dfpReport: 确定加密为逐字节XOR(动态keystream)+同步pair捕获+IDA导出线索, 记录破解进度

2026-08-26 14:17:58 +08:00
parent acb0a737eb
commit 4eec01568f
38 changed files with 4942 additions and 3 deletions
@@ -0,0 +1,121 @@
+#!/usr/bin/env python3
+"""Hook .datadiv_decode* 字符串解码器, 找 571882cf 魔数 / dfp 相关字符串的来源。
+
+libhydeviceid.so 和 libudbauthunify.so 的业务字符串全被 datadiv 混淆,
+运行时才解码。魔数 571882cf664bb39401ee 静态搜不到 -> 一定是解码产物。
+"""
+from __future__ import annotations
+
+import json
+import time
+from pathlib import Path
+
+import frida
+
+PACKAGE = "com.duowan.kiwi"
+RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
+OUT = Path("/Users/yml/codes/douyu_login_py/evidence/dfp_datadiv_capture.json")
+
+JS = r"""
+'use strict';
+Process.setExceptionHandler(function(d){ return true; });
+
+var MAGIC_HEX = '571882cf664bb39401ee';
+var KEYWORDS = ['dfp', '5718', '82cf', 'b394', 'collect', 'encrypt', 'device'];
+var hooked = 0;
+
+function hookMod(modName){
+  var m = null;
+  try{ m = Process.getModuleByName(modName); }catch(e){ return false; }
+  var exps = m.enumerateExports();
+  exps.forEach(function(exp){
+    if (exp.name.indexOf('datadiv') < 0) return;
+    try{
+      Interceptor.attach(exp.address, {
+        onEnter: function(args){ this.t0=Date.now(); },
+        onLeave: function(ret){
+          var p = ret;
+          var s = '';
+          try{ s = p.readUtf8String(); }catch(e){}
+          var hit = false;
+          if (s && s.length > 3 && s.length < 2000) {
+            var low = s.toLowerCase();
+            KEYWORDS.forEach(function(k){
+              if (low.indexOf(k) >= 0) hit = true;
+            });
+          }
+          if (hit) {
+            send({type:'hit', mod:modName, fn:exp.name,
+                  str: s.slice(0, 300)});
+          }
+        }
+      });
+      hooked += 1;
+    }catch(e){}
+  });
+  return true;
+}
+
+// 轮询等待模块加载
+var tries = 0;
+var iv = setInterval(function(){
+  tries += 1;
+  var ok1 = hookMod('libhydeviceid.so');
+  var ok2 = hookMod('libudbauthunify.so');
+  if (tries % 5 === 0) send({type:'waiting', tries:tries, hooked:hooked});
+  if (ok1 && ok2) { clearInterval(iv); send({type:'hooked_count', n:hooked}); }
+  if (tries > 60) clearInterval(iv);
+}, 1000);
+"""
+
+
+def main():
+    device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
+    pid = device.spawn([PACKAGE])
+    print(f"[*] spawned {PACKAGE} pid={pid}")
+    session = device.attach(pid)
+    session.create_script(
+        (RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
+    ).load()
+    session.create_script(
+        (RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
+    ).load()
+    device.resume(pid)
+    time.sleep(11)
+    session.create_script(
+        (RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
+    ).load()
+
+    events = []
+
+    def on_message(message, data):
+        if message.get("type") == "error":
+            print("[JS-ERR]", str(message)[:160]); return
+        if message.get("type") != "send":
+            return
+        p = message.get("payload") or {}
+        t = p.get("type")
+        if t == "hit":
+            print(f"[hit] {p.get('mod')} {p.get('fn')}: {p.get('str')!r}")
+            events.append(p)
+        elif t == "hooked_count":
+            print(f"[*] hooked {p.get('n')} datadiv decoders")
+        elif t == "skip":
+            print(f"[skip] {p.get('mod')}")
+
+    script = session.create_script(JS)
+    script.on("message", on_message)
+    script.load()
+    print("[*] 请在手机上 退出登录 -> 重新登录 触发 dfpReport 链 (120s)")
+    deadline = time.time() + 120
+    try:
+        while time.time() < deadline:
+            time.sleep(5)
+    except KeyboardInterrupt:
+        pass
+    OUT.write_text(json.dumps(events, ensure_ascii=False, indent=1))
+    print(f"[*] 捕获 {len(events)} 条 -> {OUT}")
+
+
+if __name__ == "__main__":
+    main()