dfpReport: 确定加密为逐字节XOR(动态keystream)+同步pair捕获+IDA导出线索, 记录破解进度

2026-08-26 14:17:58 +08:00
parent acb0a737eb
commit 4eec01568f
38 changed files with 4942 additions and 3 deletions
@@ -0,0 +1,66 @@
+#!/usr/bin/env python3
+"""诊断: spawn + bypass 后进程是否存活, 崩溃原因是什么。
+
+对照组: 不改写数据段。对比之前 patch_t1_experiment(改写 3 处)是否崩溃。
+"""
+from __future__ import annotations
+
+import time
+from pathlib import Path
+
+import frida
+
+RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
+
+JS = r"""
+'use strict';
+Process.setExceptionHandler(function(d){
+  send({type:'exception', code:d.code, addr:String(d.address), ctx:d.context});
+  return true;
+});
+send({type:'armed'});
+setInterval(function(){ send({type:'alive', t:Date.now()}); }, 3000);
+"""
+
+
+def main():
+    device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
+    pid = device.spawn(["com.duowan.kiwi"])
+    print(f"[*] spawned pid={pid}", flush=True)
+    session = device.attach(pid)
+
+    session.on("detached", lambda reason, crash: print(
+        f"[DETACHED] reason={reason} crash={crash}", flush=True))
+
+    def on_message(message, data):
+        if message.get("type") == "error":
+            print("[JS-ERR]", str(message)[:200], flush=True); return
+        if message.get("type") != "send":
+            return
+        p = message.get("payload") or {}
+        t = p.get("type")
+        if t == "armed":
+            print("[*] armed", flush=True)
+        elif t == "exception":
+            print(f"[EXCEPTION] code={p.get('code')} addr={p.get('addr')}", flush=True)
+        elif t == "alive":
+            print("[*] alive", flush=True)
+
+    script = session.create_script(JS)
+    script.on("message", on_message)
+    script.load()
+    print("[*] 主JS 已装载(resume前), 加载 bypass + resume", flush=True)
+    session.create_script(
+        (RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
+    ).load()
+    session.create_script(
+        (RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
+    ).load()
+    device.resume(pid)
+    print("[*] resumed, 观察 30s", flush=True)
+    time.sleep(30)
+    print("[*] 结束", flush=True)
+
+
+if __name__ == "__main__":
+    main()