yml2213
39c516b71b
- hook_str_magic.js: dfpReport/hyudbwebuif字符串过滤替代魔数(不漏轮次) + 全量请求dump - 采样集: golden+f1..f4+新身份B(0647) — 新身份头12B=旧身份一致(nonce与身份无关) - nonce块: [7cda][版本][69c9f5][计数递增][稳定段] ; 运行时路线终态(Java桥/co-located/回溯全闭) - 触发-捕获-存档 ~40s/轮 全自动; evidence/dfp_live/ 齐全
35 lines
11 KiB
JSON
35 lines
11 KiB
JSON
{"event": "ssl-hooked", "module": "libjavacrypto.so"}
|
|
{"event": "ssl-hooked", "module": "libssl.so"}
|
|
{"event": "ssl-hooked", "module": "libhyssl.so"}
|
|
{"event": "ssl-hooked", "module": "libmarsstn.so"}
|
|
{"event": "ssl-hooked", "module": "libhyquic.so"}
|
|
{"event": "ssl-hooked", "module": "libngtcp2_crypto_boringssl.so"}
|
|
{"event": "ssl-hooked", "module": "libposix_quic_ngtcp.so"}
|
|
{"event": "ssl-hooked", "module": "libhysignalcore.so"}
|
|
{"event": "ssl-hooked", "module": "libhymediatrans.so"}
|
|
{"event": "ssl-hooked", "module": "libYCloudLive.so"}
|
|
{"event": "ssl-heartbeat", "module": "libmarsstn.so", "writes": 40}
|
|
{"event": "ssl-hooked", "module": "libhydt.so"}
|
|
{"event": "ssl-heartbeat", "module": "libngtcp2_crypto_boringssl.so", "writes": 80}
|
|
{"event": "ssl-heartbeat", "module": "libmarsstn.so", "writes": 120}
|
|
{"event": "ssl-heartbeat", "module": "libhysignalcore.so", "writes": 160}
|
|
{"event": "ssl-heartbeat", "module": "libhyssl.so", "writes": 200}
|
|
{"event": "ssl-heartbeat", "module": "libjavacrypto.so", "writes": 240}
|
|
{"event": "ssl-heartbeat", "module": "libjavacrypto.so", "writes": 280}
|
|
{"event": "ssl-heartbeat", "module": "libjavacrypto.so", "writes": 320}
|
|
{"event": "ssl-heartbeat", "module": "libssl.so", "writes": 360}
|
|
{"event": "ssl-heartbeat", "module": "libhymediatrans.so", "writes": 400}
|
|
{"event": "ssl-heartbeat", "module": "libmarsstn.so", "writes": 440}
|
|
{"event": "ssl-heartbeat", "module": "libssl.so", "writes": 480}
|
|
{"event": "ssl-heartbeat", "module": "libposix_quic_ngtcp.so", "writes": 520}
|
|
{"event": "ssl-heartbeat", "module": "libhydt.so", "writes": 560}
|
|
{"event": "ssl-heartbeat", "module": "libngtcp2_crypto_boringssl.so", "writes": 600}
|
|
{"event": "ssl-heartbeat", "module": "libYCloudLive.so", "writes": 640}
|
|
{"event": "ssl-heartbeat", "module": "libhyquic.so", "writes": 680}
|
|
{"event": "ssl-heartbeat", "module": "libhyssl.so", "writes": 720}
|
|
{"event": "ssl-heartbeat", "module": "libhyssl.so", "writes": 760}
|
|
{"event": "ssl-heartbeat", "module": "libjavacrypto.so", "writes": 800}
|
|
{"event": "ssl-heartbeat", "module": "libYCloudLive.so", "writes": 840}
|
|
