dfpReport: 确定加密为逐字节XOR(动态keystream)+同步pair捕获+IDA导出线索, 记录破解进度
This commit is contained in:
yml2213
@@ -0,0 +1,187 @@
|
||||
#!/usr/bin/env python3
|
||||
"""改写明文JSON字段实验: 验证服务端回显本地明文。
|
||||
|
||||
明文JSON {hdid: 7c5387..., appkey: 865a...cbb0e3, deviceId: ...} 在堆中。
|
||||
等长替换 hdid/appkey/deviceId -> 新值, 触发登录, 看 dfpReport 响应 t5 是否变化。
|
||||
同时 hook SSL_write 抓密文 + SSL_read 抓响应。
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import random
|
||||
import string
|
||||
import time
|
||||
from pathlib import Path
|
||||
|
||||
import frida
|
||||
|
||||
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
|
||||
OUT = Path("/Users/yml/codes/douyu_login_py/evidence/dfp_plain_patch.json")
|
||||
|
||||
NEW_HDID = "".join(random.choice("0123456789abcdef") for _ in range(40))
|
||||
NEW_APPKEY = "".join(random.choice("0123456789abcdef") for _ in range(32))
|
||||
NEW_DEVID = "".join(random.choice("0123456789abcdef") for _ in range(40))
|
||||
print(f"[*] 新 hdid = {NEW_HDID}")
|
||||
print(f"[*] 新 appkey = {NEW_APPKEY}")
|
||||
print(f"[*] 新 deviceId= {NEW_DEVID}")
|
||||
|
||||
JS = r"""
|
||||
'use strict';
|
||||
Process.setExceptionHandler(function(d){ return true; });
|
||||
send({type:'armed'});
|
||||
|
||||
var NEW_HDID = '%s'; // 40hex
|
||||
var NEW_APPKEY = '%s'; // 32hex
|
||||
var NEW_DEVID = '%s'; // 40hex
|
||||
|
||||
function hexb(p, n){
|
||||
try{ return Array.from(new Uint8Array(p.readByteArray(n))).map(x=>('0'+x.toString(16)).slice(-2)).join(''); }
|
||||
catch(e){ return null; }
|
||||
}
|
||||
|
||||
// 找明文 JSON {"appId":"5008" 并等长替换字段
|
||||
function patchJson(){
|
||||
try{
|
||||
Process.enumerateRanges('r--').forEach(function(rng){
|
||||
if (rng.size > 1024*1024*256) return;
|
||||
try{
|
||||
var hits = Memory.scanSync(rng.base, rng.size, '7b 22 61 70 70 49 64 22 3a 22 35 30 30 38');
|
||||
hits.slice(0, 6).forEach(function(x){
|
||||
var p = x.address;
|
||||
var s = '';
|
||||
try{ s = p.readUtf8String(1200); }catch(e){ return; }
|
||||
if (s.indexOf('"hdid"') < 0) return;
|
||||
send({type:'found_json', addr:String(p), len:s.length});
|
||||
// 等长替换 hdid / appkey / deviceId
|
||||
try{
|
||||
Memory.protect(p, s.length + 16, 'rwx');
|
||||
var out = s;
|
||||
out = out.replace(/"hdid":"[0-9a-f]{40}"/, '"hdid":"' + NEW_HDID + '"');
|
||||
out = out.replace(/"appkey":"[0-9a-f]{32}"/, '"appkey":"' + NEW_APPKEY + '"');
|
||||
out = out.replace(/"deviceId":"[0-9a-f]{40}"/, '"deviceId":"' + NEW_DEVID + '"');
|
||||
if (out !== s) {
|
||||
p.writeUtf8String(out);
|
||||
var after = p.readUtf8String(120);
|
||||
send({type:'patched_json', addr:String(p), after:after.slice(0, 180)});
|
||||
}
|
||||
}catch(e){ send({type:'patch_err', addr:String(p), e:String(e)}); }
|
||||
});
|
||||
}catch(e){}
|
||||
});
|
||||
}catch(e){}
|
||||
}
|
||||
|
||||
// SSL_write 抓 dfpReport 密文
|
||||
try{
|
||||
var r = new ApiResolver('module');
|
||||
r.enumerateMatchesSync('exports:*!SSL_write').forEach(function(m){
|
||||
Interceptor.attach(m.address, {
|
||||
onEnter: function(a){
|
||||
var len = a[2].toInt32();
|
||||
if (len < 100 || len > 20000) return;
|
||||
var head = '';
|
||||
try{ head = a[1].readCString(Math.min(len, 2000)); }catch(e){ return; }
|
||||
if (head.indexOf('dfpReport') < 0) return;
|
||||
var hex = hexb(a[1], len);
|
||||
send({type:'wire', len:len, hex:hex});
|
||||
}
|
||||
});
|
||||
});
|
||||
}catch(e){}
|
||||
|
||||
// SSL_read 抓响应 (找 t5 / t1)
|
||||
try{
|
||||
