d46a1de05113f9b97c67c5fb2479793b015b30011a6c902e7a242e7c820696569724b2704f5547cf7849d70c4ed381b0616447fe6b315952f42dca1045051950db3e43d524cf71f79ff4ec0c8f6f1afb082e6571f28f28edcddb1635eecd613b101bad7df31fdf773783179b3b8da919c7e0a21b0eaec1ff719d052dd17e9b87e4b2f7cac54f36d97ff8fca512c359b2c054c463b72b0b509a17c92e04d39e2c6261b2175d8ae54901db050e79145cd7baa11a07e978c5f394cafdeef8c81063822846e7ec38177f5cd791610bf11070a5322ad7be77ee38f43573df6bdacc6ab5292d68c0374e2ec6147132881c630d675ed2dd971a411a5cd52b9ef1568c13cef2ecfc7eff0b943c608d8a7b529756ffe33000b79643314f2b8d10391c1760da7ac1ab838a3bcc60409650b086e3900d0ea8257e22b72c4f27fedc4e97a9451c0dbde3ba6022161db2e6712df34fe9aee9e316ac1e483b903841222d8d5de2d861d90b877d5d76cdf79d4fef0bb7826d6409e08c91164c64ae5b4ea5bf3efadd006c719bf54a6c62a5c6f04a3f183d123f2a0deb26bbfad8bfc534abaa075a68f39360b896a90d75ca77191e9884ba2a567b5855c0e9802fcfc2bcc37b3443fa469e20806853f9a3567171e378220a7b15dc7c10244fea46d39735c8e8c79511e22eef2a091ed467ea48774292fba2f7122fdab431150cf27207665fe1842f44b93e37649f3fed2595aec109852dc9283e0dcd68865e74bf8bd44789aade35ef7448aa2a20e7d7401445ac443820023bc46a0225afc63068bff007b7418b3efee3b5f5bc86bae31a8fd1dda0e5dd8c1ad37c9736ea0787dfcccce1fd1f0c5346bb71a11f7e2e8139f5b4cff10056caeeee18954045f54f687a1b64407ea8fb1f6c8907f7429b1244b3d0766866cc620e8d2164f6a291ff5730adf5d6ee085b0961b05d8a3c0d32e69d372eede6d5f1f8fa98df3a43949e43450b52271540831bda33e9c493e23842ec58e351f86219aaa90d37afd8951cd81f9c8c41e8f6ccd67cbf158407406abc88d321fdc9c81e4ace91fcb37b32ddf47d9ed1baab3d3cbb3e8c69afaef2166452c5b13ee7b16a8ca6cba69b1b24f810e6392e446a54a53627c6737a9dc56a49fad209c3663aca1d5946e17e2cd98b9ebed86ac86ff336051d0c70432a91e6c09fa6266a43a74ea8588b46db4fe356f0863f146a955a8b197d0d606fc85b43371bcd41b6944f3b0ed9d6898aa2eddd5774375d0b3c89ee9bdf837837a72acfecad9fa03d408d094e01f71fa8be8babfc8041cb95d1464fb160f0ee3af9ce6f50bfcd8b9b4239cea3311e4baf54b33e8e8526211e82a27fbf01900e91b1f03731aff16b5b0f0d67ddd9bfbceb274496b504d4c4511a5d6abfa7400d8d9681e57fb81da687e3e6e815785dbfb26a7d963ce63da1176754b47be10f953ffce9e3d6b87bef4bed96571d8b07b173d4558c7a4b9d9ecd27b0e32dc8dde7d325ba978b8083dd1cd9cda701e581a824eae5dbe114321655f24789b9aa0a664ea6d9e4ad00a3d6b0018d324998ae96a360ac6308d05987123b63e3888ad16b085babae4e2955e3a3b892d8903fadd8cc5963240e6c2ba25850f956d33f8d033cf4dcb7b74a7c80f4b4286e7de439fa1eb9b332b7e8530ff8fa6ae259c766c93363006b1ec069a064fa2a08e5d4d92362937f2e9f5edcb3c166799048699ed73767ef98a75858ea9d4d0d40b7a27046758e38a8f1f35c0d0e9960f4e1f4e53c0b45a3ebd764e427f57753b462667c7ace98185e65021e01a47f4646d4489d933293d08c4a60737fc526ff8c9df329fd87d4cb3669e3a0e7acef6086a51b843989549bdae9e999fe7a1c5fcee6f166d9b9dd9c7a26d1659220defdeac0c00a13f682a5374bf88edff5133f165845763735027a5ebd7f21aa586001431ca8c717a24c2e140469157e8434f9f88fb0105132fc78d7ec5a72a4115e5dabf741635243436e687b3074bdb600047ff0ce3181ea4df4eed3f598af225e5aac97f12954b5b2c137f32f39a7ab9b88b5f445a2d113d3daba8ffc6cfed80ad8b1e23c557ba85bf0dea7ed03206fbdc404083b1ad7df9ccf3427a7e9d81a30d836335b2259542e13a0a6ab200dd120bfb76412e845881358f639241a9313a77c6e45977009c559edea6f5b732fdca21eb2388d79dc48c5616ccbd817d346b4f39a3eabaccbf694dc618e2b3aad39047b653a0c6afb833da8fb91dfa5fb53cb96266d7b76d31a37451eff4d3c5c844e3777d02994531243a40cf2ff8efbb3c54fd90c20b3fada195a1de88319160faab677d27c5e7ff67d8f4d79029b89e033f35383831ed7526630c714bc18f00a17e8f2b2f4e7d9b017a65838f2dfb1c9faa69ad2eaa11452cf67c51b8443ce0b49afbd001f31fade971f237351b8a801db3b0ca2c2052d718aa76fa9dcab1a629e69e56ce525727b9afaf7b6b35b6c16137bc6d2553b0c9bee3821ca5a1317f132ba83bb8c24bd750684910078afa37bbbb7f55374e46777a3d8ff2adf1e7b4176a77366ac9fd4310cbe5fe4f7d6bc8ea8e302ce864a85f15c1def6669705ec60784d666047d2d17cde379b8858c22efb22f2feb23bedbd3ac3c4e9b8dc0a563b15fa098ba9f5fece6d6c1d6661dc8c7ac55ef401105721a6d08e56430527e7f61df76016dff869bbce1fc8a65e8c831102e547fdba20aa669b5e282eef75797146b7a7df550c04dd160c7434c9857506e633a22997ee38fd9d9161ad03a754c8efc3fcb96a3192eba946edc1de4f1fb21daa6d1550107bc7d07029d714f1438aadba48763bcc455f785b06804b241da15f55502b88fb37d7731000042fa2317a1b2c53d3d1e09cf8a2976bde63cb2363cd5c47e975dd0e8ee2d4aba4d8347d8a5c635739fcaf3018ab65c02e083d0c04bd140ffa0c500050f6f5b678eda74f33ed47c86117526bf81d19ced47c3dfe7482d079253858653feda2593b725cad1612725cfda94a977f2fb8bd7f4885c70583d0269ea30d5ca75edb662698b3792ff6979204d47ebb49979550923cbf414c45b87c6d5d74616d7fb33d5f656064fae252c985010825d791adf1b7070e9909c53d4df880b9aafdca6ea191f57c3a807faa0536f1a6c5687abff9d825f889ef2051d36acbc0872a88e9c35b09523da4867acb30691b0db8ba4bbffee8ffb55b96656fcfacc9498fc0bdff5c90bc8f741117f6d4239258efc14a423cee18d932828a6ec9130be295a77ed30d99a7114b3c33ae44c6af554b65dedc10dd0758678d36e1dec0bbc893bac5f5cf229fb7ba1dd9742c1333d46aec8a1bf1e8b492f7e494b778614c7428b57fcdce23ca8107b85902a958e700ae37e4823ab71ae754f59b71c3f6aee8ccdcc024a090c66be3ddefcca80524820ffab1e85f4d4be15e15a1bba5cf19d44ccaaacd88039a104bc8372ecd1b18db48042432b5740461f2055bf066f564cc4761c1316cbfacecf62e19b5d38ee4dfbb910a956619661df645c85ce84013f67299b14cf784d494344eceb651ed45057aa62d90683b171ab38165091b00b89adedfad1f1f44be6677a4aa89fc50bb8b99fb15bedbc1e40a7c5f76d1218fef53b863b0c1e1e4841cad4419af95a9736b420780b47e8c5ba24c5e837eb4705567760a476928c443496fd2a6f27789476e56202b4ab08d56c177948992a2a311999b9b93f9499301b7e7aeefe8604f1a205d77958b6fa0d728de4b0e7c5c66489106f142f04ff591d8e56ba07fa6985cd8632c64ddeca4a19c5b9ef4875dba37a34fcb61fa34a8c4bde907559410f10c24739c3bc37ee3921f23ca2ec1b61a66b38dd6c3378cbd2302dfd11a474cf918637b7f1a567e6bb6dc88c48ac84971b045f50679855b04f0214513b771ab19c580bab53a1c07629d46e3716239f94ddb10ec5c8519184b369f272b7d857a2755355725fc2c72a1cdd7da314e2c421d0e8030fcc96b9fe7152ed4663881187347c90224262dc96b2041284fa072703480af05a749633b30d2e62bada0a1b393e06896aea9391a8df64c42db3f705b51782aaea57f6b6b091e311eb4aa5e75efbddd1d644a0ddf4cd32daaa6de7bed1a62061e4e6baaaed8683544b1d18c73aa5a023996a5325cc0d4bf4df7bc3bb78c0adbb71c5d94d22e7bc7819ee9a89b17b70dae31ae37ba0a6fbff6cb78689807343dde8de557b371846c4f2d4778979c5d1966a64d375a9c90567ffdefe21b27087537aac02b96a88958e2e1b64615ac7602f886b5d6c6f10eaa8d38e5a5bc26422dd5b742c8196af07c6198cc8b940acf63d81e0c33fa6b4093f38d7e927b6f8abaa6636cc0752cde577fe