feat(huya): 🎯 ga IDA导出核心挖掘: 密钥槽5788=3DF88同款! 全链XTEA/deflate/编码器映射 (R29)
- 5788=5788:f15e78d2… 与 mfa 3DF88 相同 (turing 共享key!) - ga XTEA sub_1F1CC + 封套 1F918/1F9C8 + 解码 27DBC(inflate!) - b209202 a6==0→sub_23DF8编码器 / a6==1→27FF8解码器 - k209202 16B块: RiskDetectExt.ExtData schema + key=16B输入 - 请求密文密钥≠静态key (需编码器内部路径)
This commit is contained in:
yml2213
@@ -22,6 +22,32 @@ public class TuringProbe {
|
||||
static final long[] IMPORT_SLOTS = {0x45908, 0x45910, 0x45918, 0x45920, 0x45928, 0x45930, 0x45938, 0x45940, 0x45948, 0x45950, 0x45958, 0x45960, 0x45968, 0x45970, 0x45978, 0x45980, 0x45988, 0x45990, 0x45998, 0x459a0, 0x459a8, 0x459b0, 0x459b8, 0x459c0, 0x459c8, 0x459d0, 0x459d8, 0x459e0, 0x459e8, 0x459f0, 0x459f8, 0x45a00, 0x45a08, 0x45a10, 0x45a18, 0x45a20, 0x45a28, 0x45a30, 0x45a38, 0x45a40, 0x45a48, 0x45a50, 0x45a58, 0x45a60, 0x45a68, 0x45a70, 0x45a78, 0x45a80, 0x45a88, 0x45a90, 0x45a98, 0x45aa0, 0x45aa8, 0x45ab0, 0x45ab8, 0x45ac0, 0x45ac8, 0x45ad0, 0x45ad8, 0x45ae0, 0x45ae8, 0x45af0, 0x45af8, 0x45b00, 0x45b08, 0x45b10, 0x45b18, 0x45b20, 0x45b28, 0x45b30, 0x45b38, 0x45b40, 0x45b48, 0x45b50, 0x45b58, 0x45b60, 0x45b68, 0x45b70, 0x45b78, 0x45b80, 0x45b88, 0x45b90, 0x45b98, 0x45ba0, 0x45ba8, 0x45bb0, 0x45bb8, 0x45bc0, 0x45bc8, 0x45bd0, 0x45bd8, 0x45be0, 0x45be8, 0x45bf0, 0x45bf8, 0x45c00, 0x45c08, 0x45c10, 0x45c18, 0x45c20, 0x45c28, 0x45c30, 0x45c38, 0x45c40, 0x45c48, 0x45c50, 0x45c58, 0x45c60, 0x45c68, 0x45c70, 0x45c78, 0x45c80, 0x45c88, 0x45c90, 0x45c98, 0x45ca0, 0x45ca8, 0x45cb0, 0x45cb8, 0x45cc0, 0x45cc8};
|
||||
static final String[] IMPORT_NAMES = {"popen", "deflateEnd", "pthread_mutex_destroy", "pthread_create", "strtoull", "realloc", "open", "pthread_key_create", "inflate", "pthread_attr_setdetachstate", "__cxa_finalize", "ftell", "regcomp", "mkdir", "calloc", "fread", "strncmp", "read", "ASensor_getVendor", "strtoul", "fstat", "pthread_mutex_init", "vsnprintf", "closedir", "strlcpy", "lstat", "qsort", "__cxa_guard_acquire", "__errno", "srand", "ASensor_getName", "snprintf", "_ZdlPv", "dl_iterate_phdr", "deflateInit_", "sscanf", "pthread_mutexattr_settype", "deflate", "write", "getenv", "strcasecmp", "strrchr", "access", "time", "rand", "regfree", "memcmp", "fclose", "mincore", "rewind", "__stack_chk_fail", "fgets", "_Znwm", "pthread_attr_init", "gettimeofday", "feof", "pthread_mutexattr_init", "__cxa_guard_release", "strtok_r", "ioctl", "pthread_setspecific", "strncpy", "opendir", "inet_ntop", "recv", "__android_log_print", "unlink", "inflateEnd", "pthread_attr_destroy", "strchr", "tolower", "fseek", "strcmp", "flock", "_Znam", "pipe2", "pthread_mutexattr_destroy", "syscall", "regexec", "sprintf", "real_syscall", "send", "pthread_mutex_lock", "mmap", "pthread_getspecific", "inflateInit_", "memmove", "if_indextoname", "strsep", "ASensor_getType", "ASensorManager_getInstance", "getuid", "readlink", "strstr", "getpagesize", "strdup", "usleep", "readdir", "fdopen", "strlen", "close", "remove", "stat", "ASensorManager_getSensorList", "rename", "munmap", "ASensor_getResolution", "malloc", "memcpy", "statfs", "memset", "fopen", "socket", "pclose", "strtol", "free", "strcpy", "__system_property_get", "pthread_mutex_unlock", "__cxa_atexit", "_ZdaPv"};
|
||||
|
||||