var r2 = new ApiResolver('module');
|
||||
r2.enumerateMatchesSync('exports:*!SSL_read').forEach(function(m){
|
||||
Interceptor.attach(m.address, {
|
||||
onEnter: function(a){
|
||||
this.buf = a[1]; this.len = a[2].toInt32();
|
||||
},
|
||||
onLeave: function(ret){
|
||||
var n = ret.toInt32();
|
||||
if (n <= 0 || n > 65536) return;
|
||||
try{
|
||||
var hex = hexb(this.buf, n);
|
||||
send({type:'sslread', len:n, hex:hex});
|
||||
}catch(e){}
|
||||
}
|
||||
});
|
||||
});
|
||||
}catch(e){}
|
||||
|
||||
// 每 5s patch 一次 (登录时 JSON 重新生成)
|
||||
setInterval(function(){ try{ patchJson(); }catch(e){} }, 5000);
|
||||
"""
|
||||
|
||||
|
||||
def main():
|
||||
device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
|
||||
pid = device.spawn(["com.duowan.kiwi"])
|
||||
print(f"[*] spawned pid={pid}", flush=True)
|
||||
session = device.attach(pid)
|
||||
|
||||
events = []
|
||||
|
||||
def on_message(message, data):
|
||||
if message.get("type") == "error":
|
||||
print("[JS-ERR]", str(message)[:200], flush=True); return
|
||||
if message.get("type") != "send":
|
||||
return
|
||||
p = message.get("payload") or {}
|
||||
t = p.get("type")
|
||||
if t == "found_json":
|
||||
print(f"[json] @{p.get('addr')} len={p.get('len')}", flush=True)
|
||||
events.append({"found": p.get('addr'), "new_hdid": NEW_HDID,
|
||||
"new_appkey": NEW_APPKEY, "new_devid": NEW_DEVID})
|
||||
OUT.write_text(json.dumps(events, ensure_ascii=False, indent=1))
|
||||
elif t == "patched_json":
|
||||
print(f"[PATCH-OK] @{p.get('addr')}: {p.get('after')!r}", flush=True)
|
||||
elif t == "patch_err":
|
||||
print(f"[patch-err] @{p.get('addr')}: {p.get('e')}", flush=True)
|
||||
elif t == "wire":
|
||||
body = bytes.fromhex(p.get('hex'))
|
||||
try: hp = body.index(b'\r\n\r\n') + 4
|
||||
except ValueError: hp = 0
|
||||
b = body[hp:]
|
||||
j = b.find(b'\x57\x18\x82\xcf\x66\x4b\xb3\x94')
|
||||
print(f"[wire] len={p.get('len')} 魔数@{j}", flush=True)
|
||||
if j >= 0:
|
||||
print(f" 密文头: {b[j+10:j+30].hex(' ')}", flush=True)
|
||||
events.append({"wire": p.get('hex')})
|
||||
OUT.write_text(json.dumps(events, ensure_ascii=False, indent=1))
|
||||
elif t == "sslread":
|
||||
h = p.get('hex', '')
|
||||
low = h.lower()
|
||||
# dfpReport 响应里找 40hex t5
|
||||
if len(h) > 200 and ('7c5387' in low or 't1' in low or 't5' in low or len(h) < 4000):
|
||||
print(f"[read] len={p.get('len')} hex[:120]: {h[:120]}", flush=True)
|
||||
events.append({"read": h})
|
||||
OUT.write_text(json.dumps(events, ensure_ascii=False, indent=1))
|
||||
|
||||
script = session.create_script(JS)
|
||||
script.on("message", on_message)
|
||||
script.load()
|
||||
print("[*] 主JS 已装载(resume前), 加载 bypass + resume", flush=True)
|
||||
session.create_script(
|
||||
(RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
|
||||
).load()
|
||||
session.create_script(
|
||||
(RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
|
||||
).load()
|
||||
device.resume(pid)
|
||||
time.sleep(11)
|
||||
session.create_script(
|
||||
(RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
|
||||
).load()
|
||||
print(f"[*] 已 resume. 将把 hdid={NEW_HDID} appkey={NEW_APPKEY} deviceId={NEW_DEVID} 写入明文JSON", flush=True)
|
||||
print("[*] 请 退出登录->重新登录, 观察响应 t5 是否为新 hdid", flush=True)
|
||||
try:
|
||||
while True:
|
||||
time.sleep(5)
|
||||
except KeyboardInterrupt:
|
||||
pass
|
||||
print(f"[*] 结束, {len(events)} -> {OUT}", flush=True)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user