docs(huya): 模拟器存活闪退诊断报告与 Frida 探测脚本证据
- 诊断报告: attach 主进程静默退出/EGL 崩溃, 仅约 4s 窗口可抓帧 - scripts: attach/spawn/hook/emu 系列 Frida 脚本与抓帧/验证工具 - evidence: identity/reqchain/frame/inputbuf/magic_buf/propedge 抓取样本, emu_* 存活对比, diag_* 策略实验, baseline 裸测基准
This commit is contained in:
yml2213
@@ -0,0 +1,203 @@
|
||||
#!/usr/bin/env python3
|
||||
"""模拟器 hdid v9: spawn + 三件套 + 稳健内存扫描 32hex + hook 三函数 + SSL_write 抓登录帧.
|
||||
|
||||
v8 失败点: String.fromCharCode.apply 大数组崩 → 改分块扫描(chunk 256KB), 累计计数。
|
||||
"""
|
||||
import frida, time, re, subprocess, json
|
||||
from pathlib import Path
|
||||
|
||||
REMOTE = "127.0.0.1:31878"
|
||||
PACKAGE = "com.duowan.kiwi"
|
||||
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
|
||||
OUT = Path("/tmp/emu_hdid_v9.json")
|
||||
|
||||
MAIN_JS = r"""
|
||||
'use strict';
|
||||
function readStdString(p){
|
||||
if (p.isNull()) return null;
|
||||
try{
|
||||
var first = p.readU8();
|
||||
if ((first & 1) === 0) {
|
||||
var len = first >> 1;
|
||||
return (len>0 && len<256) ? p.add(1).readUtf8String(len) : '';
|
||||
} else {
|
||||
var data = p.readPointer();
|
||||
var len = p.add(8).readU64();
|
||||
return (len>0 && len<1024) ? data.readUtf8String(len) : null;
|
||||
}
|
||||
}catch(e){ return null; }
|
||||
}
|
||||
function hexb(p,n){try{return Array.from(new Uint8Array(p.readByteArray(n))).map(b=>('0'+b.toString(16)).slice(-2)).join('');}catch(e){return '';}}
|
||||
function head(p,n){try{return p.readCString(n);}catch(e){return '';}}
|
||||
function emit(tag,val){ send({type:tag, tag:tag, val:''+(val||''), ts:Date.now()}); }
|
||||
var hooked=false, scanned=false, sslDone=false;
|
||||
|
||||
function hookUdb(){
|
||||
if (hooked) return;
|
||||
var md = Process.findModuleByName('libudbauthunify.so');
|
||||
if (!md) return;
|
||||
emit('mod-base', ''+md.base);
|
||||
try{
|
||||
Interceptor.attach(md.base.add(0x26A2E0), {
|
||||
onEnter:function(a){ this.sd=readStdString(a[1]); this.hd=readStdString(a[2]); },
|
||||
onLeave:function(){
|
||||
var hd=(this.hd||''); emit('SETSD', hd+' | sd='+(this.sd||'').slice(0,24));
|
||||
if(/^[0-9a-f]{32}$/.test(hd)) emit('FOUND_HDID_32', hd);
|
||||
}
|
||||
});
|
||||
}catch(e){}
|
||||
try{
|
||||
Interceptor.attach(md.base.add(0x26A484), {
|
||||
onEnter:function(a){ try{ this.thiz=this.context.x8; }catch(e){ this.thiz=null; } },
|
||||
onLeave:function(){
|
||||
if(!this.thiz) return;
|
||||
try{ var s=readStdString(this.thiz.add(1088)); if(s){ emit('GETHDID',''+s); if(/^[0-9a-f]{32}$/.test(s)) emit('FOUND_HDID_32',''+s); } }catch(e){}
|
||||
}
|
||||
});
|
||||
}catch(e){}
|
||||
try{
|
||||
Interceptor.attach(md.base.add(0x2746A0), {
|
||||
onLeave:function(ret){
|
||||
try{ var s=readStdString(ret.add(152)); if(s){ emit('WUPDEV_HDID',''+s); if(/^[0-9a-f]{32}$/.test(s)) emit('FOUND_HDID_32',''+s); } }catch(e){}
|
||||
}
|
||||
});
|
||||
}catch(e){}
|
||||
emit('ready','all hooked');
|
||||
hooked = true;
|
||||
}
|
||||
|
||||
// 稳健内存扫描: 分块读取, 用正则找 32hex ASCII
|
||||
function scanMem(){
|
||||
var found = {};
|
||||
try{
|
||||
var ranges = Process.enumerateRanges({protection:'r--', coalesce:true});
|
||||
var total = ranges.length, scannedB = 0;
|
||||
ranges.forEach(function(r, ri){
|
||||
try{
|
||||
var size = r.size;
|
||||
if (size <= 0) return;
|
||||
var step = 256*1024;
|
||||
var off = 0;
|
||||
while (off < size){
|
||||
var n = Math.min(step, size - off);
|
||||
var buf = Memory.readByteArray(r.base.add(off), n);
|
||||
if (buf){
|
||||
var sbuf = new Uint8Array(buf);
|
||||
var s = '';
|
||||
for (var i=0;i<sbuf.length;i++) s += String.fromCharCode(sbuf[i]);
|
||||
var re = /[0-9a-f]{32,40}/gi;
|
||||
var m;
|
||||
while ((m = re.exec(s)) !== null){
|
||||
var v = m[0].toLowerCase();
|
||||
if (!/^[0-9a-f]{32}$/.test(v)) continue;
|
||||
found[v] = (found[v]||0) + 1;
|
||||
}
|
||||
scannedB += n;
|
||||
}
|
||||
off += step;
|
||||
}
|
||||
}catch(e){}
|