static final long[] GA_IMPORT_SLOTS = {0x48d80,0x48d88,0x48d90,0x48d98,0x48da0,0x48da8,0x48db0,0x48db8,0x48dc0,0x48dc8,0x48dd0,0x48dd8,0x48de0,0x48de8,0x48df0,0x48df8,0x48e00,0x48e08,0x48e10,0x48e18,0x48e20,0x48e28,0x48e30,0x48e38,0x48e40,0x48e48,0x48e50,0x48e58,0x48e60,0x48e68,0x48e70,0x48e78,0x48e80,0x48e88,0x48e90,0x48e98,0x48ea0,0x48ea8,0x48eb0,0x48eb8,0x48ec0,0x48ec8,0x48ed0,0x48ed8,0x48ee0,0x48ee8,0x48ef0,0x48ef8,0x48f00,0x48f08,0x48f10,0x48f18,0x48f20,0x48f28,0x48f30,0x48f38,0x48f40,0x48f48,0x48f50,0x48f58,0x48f60,0x48f68,0x48f70,0x48f78,0x48f80,0x48f88,0x48f90,0x48f98,0x48fa0,0x48fa8,0x48fb0,0x48fb8,0x48fc0,0x48fc8,0x48fd0,0x48fd8,0x48fe0,0x48fe8,0x48ff0,0x48ff8,0x49000,0x49008,0x49010,0x49018,0x49020,0x49028,0x49030,0x49038,0x49040,0x49048,0x49050,0x49058,0x49060,0x49068,0x49070,0x49078,0x49080,0x49088,0x49090,0x49098,0x490a0,0x490a8,0x490b0,0x490b8,0x490c0,0x490c8,0x490d0,0x490d8,0x490e0,0x490e8,0x490f0,0x490f8,0x49100,0x49108,0x49110,0x49118,0x49120,0x49128,0x49130,0x49138,0x49140,0x49148,0x49150,0x49158,0x49160,0x49168,0x49170};
|
||||
static final String[] GA_IMPORT_NAMES = {"__cxa_finalize","__cxa_atexit","strlen","memcpy","__stack_chk_fail","vsnprintf","strstr","memmove","strrchr","strchr","malloc","free","realloc","if_indextoname","socket","__strlcpy_chk","ioctl","close","_Znwm","memset","__memcpy_chk","__strcpy_chk","_Znam","_ZdaPv","real_syscall","sendto","__errno","recvfrom","flock","fstat","mmap","strcmp","munmap","__vsprintf_chk","stat","opendir","readdir","access","closedir","_ZdlPv","readlink","strtok_r","strtol","__cxa_guard_acquire","__cxa_guard_release","atoi","getuid","sscanf","statfs","__strlen_chk","pthread_mutexattr_init","pthread_mutexattr_settype","pthread_mutex_init","pthread_mutexattr_destroy","syscall","inet_ntop","mincore","getpagesize","__system_property_find","strtoul","fdopen","fgets","__strchr_chk","fclose","dl_iterate_phdr","pipe2","write","read","calloc","strncmp","memcmp","pthread_mutex_lock","pthread_mutex_unlock","pthread_mutex_destroy","mkdir","strdup","open","usleep","fopen","fseek","ftell","rewind","fread","pthread_attr_init","pthread_attr_setdetachstate","pthread_create","pthread_attr_destroy","__android_log_print","strtoll","strncpy","gettimeofday","__vsnprintf_chk","__open_2","feof","popen","pclose","time","srand","rand","regcomp","regfree","strsep","regexec","getenv","unlink","__strncpy_chk","qsort","__system_property_get","ASensorManager_getInstance","ASensorManager_getSensorList","ASensor_getType","ASensor_getName","ASensor_getVendor","ASensor_getResolution","pthread_key_create","pthread_setspecific","pthread_getspecific","inflateInit_","inflateEnd","inflate","deflateInit_","deflateEnd","deflate","strcasecmp","lstat","strtoull","getauxval"};
|
||||
|
||||
/** ga 版导入补丁 */
|
||||
void patchGaImports(com.github.unidbg.Module m) {
|
||||
int ok = 0, miss = 0;
|
||||
try { emulator.getMemory().mprotect(m.base + 0x48720, 0x1f40, 7); } catch (Throwable t) {}
|
||||
for (int i = 0; i < GA_IMPORT_SLOTS.length; i++) {
|
||||
String name = GA_IMPORT_NAMES[i];
|
||||
try {
|
||||
com.github.unidbg.pointer.UnidbgPointer slot = com.github.unidbg.pointer.UnidbgPointer.pointer(emulator, m.base + GA_IMPORT_SLOTS[i]);
|
||||
if (slot.getLong(0) != 0) continue;
|
||||
com.github.unidbg.Symbol sym = null;
|
||||
for (com.github.unidbg.Module md : emulator.getMemory().getLoadedModules()) {
|
||||
try { sym = md.findSymbolByName(name, false); } catch (Throwable t) {}
|
