feat(dfp): 🔑 RC4 key=APK内嵌appkey常量(datadiv@3912240), 全流程零设备依赖闭环 (R38-R39)

2026-08-29 11:01:51 +08:00
parent 4868a3b0e8
commit 5fa1f6d082
13 changed files with 43643 additions and 2 deletions
@@ -0,0 +1,82 @@
+// R39: 登录时 udbauthunify md5 正确捕获 — sret 约定: x0=out槽, x1=in
+'use strict';
+function emit(o){ try{ send(o); }catch(e){} }
+function hexb(p,n){ try{ return Array.from(new Uint8Array(p.readByteArray(n))).map(b=>('0'+b.toString(16)).slice(-2)).join(''); }catch(e){ return ''; } }
+function rdStr(p){
+  // libc++ std::string: b0&1==0 -> SSO (len=b0>>1, data=+1); else heap (len@+8, data@*+16)
+  try {
+    var b0 = p.readU8();
+    if ((b0 & 1) === 0){
+      var l = b0 >> 1;
+      if (l > 22) return {t:'susp', len:l, v: hexb(p.add(1), 48)};
+      return {t:'s', len:l, v: p.add(1).readUtf8String(l)};
+    }
+    var hl = p.add(8).readU64().toNumber();
+    if (hl > 8192) return {t:'err', v:'too long '+hl};
+    return {t:'b64h', len:hl, v: hexb(p.add(16).readPointer(), Math.min(hl, 512))};
+  } catch(e){ return {t:'err', v:String(e)}; }
+}
+var n = 0;
+function armUdb(){
+  var u = Process.findModuleByName('libudbauthunify.so');
+  if (!u) return false;
+  try {
+    Interceptor.attach(u.base.add(0x32e71c), {
+      onEnter(args){
+        this.outp = args[0];
+        this.in1  = rdStr(args[1]);
+        this.in2  = rdStr(args[2]);
+        this.raw  = [hexb(args[1], 64), hexb(args[2], 64)];
+        this.lr   = String(this.returnAddress);
+      },
+      onLeave(){
+        if (n > 300) return;
+        n++;
+        emit({event:'udb-md5', in1:this.in1, in2:this.in2, raw:this.raw,
+              out: rdStr(this.outp), lr:this.lr});
+      }
+    });
+    emit({event:'udb-armed'});
+    return true;
+  } catch(e){ emit({event:'udb-e', e:String(e).substring(0,150)}); return false; }
+}
+var armed = false;
+var poll = setInterval(function(){ if (armUdb()){ armed=true; clearInterval(poll); } }, 200);
+// Java digest 带输入 (登录 Java 侧可能也算)
+setImmediate(function(){
+  Java.perform(function(){
+    try {
+      var MD = Java.use('java.security.MessageDigest');
+      var pend = {};
+      MD.update.overload('[B').implementation = function(b){
+        try {
+          var k=this.hashCode();
+          if(!pend[k]) pend[k]=[];
+          if (pend[k].length<8) pend[k].push(Array.prototype.map.call(b,function(x){return ('0'+(x&0xff).toString(16)).slice(-2);}).join('').substring(0,2048));
+        } catch(e){}
+        return this.update(b);
+      };
+      MD.digest.overload().implementation = function(){
+        var out=this.digest();
+        try {
+          var k=this.hashCode();
+          var oh=Array.prototype.map.call(out,function(b){return ('0'+(b&0xff).toString(16)).slice(-2);}).join('');
+          emit({event:'java-digest', algo:this.getAlgorithm(), out:oh, in_parts:(pend[k]||[]).join('')});
+          delete pend[k];
+        } catch(e){}
+        return out;
+      };
+      MD.digest.overload('[B').implementation = function(b){
+        var out=this.digest(b);
+        try {
+          var oh=Array.prototype.map.call(out,function(b2){return ('0'+(b2&0xff).toString(16)).slice(-2);}).join('');
+          var ih=Array.prototype.map.call(b,function(x){return ('0'+(x&0xff).toString(16)).slice(-2);}).join('');
+          emit({event:'java-digest', algo:this.getAlgorithm(), out:oh, in_parts:ih.substring(0,4096)});
+        } catch(e){}
+        return out;
+      };
+      emit({event:'java-md5-hooked'});
+    } catch(e){}
+  });
+});
+emit({event:'script-loaded'});