{"event": "ssl-heartbeat", "module": "libssl.so", "writes": 880}
|
|
{"event": "str-magic", "module": "libjavacrypto.so", "num": 4258, "full": "504f5354202f20485454502f312e310d0a692d7665723a20310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6f637465742d73747265616d0d0a436f6e74656e742d4c656e6774683a20343037310d0a486f73743a2077736170692e687579612e636f6d0d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a557365722d4167656e743a206f6b687474702f332e31342e390d0a0d0a00000fe710032c3c4c560c68757961756462776562756966096466705265706f72747d00010fbb0800010604745265711d00010fad0a06001607616e64726f69642d00010f97571882cf664bb39401ee7cda1169c9f5289c4d46a1de0511bb80cc0d46f6f28f6b42472b34e27be80282fc39ebd7e803d94d41c7e40694a7e3c98c93ed2cf78eb42ac04549e73e994872130f322bf86547b3dd3e3537d487b9a6a5a28083dc0e776e2a7239a8c8e1c6c50841c5e300019b43213942edb726a67fc4a9b15530b466b26fcb884e90cc341a13cde06ab1f9ce7bc8c4eebe1f6e5aa7436c851d4742cb49bffcad4a3ff1e23574dffad3e10d3f49601f83057b39b65988e6b611e396b20641d00b96bea943141c4922ddfb312e74fabd592c47e7f3639211eceedfc9c55291139e2c956db0d677a96eaf1c87b6fce2c15ebc2e147c4e11818cd4283e47b912fbb60e645dd7c6239e57f10a064c03be98519e9ddb6690caac539271606ba4e8ebc2307ea381a9c6ddf4c7d189c4830aa964b925a1d17febb5e94faf7b7d9a117b971148676bd103bdecdce59e0f1d57c79e3e6ea0e6a96006748e567a847fdb5b489e6b0cb291dbdbcd03b40354af91c9ca28cffe20346ad0427f82d25c4106c297f0ac1fa8f1e4499ec28acd90e92fcd43313120b6a6400172a76d5c62bce5a3cadaa682dff705ed69e1f7a54844b5a25a09e50a5308540f9ed4f3e33733662ba56ebcbdac6e3d065c24560801e6d82c4196058dee8d764304f0d97ff652c595d82bdc68fa825aecdd1304129dbe796fd6df78bce8618e4f5a6af2963f183e7c18aba0a8d3caf5c6e8472d883bf779ffa431ef21477e411b96fb4d58afd69d04cc5646ecbd4150df7a5ea85390e6ab6419992ac7c2d5f0869522544c10a787492d1121635a271fe1d774ff5510d208d373fea031f232a1be5911aa3097f09e432b5921e9bcab5685fc0e1d718fb23ec4311926b1cef4aaed287ee2bfea9beb4a11445dcf5a82234ace0f0509030952c3e3205a0ad616ea317b836977e88495832d38e332c38d61f7764906de54cd5d2eb5d24c352bcc3b6f2d08ee4800363e6b343e1eabbdf40762ce5877947e730d8244ada7badf588e5cb227bd9ab3ddef31a17e9d670586bc14d7d51acb34edbb253e4173788649e9de66e6a53f2ebb65fa5a1eeedfc0914c1e3b21cbe0eb4a24d5b7150a4ecf4d9214545b504cce13b458984fcb6981a6b102bac99820176dcde79c25c5ab1ee89508d5ea0ed3ba55c851170e1a32a733ba1e4d44e2b286960bc507556bbc83b7769fe0d438f29fce90cd640b67dca64fa1c3f1c97eea6e05f82aadc6664c073ce5aa098ce6c3e393bd33b4e93207161abf44e9ff3edf152c7defdfa58e178efd05af49aea47239cd54d10a92a34938fb2f8e7251639b6acb17715d5eb52526f7571946df248de