dfpReport: 确定加密为逐字节XOR(动态keystream)+同步pair捕获+IDA导出线索, 记录破解进度

2026-08-26 14:17:58 +08:00
parent acb0a737eb
commit 4eec01568f
38 changed files with 4942 additions and 3 deletions
@@ -0,0 +1,134 @@
+#!/usr/bin/env python3
+"""内存扫描: 找魔数 571882cf664bb39401ee 在进程内存中的位置。
+
+App 组装 dfpReport 时魔数一定在内存中。扫描模块内存,
+定位后 dump 周围字节 + 反查所在模块/偏移。
+"""
+from __future__ import annotations
+
+import time
+from pathlib import Path
+
+import frida
+
+RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
+
+JS = r"""
+'use strict';
+Process.setExceptionHandler(function(d){ return true; });
+send({type:'armed'});
+
+var MAGIC8 = [0x57,0x18,0x82,0xcf,0x66,0x4b,0xb3,0x94];
+
+function scanRange(base, size, name){
+  try{
+    var m = Memory.scanSync(base, size, '57 18 82 cf 66 4b b3 94');
+    m.forEach(function(x){
+      var addr = x.address;
+      var ctx = [];
+      try{
+        var bytes = addr.sub(16).readByteArray(48);
+        ctx = Array.from(new Uint8Array(bytes));
+      }catch(e){}
+      send({type:'found', mod:name, addr:String(addr),
+            offInMod: addr.sub(base).toString(),
+            ctx: ctx.map(function(b){return ('0'+b.toString(16)).slice(-2);}).join(' ')});
+    });
+  }catch(e){}
+}
+
+function doScan(){
+  var mods = Process.enumerateModules();
+  mods.forEach(function(m){
+    var n = m.name.toLowerCase();
+    if (n.indexOf('hydevice')>=0 || n.indexOf('udb')>=0 || n.indexOf('tsc')>=0 ||
+        n.indexOf('hycrypto')>=0 || n.indexOf('libc')>=0 || n.indexOf('kiwi')>=0) {
+      try{ scanRange(m.base, m.size, m.name); }catch(e){}
+    }
+  });
+  // 也扫匿名可读内存 (堆)
+  try{
+    Process.enumerateRanges('r--').forEach(function(r){
+      if (r.size > 1024*1024*256) return;  // 跳过超大段
+      try{
+        var m = Memory.scanSync(r.base, r.size, '57 18 82 cf 66 4b b3 94');
+        m.forEach(function(x){
+          var ctx = [];
+          try{ ctx = Array.from(new Uint8Array(x.address.sub(16).readByteArray(48))); }catch(e){}
+          // dump 魔数前 256B + 后 512B 的 ascii 找明文
+          var pre = '', post = '';
+          try{ pre = x.address.sub(256).readUtf8String(); }catch(e){}
+          try{ post = x.address.add(10).readUtf8String(); }catch(e){}
+          send({type:'found_heap', addr:String(x.address),
+                ctx: ctx.map(function(b){return ('0'+b.toString(16)).slice(-2);}).join(' '),
+                pre: pre, post: post});
+        });
+      }catch(e){}
+    });
+  }catch(e){}
+  send({type:'scan_done'});
+}
+
+// 每 5 秒扫一次, 实时找魔数 (App 登录触发 dfpReport 时出现)
+var iv = setInterval(function(){
+  try{ doScan(); }catch(e){ send({type:'scan_err', e:String(e)}); }
+}, 5000);
+"""
+
+
+def main():
+    device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
+    pid = device.spawn(["com.duowan.kiwi"])
+    print(f"[*] spawned pid={pid}")
+    session = device.attach(pid)
+    session.create_script(
+        (RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
+    ).load()
+    session.create_script(
+        (RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
+    ).load()
+    device.resume(pid)
+    time.sleep(11)
+    session.create_script(
+        (RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
+    ).load()
+
+    def on_message(message, data):
+        if message.get("type") == "error":
+            print("[JS-ERR]", str(message)[:160], flush=True); return
+        if message.get("type") != "send":
+            return
+        p = message.get("payload") or {}
+        t = p.get("type")
+        if t == "found":
+            print(f"[FOUND] {p.get('mod')} @{p.get('addr')} off={p.get('offInMod')}", flush=True)
+            print(f"   ctx: {p.get('ctx')}", flush=True)
+        elif t == "found_heap":
+            print(f"[FOUND-HEAP] @{p.get('addr')}", flush=True)
+            print(f"   ctx: {p.get('ctx')}", flush=True)
+            pre = p.get('pre', '') or ''
+            post = p.get('post', '') or ''
+            if pre.strip(): print(f"   pre256: {pre[:256]!r}", flush=True)
+            if post.strip(): print(f"   post512: {post[:512]!r}", flush=True)
+        elif t == "mods":
+            print(f"[*] modules: {p.get('n')}", flush=True)
+        elif t == "scan_done":
+            print("[*] scan tick done", flush=True)
+        elif t == "scan_err":
+            print(f"[scan_err] {p.get('e')}", flush=True)
+
+    script = session.create_script(JS)
+    script.on("message", on_message)
+    script.load()
+    print("[*] 内存扫描中 (每5s), 请在手机上 退出登录->重新登录 (持续扫描, 命中即停止)", flush=True)
+    try:
+        while True:
+            time.sleep(5)
+    except KeyboardInterrupt:
+        pass
+    print("[*] done", flush=True)
+    session.detach()
+
+
+if __name__ == "__main__":
+    main()