feat(dfp): 🏆 dfpReport 加密完全攻破 — RC4+gzip, 12/12 密文解密+逐字节回验 (R35-R37)

2026-08-29 10:13:08 +08:00
parent 12fad07385
commit 4868a3b0e8
28 changed files with 4110 additions and 0 deletions
@@ -0,0 +1,80 @@
+// R37: 挂 libhydeviceid.so 加密调用链 — 抓加密函数的密钥/nonce 参数
+// 已知链 (R36 deflate bt): 0x57e7c(gzip包装) <- 0x58d38 <- 0x60e6c <- 0x5b1f4 <- 0x5a938 <- 0x20e924 <- JNI
+'use strict';
+function emit(o){ try{ send(o); }catch(e){} }
+function hexb(p,n){ try{ return Array.from(new Uint8Array(p.readByteArray(n))).map(b=>('0'+b.toString(16)).slice(-2)).join(''); }catch(e){ return ''; } }
+var HY = null;
+var events = 0;
+var MAX = 400;
+
+function dumpArgs(args, tag, ctx){
+  if (events >= MAX) return;
+  var row = {event:'call', fn:tag, args:[]};
+  for (var i=0;i<4;i++){
+    try {
+      var p = args[i];
+      var h = hexb(p, 48);
+      // 判定是否像指针指向数据
+      row.args.push({x:String(p), h: h});
+    } catch(e){ row.args.push({x:String(args[i]), h:''}); }
+  }
+  try {
+    row.bt = Thread.backtrace(ctx, Backtracer.ACCURATE).slice(0,12).map(function(a){
+      var m=Process.findModuleByAddress(a); return m? m.name+'!0x'+a.sub(m.base).toString(16) : a.toString();
+    });
+  } catch(e){}
+  events++;
+  emit(row);
+}
+
+function arm(){
+  if (HY) return true;
+  HY = Process.findModuleByName('libhydeviceid.so');
+  if (!HY) return false;
+  var offs = [0x57e7c, 0x58d38, 0x60e6c, 0x5b1f4, 0x5a938, 0x20e924];
+  for (var off of offs){
+    (function(off){
+      try {
+        Interceptor.attach(HY.base.add(off), {
+          onEnter(args){ this.tag='0x'+off.toString(16); this.on=true;
+            if (events < MAX) dumpArgs(args, this.tag+':e', this.context); },
+          onLeave(ret){
+            if (this.on && events < MAX){
+              events++;
+              emit({event:'ret', fn:this.tag, ret:String(ret), x0:String(this.context.x0), x1:String(this.context.x1)});
+            }
+          }
+        });
+      } catch(e){ emit({event:'hook-e', off:off, e:String(e).substring(0,120)}); }
+    })(off);
+  }
+  emit({event:'armed-hy'});
+  return true;
+}
+
+var poll = setInterval(function(){ if (arm()) clearInterval(poll); }, 150);
+
+// SSL_write: 同轮 wire 密文
+var done = false;
+for (var mod of Process.enumerateModules()){
+  var addr = null;
+  try { addr = mod.getExportByName('SSL_write'); } catch(e){}
+  if (!addr) continue;
+  Interceptor.attach(addr, {
+    onEnter(args){
+      if (done) return;
+      try {
+        var num = args[2].toInt32();
+        if (num < 60 || num > 60000) return;
+        var u = new Uint8Array(args[1].readByteArray(num));
+        var s = '';
+        for (var i=0;i<u.length;i++) s += (u[i]>=32 && u[i]<127) ? String.fromCharCode(u[i]) : '.';
+        if (s.indexOf('dfpReport') < 0) return;
+        done = true;
+        var hex = Array.prototype.map.call(u, function(x){return ('0'+x.toString(16)).slice(-2)}).join('');
+        emit({event:'post', num:num, hex:hex});
+      } catch(e){}
+    }
+  });
+}
+emit({event:'script-loaded'});