3fa2e4f7d4eefb7a4a20362014f5fe40b5654e744c173954c5c0222af2a5b2a1cb6f80966554c50ec518bc6eaca3466b0ea9e93a936413cee974dc00f6947e5c738efddf3534275535bc0f7488c3a91ad5ae70d6127b5a19c8ced18eefe783358b324b5d8f14f2614f7bc9c4c187d669c7b1a747909a961189faf6e4ee93d7a1c938a02240f76682f5b3ac14cd9c378383545d9da6f738f3c624f7b8db33a4483442ff64ce3b212053b861b9acfd3ee626645f8a75479414f0716bfac7860b2654fbfc6e5290c284ea8b35f6c8a1efbfe330e34fe2bf5cc2464bbb2624dfa5be511347c46a9095c6d5b9beb9c2f00811d8135ebbd86d4ad262ff6c7b58efc6c421266d6d6cbafc0da1413874524a6367828633521e29e3bbc5ceebf0610ca291c6f44c6cc1f70d4e4677c5f78612da8f18a06a1c74267afc0c0afbb2addd455844d2ec5b15015f4b0501fd682415c6cc030d56a2b2e52c46ba8854c23a479c8d26fe898af3b0a5e36f864d00b280533355d573cfebb9c1856a9e464ef3ca60d123dfb56ec86b1892e31b40fdaf05f85d3b57fffa0da2b1bb114e8a9b498ecc1a520e8a740ebf17d167503f529e1b3e0205930ec354be886d4be1d3198956563f0523a7c17a1da663bef257cca7472b629331620d19e4af1d8c98e9a42fa763073ad22f5be425eb2643e512de1f2a51596cee9f6d208399793558d8d82a17f597a78a67aefc22fb1c311ac25ab94d37f4e39a066ec3198eb3dc2b32499d968db6b33e21e24e646219198d8bf0bfbc255b2245094cc07b833fd81840b762a7cc8bb5bdfdaf1949556fdb008df72e754e5346dc9da13cadde6acbea5747644dc5dde6c8a098f7bb8f4e453a737ce7e0d0df6f02fd4e2a321a44aac53bc1dde34ed156b7f171ef8f78177eab98f15e9da35ff7575f2bc44ffc59b87a8eec5e641885a3bd693f676489853de495c3084542476140d0238734c6434cd87fd63175e9058dbae2f3fd435808eb46349d3a01358ef9558a4429d766af316ab27b5856e4d70e8a01c418646091621722618148b15507e63e434d23634e32efc945e07ceb919a25e35776647b400d6bf36cc72b4b745d57440833a94bc9ebd78d65923aa76126796057c063885f65f986058f09d7a4b6e865c01ebd75fcc312bd391ca54eb6fb8101bded18d7576695bfdddf49ba4dbf44882b3b3a8d4a380854040e3a0998de2ac9a40dcd78d01ad0bc62604b374233efdbde9a9f253e069c88420e6e3b92f3c14c724048598f0c042e8e576e347994c333600400c0b8c980ca80c", "bt": "libjavacrypto.so!0x38c48 <- libart.so!0x13ded8 <- libart.so!0x1347ec <- libart.so!0x1a9a98 <- libart.so!0x31b110 <- libart.so!0x3124fc <- libart.so!0x685858 <- libart.so!0x12ec98 <- libart.so!0x67f940 <- libart.so!0x12e818 <- libart.so!0x681fbc <- libart.so!0x12e918 <- libart.so!0x681fbc <- libart.so!0x12e918 <- libart.so!0x308a38 <- libart.so!0x66e3a8"} +{"event": "co-done", "n": 0, "regions": 6} diff --git a/tools/frida/hook_dual.js b/tools/frida/hook_dual.js new file mode 100644 index 0000000..a3301a6 --- /dev/null +++ b/tools/frida/hook_dual.js @@ -0,0 +1,77 @@ +'use strict'; +function emit(row) { try { send(row); } catch (e) {} } +function btOk(ctx) { try { return Thread.backtrace(ctx, Backtracer.ACCURATE).slice(0, 10).map(a => { const m = Process.findModuleByAddress(a); return m ? m.name + '!' + a.sub(m.base) : a.toString(); }).join(' <- '); } catch (e) { return ''; } } +const PREF = [0x57, 0x18, 0x82, 0xcf]; +let fired = false; +function hexOfBytes(arr, max) { try { return Array.from(Java.array('byte', arr).slice(0, max || 96)).map(b => (b & 0xff).toString(16).padStart(2, '0')).join(''); } catch (e) { return ''; } } +// ===== SSL_write magic ===== +for (const mod of Process.enumerateModules()) { + let