// 多切片×多密钥暴力: Java 真 Cprivate.a
function emit(o){ try{ send(o); }catch(e){} }
let klist = [];
for (const mod of Process.enumerateModules()) {
  let addr = null;
  try { addr = mod.getExportByName('SSL_write'); } catch(e){}
  if (!addr) continue;
  Interceptor.attach(addr, {
    onEnter(args){
      try {
        var num = args[2].toInt32();
        if (num < 60 || num > 60000) return;
        var u = new Uint8Array(args[1].readByteArray(num));
        var s = '';
        for (var i=0;i<u.length;i++) s += (u[i]>=32 && u[i]<127) ? String.fromCharCode(u[i]) : '.';
        if (s.indexOf('dfpReport') < 0 && s.indexOf('hyudbwebuif') < 0) return;
        var hex = Array.prototype.map.call(u, function(x){return ('0'+x.toString(16)).slice(-2)}).join('');
        emit({event:'post', num:num, hex:hex});
        setTimeout(function(){
          try {
            Java.perform(function(){
              var keys = [];
              Java.enumerateClassLoaders({
                onMatch: function(loader){
                  try {
                    Java.classFactory.loader = loader;
                    Java.choose('com.tencent.turingfd.sdk.ams.ga.Perseus', {
                      onMatch: function(inst){
                        try {
                          var g = inst.b.value;
                          if (g && keys.indexOf(g.c.value) < 0) keys.push(g.c.value);
                        } catch(e){}
                      },
                      onComplete: function(){
                        try {
                          var C = Java.use('com.tencent.turingfd.sdk.ams.ga.private');
                          var Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon');
                          var idx = hex.indexOf('571882cf664bb39401ee');
                          if (idx < 0) return;
                          var all = hex.substring(idx+20);
                          var tot = keys.length;
                          for (var ki=0; ki<tot; ki++) {
                            var key = keys[ki];
                            var karr = Java.use('java.lang.String').$new(key).getBytes('UTF-8');
                            for (var off=0; off<=48; off+=2) {
                              var cph = all.substring(off);
                              if (cph.length < 16 || cph.length % 8 !== 0) continue;
                              var bytes = [];
                              for (var i=0;i<cph.length;i+=2) bytes.push(parseInt(cph.substr(i,2),16));
                              var arr = Java.array('byte', bytes);
                              var plain = C.a(arr, karr);
                              if (plain !== null) {
                                emit({event:'DEC-OK', key:key, off:off, len:plain.length, hex:Melon.a(plain).substring(0,400)});
                              }
                            }
                          }
                          emit({event:'brute-done', keys:keys.length});
                        } catch(e){ emit({event:'brute-e', e:String(e).substring(0,120)}); }
                      }
                    });
                  } catch(e){}
                },
                onComplete: function(){}
              });
            });
          } catch(e){}
        }, 300);
      } catch(e){}
    }
  });
}