dfpReport: 确定加密为逐字节XOR(动态keystream)+同步pair捕获+IDA导出线索, 记录破解进度

2026-08-26 14:17:58 +08:00
parent acb0a737eb
commit 4eec01568f
38 changed files with 4942 additions and 3 deletions
@@ -0,0 +1,128 @@
+#!/usr/bin/env python3
+"""定位 dfpReport 加密体生成函数: 批量 hook libhydeviceid.so / libtscsdk.so
+导出函数, 记录返回长度 >500B 的调用。登录触发后, 找输出含魔数
+571882cf664bb39401ee 或长度 ≈3908B 的函数。
+"""
+from __future__ import annotations
+
+import json
+import sys
+import time
+from pathlib import Path
+
+import frida
+
+PACKAGE = "com.duowan.kiwi"
+RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
+OUT = Path("/Users/yml/codes/douyu_login_py/evidence/dfp_bigout_capture.json")
+
+JS = r"""
+'use strict';
+Process.setExceptionHandler(function(d){
+  send({type:'segv', info:{type:d.type, addr:String(d.address)}});
+  return true;
+});
+send({type:'armed'});
+
+function hx(p,n){
+  try{ return Array.from(new Uint8Array(p.readByteArray(n))).map(x=>('0'+x.toString(16)).slice(-2)).join(''); }
+  catch(e){ return 'ERR'; }
+}
+function ra(ctx){
+  try{ return DebugSymbol.fromAddress(ctx.returnAddress).toString().slice(0,90);}catch(e){return '?';}
+}
+
+var TARGETS = ['libhydeviceid.so', 'libtscsdk.so', 'libturingga.so'];
+var MIN_LEN = 3000;
+var MAX_LEN = 6000;
+var hooked = 0;
+
+TARGETS.forEach(function(modName){
+  try{
+    var m = Process.getModuleByName(modName);
+  }catch(e){ send({type:'skip', mod:modName}); return; }
+  var exps = m.enumerateExports();
+  exps.forEach(function(exp){
+    var n = exp.name;
+    if (n.indexOf('datadiv') === 0) return;       // 字符串解码器, 跳过
+    if (n.indexOf('std::') === 0) return;          // std 符号, 跳过
+    if (/^(_Z|Java_|JNI_)/.test(n)) return;        // C++ 符号/Java 方法名太长, 跳过
+    try{
+      Interceptor.attach(exp.address, {
+        onEnter: function(args){
+          this.t0 = Date.now();
+          this.args = [];
+          for (var i = 0; i < Math.min(4, args.length); i++) {
+            try{
+              var v = args[i].toInt32();
+              if (v > 0 && v < 10000000) this.args.push(v);
+            }catch(e){}
+          }
+        },
+        onLeave: function(ret){
+          var dt = Date.now() - this.t0;
+          var v = ret.toInt32();
+          if ((v >= MIN_LEN && v <= MAX_LEN) || dt > 30) {
+            send({type:'big', mod:modName, fn:exp.name, ret:v, dt:dt,
+                  args:this.args, r:ra(this.ctx)});
+          }
+        }
+      });
+      hooked += 1;
+    }catch(e){}
+  });
+});
+send({type:'hooked_count', n:hooked});
+"""
+
+
+def main():
+    device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
+    pid = device.spawn([PACKAGE])
+    print(f"[*] spawned {PACKAGE} pid={pid}")
+    session = device.attach(pid)
+    session.create_script(
+        (RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
+    ).load()
+    session.create_script(
+        (RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
+    ).load()
+    device.resume(pid)
+    time.sleep(11)
+    session.create_script(
+        (RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
+    ).load()
+
+    events = []
+
+    def on_message(message, data):
+        if message.get("type") == "error":
+            print("[JS-ERR]", str(message)[:160]); return
+        if message.get("type") != "send":
+            return
+        p = message.get("payload") or {}
+        t = p.get("type")
+        if t == "big":
+            print(f"[big] {p.get('mod')} {p.get('fn')} ret={p.get('ret')} dt={p.get('dt')}ms r={p.get('r','')}")
+            events.append(p)
+        elif t == "hooked_count":
+            print(f"[*] hooked {p.get('n')} exports")
+        elif t == "skip":
+            print(f"[skip] {p.get('mod')}")
+
+    script = session.create_script(JS)
+    script.on("message", on_message)
+    script.load()
+    print("[*] hooks 装好, 请在手机上 退出登录 -> 重新登录 触发 dfpReport 链 (120s)")
+    deadline = time.time() + 120
+    try:
+        while time.time() < deadline:
+            time.sleep(5)
+    except KeyboardInterrupt:
+        pass
+    OUT.write_text(json.dumps(events, ensure_ascii=False, indent=1))
+    print(f"[*] 捕获 {len(events)} 条 -> {OUT}")
+
+
+if __name__ == "__main__":
+    main()