||||
});
|
||||
}catch(e){ emit('scan-err',''+e); }
|
||||
var keys = Object.keys(found);
|
||||
emit('scan-result', 'ranges='+total+' scannedB='+scannedB+' found32+='+keys.length);
|
||||
keys.sort().forEach(function(k, i){
|
||||
if (i < 50) emit('H32CAND', k+' x'+found[k]);
|
||||
// 过滤: 排除常见噪音
|
||||
if (/^(00000000|ffffffff|0123456789)/.test(k)) return;
|
||||
emit('H32CAND_NZ', k+' x'+found[k]);
|
||||
});
|
||||
scanned = true;
|
||||
}
|
||||
|
||||
function hookSSL(){
|
||||
if (sslDone) return;
|
||||
try{
|
||||
var r=new ApiResolver('module');
|
||||
r.enumerateMatchesSync('exports:*!SSL_write').forEach(function(m){
|
||||
Interceptor.attach(m.address,{onEnter:function(a){
|
||||
var len=a[2].toInt32();
|
||||
if(len<50||len>50000)return;
|
||||
var h=head(a[1],Math.min(len,600));
|
||||
if(h.indexOf('hypasswordLogin')>=0){
|
||||
emit('WUP_LOGIN_FULL', len+'B '+hexb(a[1],len));
|
||||
}
|
||||
}});
|
||||
});
|
||||
send({type:'sslwrite-hooked', tag:'ssl'});
|
||||
}catch(e){}
|
||||
sslDone=true;
|
||||
}
|
||||
|
||||
setInterval(hookUdb, 100);
|
||||
setInterval(hookSSL, 1000);
|
||||
var scanLaunched = false;
|
||||
setInterval(function(){
|
||||
if (!scanLaunched && hooked && !scanned){
|
||||
scanLaunched = true;
|
||||
setTimeout(scanMem, 2500);
|
||||
}
|
||||
}, 500);
|
||||
"""
|
||||
|
||||
def load(session, js, wait=0.2):
|
||||
try:
|
||||
s = session.create_script(js); s.load(); return s
|
||||
except Exception as e:
|
||||
print("[load-err]", str(e)[:160], flush=True)
|
||||
return None
|
||||
|
||||
def main():
|
||||
subprocess.run(["adb","-s","127.0.0.1:5555","shell","am","force-stop",PACKAGE],
|
||||
capture_output=True)
|
||||
time.sleep(1.5)
|
||||
d = frida.get_device_manager().add_remote_device(REMOTE)
|
||||
pid = d.spawn([PACKAGE])
|
||||
print(f"[*] spawn pid={pid}", flush=True)
|
||||
session = d.attach(pid)
|
||||
load(session, (RE/"evidence/scripts/bypass_msaoaid_maps_skip_cleanup.js").read_text())
|
||||
load(session, (RE/"evidence/scripts/mask_frida_maps_only.js").read_text())
|
||||
print("[*] bypass x2 loaded", flush=True)
|
||||
d.resume(pid)
|
||||
print("[*] resumed", flush=True)
|
||||
load(session, (RE/"evidence/scripts/patch_guard_block_termination.js").read_text(), wait=0.1)
|
||||
print("[*] patch_guard loaded", flush=True)
|
||||
|
||||
events = []
|
||||
def on_message(m, data):
|
||||
if m.get('type') == 'error':
|
||||
print("[JS-ERR]", str(m)[:200], flush=True); return
|
||||
p = m.get('payload') or {}
|
||||
t = p.get('type')
|
||||
if t in ('mod-base','ready','scan-err'):
|
||||
print(f"[{t}] {p.get('val')}", flush=True)
|
||||
elif t in ('SETSD','GETHDID','WUPDEV_HDID'):
|
||||
print(f"[{t}] {p.get('val')}", flush=True)
|
||||
elif t == 'FOUND_HDID_32':
|
||||
print(f"\n★★★ FOUND 32HEX HDID = {p.get('val')} ★★★", flush=True)
|
||||
elif t == 'scan-result':
|
||||
print(f"[SCAN] {p.get('val')}", flush=True)
|
||||
elif t in ('H32CAND','H32CAND_NZ'):
|
||||
print(f"[{t}] {p.get('val')}", flush=True)
|
||||
elif t == 'WUP_LOGIN_FULL':
|
||||
b = bytes.fromhex(p.get('val','').split('B ')[-1]) if 'B ' in p.get('val','') else b''
|
||||
h = re.search(rb'hdid.{0,100}', b)
|
||||
print(f"[WUP_LOGIN] len={p.get('val','').split('B')[0]} ctx={(h.group(0)[:110] if h else b[:60])}", flush=True)
|
||||
elif t == 'sslwrite-hooked':
|
||||
print("[*] SSL_write hooked", flush=True)
|
||||
events.append(p); OUT.write_text(json.dumps(events, indent=1))
|
||||
|
||||
main_sc = load(session, MAIN_JS)
|
||||
if main_sc:
|
||||
main_sc.on('message', on_message)
|
||||
print("[*] running 170s", flush=True)
|
||||
t0 = time.time()
|
||||
while time.time() - t0 < 170:
|
||||
time.sleep(3)
|
||||
if any(e.get('tag')=='FOUND_HDID_32' for e in events):
|
||||
print("[*] 命中, 提前停止", flush=True)
|
||||
break
|
||||
print(f"[*] done, {len(events)} events", flush=True)
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user