dfpReport: 确定加密为逐字节XOR(动态keystream)+同步pair捕获+IDA导出线索, 记录破解进度

2026-08-26 14:17:58 +08:00
parent acb0a737eb
commit 4eec01568f
38 changed files with 4942 additions and 3 deletions
@@ -0,0 +1,126 @@
+#!/usr/bin/env python3
+"""抓取真正"同时刻"的 (明文JSON, 密文) 对。
+
+SSL_write 命中 dfpReport 时, 明文刚生成/正在内存, 立即全内存扫描
+{"appId":"5008" 快照 -> 与本次密文构成同步 pair。命中即持久化。
+"""
+from __future__ import annotations
+
+import json
+import time
+from pathlib import Path
+
+import frida
+
+RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
+OUT = Path("/Users/yml/codes/douyu_login_py/evidence/dfp_pair_sync.json")
+
+JS = r"""
+'use strict';
+Process.setExceptionHandler(function(d){ return true; });
+send({type:'armed'});
+
+function hexb(p, n){
+  try{ return Array.from(new Uint8Array(p.readByteArray(n))).map(x=>('0'+x.toString(16)).slice(-2)).join(''); }
+  catch(e){ return null; }
+}
+function hexs(buf){ return Array.from(new Uint8Array(buf)).map(function(x){return ('0'+x.toString(16)).slice(-2);}).join(''); }
+
+// 同步: SSL_write 后 50ms 扫描明文 (此时 JSON 应仍在堆)
+function scanPlainNow(tag){
+  var out = [];
+  try{
+    Process.enumerateRanges('r--').forEach(function(rng){
+      if (rng.size > 1024*1024*256) return;
+      try{
+        var hits = Memory.scanSync(rng.base, rng.size, '7b 22 61 70 70 49 64 22 3a 22 35 30 30 38');
+        hits.slice(0, 4).forEach(function(x){
+          var post = null;
+          try{ post = x.address.readByteArray(4096); }catch(e){ return; }
+          out.push({addr: String(x.address), hex: hexs(post)});
+        });
+      }catch(e){}
+    });
+  }catch(e){}
+  if (out.length) send({type:'sync_plain', tag:tag, plains:out});
+}
+
+try{
+  var r = new ApiResolver('module');
+  r.enumerateMatchesSync('exports:*!SSL_write').forEach(function(m){
+    Interceptor.attach(m.address, {
+      onEnter: function(a){
+        var len = a[2].toInt32();
+        if (len < 100 || len > 20000) return;
+        var head = '';
+        try{ head = a[1].readCString(Math.min(len, 2000)); }catch(e){ return; }
+        if (head.indexOf('dfpReport') < 0) return;
+        var hex = hexb(a[1], len);
+        var t = Date.now();
+        send({type:'wire', len:len, hex:hex, t:t});
+        setTimeout(function(){ scanPlainNow(t); }, 80);
+      }
+    });
+  });
+}catch(e){}
+"""
+
+
+def main():
+    device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
+    pid = device.spawn(["com.duowan.kiwi"])
+    print(f"[*] spawned pid={pid}", flush=True)
+    session = device.attach(pid)
+
+    events = []
+
+    def on_message(message, data):
+        if message.get("type") == "error":
+            print("[JS-ERR]", str(message)[:200], flush=True); return
+        if message.get("type") != "send":
+            return
+        p = message.get("payload") or {}
+        t = p.get("type")
+        if t == "wire":
+            print(f"[wire] len={p.get('len')}", flush=True)
+            events.append({"type": "wire", "t": p.get('t'), "hex": p.get('hex')})
+            OUT.write_text(json.dumps(events))
+        elif t == "sync_plain":
+            print(f"[sync_plain] tag={p.get('tag')} {len(p.get('plains'))} 份", flush=True)
+            events.append({"type": "plain", "t": p.get('tag'), "plains": p.get('plains')})
+            OUT.write_text(json.dumps(events))
+            for pl in p.get('plains'):
+                try:
+                    h = pl['hex']
+                    j = h.index('7b226170704964223a2235303038')
+                    asc = bytes.fromhex(h[j:j+700])
+                    s = ''.join(chr(x) if 32<=x<127 else '.' for x in asc)
+                    print(f"    @{pl['addr']}: {s[:200]}", flush=True)
+                except Exception: pass
+
+    script = session.create_script(JS)
+    script.on("message", on_message)
+    script.load()
+    print("[*] 主JS 已装载(resume前), 加载 bypass + resume", flush=True)
+    session.create_script(
+        (RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
+    ).load()
+    session.create_script(
+        (RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
+    ).load()
+    device.resume(pid)
+    time.sleep(11)
+    session.create_script(
+        (RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
+    ).load()
+    print("[*] 已 resume. 请 退出登录->重新登录 (wire 后立即抓同刻明文)", flush=True)
+    try:
+        while True:
+            time.sleep(5)
+    except KeyboardInterrupt:
+        pass
+    print(f"[*] 结束 -> {OUT}", flush=True)
+
+
+if __name__ == "__main__":
+    main()