addr = null; + try { addr = mod.getExportByName('SSL_write'); } catch (e) {} + if (addr === null) continue; + Interceptor.attach(addr, { + onEnter(args) { + if (fired) return; + const buf = args[1], num = args[2].toInt32(); + if (num < 40) return; + try { + const u = new Uint8Array(buf.readByteArray(Math.min(num, 20000))); + for (let i = 0; i + 4 < u.length; i++) { + if (u[i] === PREF[0] && u[i+1] === PREF[1] && u[i+2] === PREF[2] && u[i+3] === PREF[3]) { + fired = true; + const n = Math.min(num, 20000); + const hex = Array.from(new Uint8Array(buf.readByteArray(n))).map(x => x.toString(16).padStart(2, '0')).join(''); + emit({ event: 'ssl-magic', module: mod.name, num, off: i, full: hex, bt: btOk(this.context) }); + return; + } + } + } catch (e) {} + }, + }); +} +// ===== turing encrypt bridge ===== +setTimeout(() => { + try { + Java.perform(() => { + const targets = [ + { cls: 'com.tencent.turingfd.sdk.ams.ga.native', methods: ['a'] }, + { cls: 'com.tencent.turingfd.sdk.ams.ga.TNative$aa', methods: ['k209202_2A742FA224BA8A2A', 'k87_D2D99D56FECC73FD'] }, + { cls: 'com.tencent.turingfd.sdk.ams.ga.Seedless', methods: ['getAIDCode', 'getAIDTicket'] }, + ]; + let hooked = 0; + for (const t of targets) { + let K = null; + try { K = Java.use(t.cls); } catch (e) { continue; } + for (const mn of t.methods) { + try { + K[mn].overloads.forEach(ov => { + ov.implementation = function () { + try { + const args = Array.from(arguments).map((a, ix) => { + try { + if (a === null || a === undefined) return String(a); + if (ov.argumentTypes[ix] && ov.argumentTypes[ix].className === 'byte[]') return 'byte[' + Java.array('byte', a).length + ']:' + hexOfBytes(a, 80); + const s = String(a); + return s.length > 160 ? s.slice(0, 80) + '…(' + s.length + ')' : s; + } catch (e2) { return ''; } + }); + emit({ event: 'turing-enc', cls: t.cls, method: mn, phase: 'enter', args: args.slice(0, 4) }); + } catch (e3) {} + const r = ov.apply(this, arguments); + try { + if (r !== null && r !== undefined) { + if (r instanceof Java.use('byte[]')) emit({ event: 'turing-enc', cls: t.cls, method: mn, phase: 'leave', ret: 'byte[' + Java.array('byte', r).length + ']:' + hexOfBytes(r, 100) }); + else { const s = String(r); emit({ event: 'turing-enc', cls: t.cls, method: mn, phase: 'leave', ret: s.length > 160 ? s.slice(0, 80) + '…(' + s.length + ')' : s }); } + } + } catch (e4) {} + return r; + }; + hooked++; + }); + } catch (e5) {} + } + } + emit({ event: 'turing-enc-hooks', n: hooked }); + }); + } catch (e) { emit({ event: 'turing-enc-err', msg: String(e).slice(0, 160) }); } +}, 2500); diff --git a/tools/frida/hook_dump_magic.js b/tools/frida/hook_dump_magic.js new file mode 100644 index 0000000..52b30d8 --- /dev/null +++ b/tools/frida/hook_dump_magic.js @@ -0,0 +1,67 @@ +'use strict'; +function emit(row) { try { send(row); } catch (e) {} } +function btOk(ctx) { try { return Thread.backtrace(ctx, Backtracer.ACCURATE).slice(0, 10).map(a => { const m = Process.findModuleByAddress(a); return m ? m.name + '!' + a.sub(m.base) : a.toString(); }).join(' <- '); } catch (e) { return ''; } } +const MAGIC = new Uint8Array([0x57, 0x18, 0x82, 0xcf, 0x66, 0x4b, 0xb3, 0x94, 0x01, 0xee]); +let done = false; +function scanAndDump(p, n) { + const hits = []; + try { + const u = new Uint8Array(p.readByteArray(n)); + for (let i = 0; i + 10 < n; i++) { + let ok = true; + for (let j = 0; j < 10; j++) if (u[i+j] !