feat(huya): turing运行中dump工程化 (R20) — 串过滤100%命中+采样集7份

- hook_str_magic.js: dfpReport/hyudbwebuif字符串过滤替代魔数(不漏轮次) + 全量请求dump - 采样集: golden+f1..f4+新身份B(0647) — 新身份头12B=旧身份一致(nonce与身份无关) - nonce块: [7cda][版本][69c9f5][计数递增][稳定段] ; 运行时路线终态(Java桥/co-located/回溯全闭) - 触发-捕获-存档 ~40s/轮全自动; evidence/dfp_live/ 齐全
2026-08-29 06:50:34 +08:00
parent 0944e9c86b
commit 39c516b71b
17 changed files with 588 additions and 0 deletions
@@ -0,0 +1,70 @@
+'use strict';
+function emit(row) { try { send(row); } catch (e) {} }
+function btOk(ctx) { try { return Thread.backtrace(ctx, Backtracer.ACCURATE).slice(0, 40).map(a => { const m = Process.findModuleByAddress(a); return m ? m.name + '!' + a.sub(m.base) : a.toString(); }).join(' <- '); } catch (e) { return ''; } }
+let fired = false, writes = 0;
+for (const mod of Process.enumerateModules()) {
+  let addr = null;
+  try { addr = mod.getExportByName('SSL_write'); } catch (e) {}
+  if (addr === null) continue;
+  Interceptor.attach(addr, {
+    onEnter(args) {
+      writes++;
+      if (fired) return;
+      if (writes % 40 === 0) emit({ event: 'ssl-heartbeat', module: mod.name, writes });
+      const buf = args[1], num = args[2].toInt32();
+      if (num < 60) return;
+      try {
+        const u = new Uint8Array(buf.readByteArray(Math.min(num, 30000)));
+        // 编码成可检索串 (简化: 只查 ascii 子串)
+        let s = '';
+        for (let i = 0; i < u.length; i++) s += (u[i] >= 32 && u[i] < 127) ? String.fromCharCode(u[i]) : '.';
+        if (s.indexOf('dfpReport') < 0 && s.indexOf('hyudbwebuif') < 0) return;
+        fired = true;
+        const hex = Array.from(u).map(x => x.toString(16).padStart(2, '0')).join('');
+        emit({ event: 'str-magic', module: mod.name, num, full: hex, bt: btOk(this.context) });
+        // ---- co-located: 命中后立即在 turing 区域 + 全堆扫第二处魔数/明文特征 ----
+        const MAG = [0x57, 0x18, 0x82, 0xcf, 0x66, 0x4b, 0xb3, 0x94, 0x01, 0xee];
+        setTimeout(() => {
+          try {
+            const regions = [];
+            for (const m of Process.enumerateModules()) {
+              if (/turing|Turin/.test(m.name)) regions.push({ name: m.name, p: m.base, n: Math.min(m.size, 2 * 1024 * 1024) });
+            }
+            // 附加: 加载库里的映射区域 (含 .turing.dat mmap) — 用 Process.enumerateRanges 'r--' 太广, 只挑 map 文件路径含 turing 的
+            for (const r of Process.enumerateRanges('r--')) {
+              try {
+                const f = r.file ? r.file.path : '';
+                if (/turing|\.dat/.test(f) && !/\.so/.test(f)) regions.push({ name: f.slice(-40), p: r.base, n: Math.min(r.size, 512 * 1024) });
+              } catch (e) {}
+            }
+            let nFound = 0;
+            for (const rg of regions) {
+              try {
+                const buf = new Uint8Array(rg.p.readByteArray(rg.n));
+                for (let i = 0; i + 10 < rg.n; i++) {
+                  let ok = true;
+                  for (let j = 0; j < 10; j++) if (buf[i+j] !== MAG[j]) { ok = false; break; }
+                  if (!ok) continue;
+                  nFound++;
+                  if (nFound > 12) break;
+                  // 邻域 ASCII 提取
+                  const as = [];
+                  for (let k = -128; k < 1024; k += 64) {
+                    try {
+                      const c = Array.from(new Uint8Array(rg.p.add(i + k).readByteArray(64)));
+                      const str = c.map(x => (x >= 32 && x < 127) ? String.fromCharCode(x) : '.').join('');
+                      if (/[A-Za-z0-9_\-\.\/:]{10,}/.test(str)) as.push({ k, s: str });
+                    } catch (e) {}
+                  }
+                  emit({ event: 'co-magic', mod: rg.name, off: '0x' + i.toString(16), ascii: as.slice(0, 10) });
+                }
+              } catch (e) {}
+            }
+            emit({ event: 'co-done', n: nFound, regions: regions.length });
+          } catch (e) { emit({ event: 'co-err', msg: String(e).slice(0, 120) }); }
+        }, 0);
+      } catch (e) {}
+    },
+  });
+  emit({ event: 'ssl-hooked', module: mod.name });
+}