yml/live-hub-py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(huya): turing JNI表解出+b87_@0x25c98 (R21)

Browse Source 
- libturingmfa JNI 表: b87_(SparseArray,[B,Map,I)impl@0x25c98 + f87_ — 加密核心入口
- ELF 间隙洞察: LOAD-2 vaddr未4K对齐->unidbg映射崩因; mmap2补映射过导出
- TuringProbe.java: 装库+预注册类+gap补映射+直调框架(封送待办)
- 路线: 直调b87_喂真实blob->SparseArray明文; ga侧JNI表同法
This commit is contained in:
yml2213
2026-08-29 07:07:18 +08:00
parent 39c516b71b
commit dc109c5dba
7 changed files with 284 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/frida/capture_20260829_065846.jsonl
+1
View File
@@ -0,0 +1 @@
{"event": "rn-err", "msg": "no RegisterNatives export"}
tools/frida/capture_20260829_070028.jsonl
+1
View File
@@ -0,0 +1 @@
{"event": "rn-err", "msg": "no RegisterNatives in libart"}
tools/frida/capture_20260829_070141.jsonl
+43
View File
@@ -0,0 +1,43 @@
{"event": "rn-hooked", "at": "0x72e1abccbc"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 12"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 3"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 18"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 10"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 12"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 3"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 18"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 10"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 10"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 7"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 13"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 12"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 12"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 8"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 11"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 10"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 8"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 10"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 7"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 11"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 8"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 10"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 10"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 10"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 19"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 7"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 15"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 17"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 22"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 20"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 13"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 18"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 13"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 14"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 24"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 10"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 20"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 18"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 11"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 17"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 11"}
{"event": "rn-err", "msg": "Error: can't decode byte 0x00 in position 19"}
tools/frida/capture_20260829_070247.jsonl
+1
View File
@@ -0,0 +1 @@
{"event": "rn-hooked", "at": "0x72e1a37890"}
tools/frida/hook_regnatives.js
+48
View File
@@ -0,0 +1,48 @@
'use strict';
function emit(row) { try { send(row); } catch (e) {} }
const seen = {};
setTimeout(() => {
let addr = null;
try {
for (const m of Process.enumerateModules()) {
if (m.name !== 'libart.so') continue;
const syms = m.enumerateSymbols();
for (const sm of syms) {
if (sm.name.indexOf('RegisterNatives') >= 0) { addr = sm.address; break; }
}
}
} catch (e) {}
if (addr === null) { emit({ event: 'rn-err', msg: 'no sym' }); return; }
emit({ event: 'rn-hooked', at: addr });
Interceptor.attach(addr, {
onEnter(args) {
try {
const cls = args[1];
const methods = args[2];
const n = args[3].toInt32();
if (n <= 0 || n > 500) return;
// 读 class 名 (jclass -> 从 vtable 附近读太复杂, 只读方法表)
const rows = [];
for (let i = 0; i < n; i++) {
const off = methods.add(i * 24);
const namePtr = off.readPointer();
const sigPtr = off.add(8).readPointer();
const fnPtr = off.add(16).readPointer();
const mod = Process.findModuleByAddress(fnPtr);
const name = namePtr.readUtf8String(80) || '?';
const sig = sigPtr.readUtf8String(80) || '?';
rows.push({
name: name.length > 60 ? name.slice(0, 60) : name,
sig: sig.length > 50 ? sig.slice(0, 50) : sig,
impl: (mod ? mod.name + '!' + fnPtr.sub(mod.base) : fnPtr.toString()),
});
}
const key = rows.map(r => r.name + r.impl).join('|');
if (!seen[key]) {
seen[key] = true;
emit({ event: 'rn-table', n, rows: rows.slice(0, 60) });
}
} catch (e) { emit({ event: 'rn-err', msg: String(e).slice(0, 120) }); }
},
});
}, 1500);