== MAGIC[j]) { ok = false; break; } + if (ok) hits.push(i); + } + } catch (e) {} + return hits; +} +for (const mod of Process.enumerateModules()) { + let addr = null; + try { addr = mod.getExportByName('SSL_write'); } catch (e) {} + if (addr === null) continue; + Interceptor.attach(addr, { + onEnter(args) { + if (done) return; + const buf = args[1], num = args[2].toInt32(); + if (num < 40) return; + try { + const head = new Uint8Array(buf.readByteArray(Math.min(num, 60))); + let hit = -1; + for (let i = 0; i + 10 < head.length; i++) { + let ok = true; + for (let j = 0; j < 10; j++) if (head[i+j] !== MAGIC[j]) { ok = false; break; } + if (ok) { hit = i; break; } + } + if (hit < 0) return; + done = true; + // 1) full ssl buffer + const n = Math.min(num, 20000); + const hex = Array.from(new Uint8Array(buf.readByteArray(n))).map(x => x.toString(16).padStart(2, '0')).join(''); + emit({ event: 'magic-dump', stage: 'ssl', module: mod.name, num, full: hex, bt: btOk(this.context) }); + // 2) co-located: scan the turing modules + a few anonymous big regions for other magic instances + ascii around + setTimeout(() => { + try { + const tg = ['libturingga.so', 'libturingmfa.so', 'libudbauthunify.so', 'libturingsdk']; + for (const m of Process.enumerateModules()) { + if (!tg.some(t => m.name.indexOf(t) >= 0)) continue; + const hits = scanAndDump(m.base, Math.min(m.size, 4096 * 1024)); + for (const off of hits.slice(0, 20)) { + const at = m.base.add(off); + const pre = Array.from(new Uint8Array(at.readByteArray(64))).map(x => x.toString(16).padStart(2, '0')).join(''); + const around = []; + for (let k = -64; k < 2048; k += 64) { + try { + const chunk = Array.from(new Uint8Array(at.add(k).readByteArray(64))); + const s = chunk.map(c => (c >= 32 && c < 127) ? String.fromCharCode(c) : '.').join(''); + if (/[A-Za-z0-9_\-\.\/:]{12,}/.test(s)) around.push({ k, s }); + } catch (e) {} + } + emit({ event: 'magic-dump', stage: 'co-located', mod: m.name, off: '0x' + off.toString(16), pre, around: around.slice(0, 12) }); + } + } + } catch (e) { emit({ event: 'magic-dump', stage: 'co-err', msg: String(e).slice(0, 120) }); } + }, 0); + } catch (e) {} + }, + }); +} diff --git a/tools/frida/hook_str_magic.js b/tools/frida/hook_str_magic.js new file mode 100644 index 0000000..3550955 --- /dev/null +++ b/tools/frida/hook_str_magic.js @@ -0,0 +1,70 @@ +'use strict'; +function emit(row) { try { send(row); } catch (e) {} } +function btOk(ctx) { try { return Thread.backtrace(ctx, Backtracer.ACCURATE).slice(0, 40).map(a => { const m = Process.findModuleByAddress(a); return m ? m.name + '!' + a.sub(m.base) : a.toString(); }).join(' <- '); } catch (e) { return ''; } } +let fired = false, writes = 0; +for (const mod of Process.enumerateModules()) { + let