dfpReport: 确定加密为逐字节XOR(动态keystream)+同步pair捕获+IDA导出线索, 记录破解进度

2026-08-26 14:17:58 +08:00
parent acb0a737eb
commit 4eec01568f
38 changed files with 4942 additions and 3 deletions
@@ -0,0 +1,105 @@
+#!/usr/bin/env python3
+"""完整导出 libhydeviceid.so .data 段解密后的全部字符串(不截断)。
+
+.resume 后 .data 已被 datadiv 就地解密为明文。dump 全部字节 + 全部
+字符串(带偏移)到 JSON, 供离线分析 XXTEA key / 魔数 / t1 来源。
+"""
+from __future__ import annotations
+
+import json
+import time
+from pathlib import Path
+
+import frida
+
+RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
+OUT = Path("/Users/yml/codes/douyu_login_py/evidence/dfp_datadiv_full.json")
+
+JS = r"""
+'use strict';
+Process.setExceptionHandler(function(d){ return true; });
+send({type:'armed'});
+
+var RANGES = [
+  [0x36aec0, 0x6e75],   // .rodata
+  [0x3b2460, 0x74d8],   // .data.rel.ro
+  [0x3bb000, 0x2fc08],  // .data
+];
+
+function dumpSec(m, off, size){
+  try{
+    var base = m.base.add(off);
+    var raw = base.readByteArray(size);
+    var bytes = Array.from(new Uint8Array(raw));
+    var strs = [];
+    var cur = '';
+    var curOff = 0;
+    for (var i = 0; i < bytes.length; i++) {
+      var c = bytes[i];
+      if (c >= 32 && c < 127) { if (!cur) curOff = i; cur += String.fromCharCode(c); }
+      else {
+        if (cur.length >= 4) strs.push([off + curOff, cur]);
+        cur = '';
+      }
+    }
+    if (cur.length >= 4) strs.push([off + curOff, cur]);
+    return {sec: off.toString(16), size: size, n: strs.length, strs: strs};
+  }catch(e){ return {sec: off.toString(16), err: String(e)}; }
+}
+
+var tries = 0;
+var iv = setInterval(function(){
+  tries += 1;
+  var m = null;
+  try{ m = Process.getModuleByName('libhydeviceid.so'); }catch(e){}
+  if (m) {
+    clearInterval(iv);
+    var out = [];
+    RANGES.forEach(function(r){ out.push(dumpSec(m, r[0], r[1])); });
+    send({type:'all', ranges: out});
+  } else if (tries > 100) { clearInterval(iv); send({type:'no_mod'}); }
+}, 50);
+"""
+
+
+def main():
+    device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
+    pid = device.spawn(["com.duowan.kiwi"])
+    print(f"[*] spawned pid={pid}", flush=True)
+    session = device.attach(pid)
+
+    def on_message(message, data):
+        if message.get("type") == "error":
+            print("[JS-ERR]", str(message)[:200], flush=True); return
+        if message.get("type") != "send":
+            return
+        p = message.get("payload") or {}
+        t = p.get("type")
+        if t == "all":
+            total = sum(r.get('n', 0) for r in p.get('ranges', []))
+            print(f"[*] 完成, 共 {total} 条字符串 -> {OUT}", flush=True)
+            OUT.write_text(json.dumps(p.get('ranges'), ensure_ascii=False))
+        elif t == "no_mod":
+            print("[*] 模块未加载", flush=True)
+
+    script = session.create_script(JS)
+    script.on("message", on_message)
+    script.load()
+    print("[*] 主JS 已装载(resume前), 加载 bypass + resume", flush=True)
+    session.create_script(
+        (RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
+    ).load()
+    session.create_script(
+        (RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
+    ).load()
+    device.resume(pid)
+    time.sleep(11)
+    session.create_script(
+        (RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
+    ).load()
+    time.sleep(5)
+    print("[*] dump 完成, 结束", flush=True)
+
+
+if __name__ == "__main__":
+    main()