dfpReport: 确定加密为逐字节XOR(动态keystream)+同步pair捕获+IDA导出线索, 记录破解进度

2026-08-26 14:17:58 +08:00
parent acb0a737eb
commit 4eec01568f
38 changed files with 4942 additions and 3 deletions
@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+"""侦察: 虎牙App 加载的模块中, 哪些含 dfp/hydevice/tsc/xxtea/aes 相关符号。
+
+决定 dfpReport 加密体生成所在的 so, 再针对性 hook。
+"""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import frida
+
+PACKAGE = "com.duowan.kiwi"
+RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
+
+JS = r"""
+'use strict';
+var mods = Process.enumerateModules();
+var kw = /dfp|hydevice|deviceid|tsc|udb|xxtea|aes|finger|crypt|secsdk|turing|risk/;
+var out = [];
+mods.forEach(function(m){
+  var n = m.name;
+  if (kw.test(n.toLowerCase())) out.push({name:n, base:String(m.base), size:m.size});
+});
+send({type:'mods', list:out});
+"""
+
+
+def main():
+    device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
+    pid = device.spawn([PACKAGE])
+    print(f"[*] spawned {PACKAGE} pid={pid}")
+    session = device.attach(pid)
+    session.create_script(
+        (RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
+    ).load()
+    session.create_script(
+        (RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
+    ).load()
+    device.resume(pid)
+    time.sleep(11)
+    session.create_script(
+        (RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
+    ).load()
+    script = session.create_script(JS)
+
+    def on_message(message, data):
+        if message.get("type") == "send":
+            payload = message.get("payload") or {}
+            if payload.get("type") == "mods":
+                for m in payload["list"]:
+                    print(f"  {m['name']:<32} {m['base']} size={m['size']}")
+
+    script.on("message", on_message)
+    script.load()
+    time.sleep(8)
+    print("[*] done")
+    session.detach()
+
+
+if __name__ == "__main__":
+    import time
+    main()