addr = null; + try { addr = mod.getExportByName('SSL_write'); } catch (e) {} + if (addr === null) continue; + Interceptor.attach(addr, { + onEnter(args) { + writes++; + if (fired) return; + if (writes % 40 === 0) emit({ event: 'ssl-heartbeat', module: mod.name, writes }); + const buf = args[1], num = args[2].toInt32(); + if (num < 60) return; + try { + const u = new Uint8Array(buf.readByteArray(Math.min(num, 30000))); + // 编码成可检索串 (简化: 只查 ascii 子串) + let s = ''; + for (let i = 0; i < u.length; i++) s += (u[i] >= 32 && u[i] < 127) ? String.fromCharCode(u[i]) : '.'; + if (s.indexOf('dfpReport') < 0 && s.indexOf('hyudbwebuif') < 0) return; + fired = true; + const hex = Array.from(u).map(x => x.toString(16).padStart(2, '0')).join(''); + emit({ event: 'str-magic', module: mod.name, num, full: hex, bt: btOk(this.context) }); + // ---- co-located: 命中后立即在 turing 区域 + 全堆扫第二处魔数/明文特征 ---- + const MAG = [0x57, 0x18, 0x82, 0xcf, 0x66, 0x4b, 0xb3, 0x94, 0x01, 0xee]; + setTimeout(() => { + try { + const regions = []; + for (const m of Process.enumerateModules()) { + if (/turing|Turin/.test(m.name)) regions.push({ name: m.name, p: m.base, n: Math.min(m.size, 2 * 1024 * 1024) }); + } + // 附加: 加载库里的映射区域 (含 .turing.dat mmap) — 用 Process.enumerateRanges 'r--' 太广, 只挑 map 文件路径含 turing 的 + for (const r of Process.enumerateRanges('r--')) { + try { + const f = r.file ? r.file.path : ''; + if (/turing|\.dat/.test(f) && !/\.so/.test(f)) regions.push({ name: f.slice(-40), p: r.base, n: Math.min(r.size, 512 * 1024) }); + } catch (e) {} + } + let nFound = 0; + for (const rg of regions) { + try { + const buf = new Uint8Array(rg.p.readByteArray(rg.n)); + for (let i = 0; i + 10 < rg.n; i++) { + let ok = true; + for (let j = 0; j < 10; j++) if (buf[i+j] !== MAG[j]) { ok = false; break; } + if (!ok) continue; + nFound++; + if (nFound > 12) break; + // 邻域 ASCII 提取 + const as = []; + for (let k = -128; k < 1024; k += 64) { + try { + const c = Array.from(new Uint8Array(rg.p.add(i + k).readByteArray(64))); + const str = c.map(x => (x >= 32 && x < 127) ? String.fromCharCode(x) : '.').join(''); + if (/[A-Za-z0-9_\-\.\/:]{10,}/.test(str)) as.push({ k, s: str }); + } catch (e) {} + } + emit({ event: 'co-magic', mod: rg.name, off: '0x' + i.toString(16), ascii: as.slice(0, 10) }); + } + } catch (e) {} + } + emit({ event: 'co-done', n: nFound, regions: regions.length }); + } catch (e) { emit({ event: 'co-err', msg: String(e).slice(0, 120) }); } + }, 0); + } catch (e) {} + }, + }); + emit({ event: 'ssl-hooked', module: mod.name }); +} diff --git a/tools/frida/hook_turing_enc.js b/tools/frida/hook_turing_enc.js new file mode 100644 index 0000000..3c7dfc7 --- /dev/null +++ b/tools/frida/hook_turing_enc.js @@ -0,0 +1,53 @@ +'use strict'; +function emit(row) { try { send(row); } catch (e) {} } +function hexOfBytes(arr, max) { + try { return Array.from(Java.array('byte', arr).slice(0, max || 96)).map(b => (b & 0xff).toString(16).padStart(2, '0')).join(''); } catch (e) { return ''; } +} +setTimeout(() => { + try { + Java.perform(() => { + const targets = [ + { cls: 