||||
if (sym != null && sym.getAddress() != 0) break;
|
||||
}
|
||||
if (sym != null && sym.getAddress() != 0) {
|
||||
slot.setPointer(0, com.github.unidbg.pointer.UnidbgPointer.pointer(emulator, sym.getAddress()));
|
||||
ok++;
|
||||
} else miss++;
|
||||
} catch (Throwable t) { miss++; }
|
||||
}
|
||||
System.out.println("[TP] ga imports patched ok=" + ok + " miss=" + miss);
|
||||
}
|
||||
|
||||
/** 全量补 JUMP_SLOT 导入槽 (懒绑定未解析) */
|
||||
void patchImports(com.github.unidbg.Module m) {
|
||||
int ok = 0, miss = 0;
|
||||
@@ -325,6 +351,37 @@ public class TuringProbe {
|
||||
}
|
||||
}
|
||||
|
||||
/** gaxtest: 直调 ga sub_1F1CC (XTEA) — (buf, ±n, key@5788) */
|
||||
void gaxtest(String blobPath) {
|
||||
try {
|
||||
DalvikModule dm = vm.loadLibrary(new File("/Users/yml/codes/douyu_login_py/evidence/dfp_live/turingga.so"), false);
|
||||
com.github.unidbg.Module m = dm.getModule();
|
||||
try { emulator.getMemory().mmap2(m.base + 0x48000, 0x720, 7, 0x32, -1, 0); } catch (Throwable t) {}
|
||||
boolean enc = blobPath.startsWith("ENC:");
|
||||
if (enc) blobPath = blobPath.substring(4);
|
||||
int off = 0;
|
||||
if (blobPath.contains(":")) {
|
||||
String[] sp = blobPath.split(":");
|
||||
blobPath = sp[0]; off = Integer.parseInt(sp[1]);
|
||||
}
|
||||
byte[] blobAll = new java.io.FileInputStream(blobPath).readAllBytes();
|
||||
byte[] blob = java.util.Arrays.copyOfRange(blobAll, off, blobAll.length);
|
||||
int n = blob.length / 4;
|
||||
com.github.unidbg.pointer.UnidbgPointer vp = emulator.getMemory().mmap(blob.length + 32, 7);
|
||||
for (int i=0;i<blob.length;i++) vp.setByte(i, blob[i]);
|
||||
long keyPtr = m.base + 0x5788;
|
||||
System.out.println("[TP] gaxtest " + (enc?"ENC":"DEC") + " n=" + n);
|
||||
Number ret = m.callFunction(emulator, 0x1F1CC, vp.peer, enc ? n : -n, keyPtr);
|
||||
byte[] out = vp.getByteArray(0, Math.min(blob.length, 32));
|
||||
long lastw = vp.getLong((long)(n - 1) * 4) & 0xFFFFFFFFL;
|
||||
boolean lenok = lastw > 0 && lastw + 8 <= blob.length && lastw < blob.length;
|
||||
System.out.println("[TP] gaxtest ret=" + ret + " head=" + java.util.HexFormat.of().formatHex(out)
|
||||
+ " lastw=" + lastw + " lenok=" + lenok);
|
||||
} catch (Throwable t) {
|
||||
System.out.println("[TP] gaxtest EXC " + t);
|
||||
}
|
||||
}
|
||||
|
||||
/** xtest: 直调 sub_24D58 (XXTEA变体) 解样本密文 @ blob 文件 */
|
||||
void xtest(String blobPath, String outPath) {
|
||||
try {
|
||||
@@ -539,6 +596,7 @@ public class TuringProbe {
|
||||
emulator.getMemory().mmap2(ggap, 0x720, 7, 0x32, -1, 0);
|
||||
com.github.unidbg.pointer.UnidbgPointer.pointer(emulator, ggap).setMemory(0, 0x720, (byte) 0);
|
||||
} catch (Throwable t) {}
|
||||
patchGaImports(gm);
|
||||
try { dm.callJNI_OnLoad(emulator); } catch (Throwable t) {}
|
||||
// 补 ga 0x48c18 状态指针 (ldr w8,[x8] 解引用) + 邻近槽
|
||||
try {
|
||||
@@ -577,6 +635,7 @@ public class TuringProbe {
|
||||
TuringProbe p = new TuringProbe();
|
||||
String which = args.length > 0 ? args[0] : "both";
|
||||
p.preResolveClasses();
|
||||
if (which.equals("gaxtest")) { p.gaxtest(args[1]); return; }
|
||||
if (which.equals("etest3")) { p.etest3(args[1]); return; }
|
||||
if (which.equals("etest2")) { p.etest2(args[1]); return; }
|
||||
if (which.equals("gacall2")) { p.gacall2(args[1]); return; }
|
||||
|
||||
Reference in New Issue
Block a user