'com.tencent.turingfd.sdk.ams.ga.native', methods: ['a'] }, + { cls: 'com.tencent.turingfd.sdk.ams.ga.TNative$aa', methods: ['k209202_2A742FA224BA8A2A', 'k87_D2D99D56FECC73FD', 'b209202_2A742FA224BA8A2A', 'f209202_2A742FA224BA8A2A'] }, + { cls: 'com.tencent.turingfd.sdk.ams.ga.Seedless', methods: ['getAIDCode', 'getAIDTicket', 'getTAIDTicket', 'getOpenIdTicket'] }, + { cls: 'com.tencent.turingfd.sdk.ams.ga.ITuringDID', methods: ['getAIDCode', 'getAIDTicket'] }, + ]; + let hooked = 0; + for (const t of targets) { + let K = null; + try { K = Java.use(t.cls); } catch (e) { continue; } + for (const mn of t.methods) { + try { + K[mn].overloads.forEach(ov => { + ov.implementation = function () { + try { + const args = Array.from(arguments).map((a, ix) => { + try { + if (a === null || a === undefined) return String(a); + if (ov.argumentTypes[ix] && ov.argumentTypes[ix].className === 'byte[]') { + return 'byte[' + Java.array('byte', a).length + ']:' + hexOfBytes(a, 80); + } + const s = String(a); + return s.length > 160 ? s.slice(0, 80) + '…(' + s.length + ')' : s; + } catch (e2) { return ''; } + }); + emit({ event: 'turing-enc', cls: t.cls, method: mn, phase: 'enter', args: args.slice(0, 4) }); + } catch (e3) {} + const r = ov.apply(this, arguments); + try { + if (r !== null && r !== undefined) { + if (r instanceof Java.use('byte[]')) emit({ event: 'turing-enc', cls: t.cls, method: mn, phase: 'leave', ret: 'byte[' + Java.array('byte', r).length + ']:' + hexOfBytes(r, 96) }); + else { const s = String(r); emit({ event: 'turing-enc', cls: t.cls, method: mn, phase: 'leave', ret: s.length > 160 ? s.slice(0, 80) + '…(' + s.length + ')' : s }); } + } + } catch (e4) {} + return r; + }; + hooked++; + }); + } catch (e5) {} + } + } + emit({ event: 'turing-enc-hooks', n: hooked }); + }); + } catch (e) { emit({ event: 'turing-enc-err', msg: String(e).slice(0, 200) }); } +}, 3000); diff --git a/tools/frida/probe_turing_classes.js b/tools/frida/probe_turing_classes.js new file mode 100644 index 0000000..e596562 --- /dev/null +++ b/tools/frida/probe_turing_classes.js @@ -0,0 +1,32 @@ +'use strict'; +function emit(row) { try { send(row); } catch (e) {} } +setTimeout(() => { + try { + Java.perform(() => { + const hits = []; + Java.enumerateLoadedClasses({ + onMatch(name) { + if (/turing|Turing|turingfd|TuringFd/.test(name)) hits.push(name); + }, + onComplete() { + for (const cn of hits) { + try { + const K = Java.use(cn); + const ms = K.class.getDeclaredMethods(); + const sigs = []; + for (const m of ms) { + let ret = '?'; + try { ret = m.getReturnType().getName(); } catch (e) {} + const pts = Array.from(m.getParameterTypes()).map(t => { try { return t.getName(); } catch (e) { return '?'; } }); + const isNative = m.isNative ? 'N' : '-'; + sigs.push(isNative + ' ' + ret + ' ' + m.getName() + '(' + pts.join(',') + ')'); + } + emit({ event: 'turing-class', name: cn, methods: sigs.slice(0, 40) }); + } catch (e) {} + } + emit({ event: 'turing-count', n: hits.length }); + }, + }); + }); + } catch (e) { emit({ event: 'turing-err', msg: String(e).slice(0, 160) }); } +}, 3500);