6c9fca2c733d24d96042c8a4be4352b3d0dbd76327b6cfbf1ff952ea4110cc30aabb88251f187a576c61d99d167aaa472e3a08dd6295fe699b80f0c5b94cd4e4486b07d493dba342b80e9f6bd130c31e46c65ee468c0559c13fd658cc193a21aaa283c7b340072a289ce68271bb18c9ef78725a813774d059ebe00dd5501723bb935e284b4df617250ce085c59e7f1e03878970f0c022f4b67cadfdc78e67482bde6e8d0aae2c09e3363ca8a31c249b33876230a7b0d2f6b1fe8ae817a667186f725a0cd2a00c3c081bd967fe67a0f795786c5f0ac3f3dfb393a3fcb1bef4db20051fe22b431a0a8f60fde552797222e856caebb2c507416e2787f9f3b79965f17b05251e360e297db4a542665f0910d2942c08ebfce79f478cfe1571247a1a0f1370001182f17fe8c88fbcb96b2a09e26fce56c8c9e9b83e41740134fb3b20daf2a92b3ef601227ef80ef08f1513787d07bc1ca152316c67253b0ef6eb01af1aaa3ab12556d60a2d5cf55f3760fff78fb56b9d9b741ed8d38892e460be943eb39eef543f36bf25d8db9c7746b5d25c637d6b228bbb067bda721a59cc021fa1a4ef29f5530896df3a66fdf41ec88de41a9f0635e3c743a015c70a4bc9a0b1b56779db1b3d4dd9c3dec5ac9349fae808bdc2ce0b7e35203426e688b3074bdb60e08f986bb205dea7ef4eed235e8af22367d38a4933ed1dd66b3aeade8f5c29902bbdd90626fda254a20969fe98b8734306a0968efb32a8aed5e15b8ab19ed09449f5245b8475a999b7bcc36cf201438949e6075276c181c1bf722f156344f05ffe04e0bb527206079820c8dec3e469dd0e7003d43d527da9551e0e0a44da6e6a1826905ea21e4da2e422151a9d7662e5b0c556f6571f89982ac7996c2cf0eec60aac3211e315d165ba59c4441b7b3e616aa0c52175cb8830e94ce7c5c8944ecd0a59dfc029227c5e8dc3cbbf731b558ed719d8a5a15dd7fa9669a5cc64c6e54c6f571d5755ad1e04d784092891a6cc408d35ce1197d51ef2f0a78df0fda960560efa4363c6b2c56bacf81245dec949b98987015ff8953db1c58142d44534313912062266b327c83fc91871567a8080fbe12e2c9044ecde0f9fff8cfeeefad91694a1a702781ce04033fc283dce7f644756e14147a53e88d6929d44f06d224c1177eb38d87175f216969688700c9a7378ed9def9d79e860ea5081f0f05adb353a1d366d5e01e681e2a692cd6f01023eeb5880621b8b16af8d89cb5d53d1be77c97ac2d9e4ae7f46f2d7594b13891789d1fe899192ef98fc898a8a50078f444be99a6f9bd2917f998faf109b10cf5f3e2444c64dd63fd81dd331eea106a4fb420136b003994d0ccd34b86625715a602dec9a3f1f9334f769bd7d97f474f1f225adf6968681ddc5ea5ee7df1834ee34d221b8a8330a9eedcaf96b00246999121bc4ae82325d11605f59c43f8eff0e86f207b945cd772ceeb92386ced2dc4517f8a65bf9e67116a13d1f4d53ac87ecef27f009aef947b2748ddb1603d5add5f4cbbb32b17375539f7ff7aba8c368a7e81823aa0486d1c77b7f273debb642dbfd78e1e3507eaa1145fbc0898854fbfb18c590a134d01f973334cd338447bb361a7e54f6e40202814149c0696ccf9e66f5a17e94869dcc799aacc92f080c2221e848ad62703c1a8bfdac1b11b4ceb4afb0ff6ced11a54075925b3a0eb55e8f66ee5956ffa8b17b9bfa17fd9c28bc504136e4639042c2c49d20988816fb2d924091491851d86b452ec490da23c5994d8c74cd78dc957379299a59f7b4ebe22c64b4e78229c6703acf3d93ebfcdf7e9dca1402114d242221b68944b63c8a2fe9e1b24981dd4382d69dcec6fd1021f0b15909f4586185f95458d1fb13de326f6dc68be421d3385a44914b4bc0d9fe7df9bc2fe9c3bea05d5794e1392ecfeb377d96201bbd2f59e638b707e8a8a39aff8bbd6ffbc0c6d8e30661b7187e044757a5b72e1b5e7f6d41bb219d400dc83ae0be91905882aa648038b49748f2b6f2c381c634683380e49151d3907aa8ae6f431e44fd05a9a2fa0837d4f18324727d8cb962af6c0300f6ae99e955d19d4ed3b53d148c2d580bf833a5f60f3afe777311b3862abb75a9f759e1130630bf2e533c6fbc7d063797d1041e2588ea1a81c57d783e7c45d597603e57db519078418329de43d0a82bdabd09f7421f364583696c35c18a67f5581f9bf3e8ae19eac489530f316cf0217f5f4057ae260ee211d6e9661abb95661cf9e49aba0202ec336fc5f0bf1f0b918eb6dbd08cfd03dbc6216d47955142ff88ccd2878fd5c572f76b8bc6fb4fbf3dbc4187e7cc80027f89c3c1f85f836ce3fffdfc60f4aae75d96c26fdfcdd5a9b913b82cca1adf7310d11288093297bea20bdc5a90065a2acd9cd71eb86b5c58203be86bb091d6447c979a2030d61efebd70eb8ee0113a40224c31f3a5b57fdb5c01bea884026accd096166e5b14b3541b766352bf170ceb354cd0eb2daeb90537ee13354e955de1e6f4fdc2a17f8225835ea1fdd810030d4c509c104f9755afb4de249558223c0489e950aae489d51cc0c8d96c76ecb21ca8c7079ac0448af6c2bf01cd3647717afc5482a1d46d0ed4afaca80bfb3d7d3519ccafd093ce93a10bf3a76f1dc984dbec052808dc49f50a16b0854b68c858df20b43e473979c996b45eb373dea9b0d6153d4b630d9feec2a920ebab9c9baed6893f8a7c7ab8c9074c0e8f06cbf5694068246e319a5a713cf5c98c81ff591e809c952904f420025ffcd18067fe3a26405ec0d39c9de25a71da28d2650f7afe724fd394ad8820fd2952f4579bfc05befbd718511255fa9b7bdec25ab0311c7752db680ba97f00a2f5dbd752c86e685d981e6068b98a88ef361701d613a9263ff27c6cce3e371d4e952e10d7e100b5a55147ee820417b7946417cbb5f0ff0506148766f13b7883185bc8e72b0ebb3a88082db5a945f8fef692157ec4dd42e1b9aa88ac6e8a8c94119b96ddfb92f7a2a8a6addb954ba49b43d9bbe47cf51c561035251c5cd36f1123ee03192b8ae4ebe61df34ec71abe9ae53843be800a73d5f25e12f9a85d3f78c67a0995b641282f091d1566c3a4f38a9141cd623c0da1534bf6d2ea1ed514dc3f005825e3b709a11dd2a874b38b796173860eaef74a6c7641b020dc4fb63564f2599bc1292fe8b615524042ebb0da11d34a3dde4124ff0a60ce212f97bd87e1262c33de3e3d744574b17566f1ede45e399d57ce0149faa079c50384ca87cd9cb32005d85135d7e1364ee4d91c3928fc27db10df916c4d8a66d39526fa2a5b5edc2e4cc1d4282a4eae71166b5b0d05bcfd11e62bfe5f4e44fe913ce812db64c3f5c7c9111f85ebfcc7faff8cd4b52446be0854e2d698d3d6bacbdf07de3191d7ad55e908bfd76cd2352fbf8542a6b63c8002bc0d8fdcc84b39eaefb5a594f338b8cc2dbbb188721a55a882c822ddab6b2d9e3c4fcc09a7f9c151917ea86c3058c9efc593113605830f19e771c828450e4516194e638541e86d6446cbb1fbe20a80302a63f54234a9e0f718146698fa533eb283a37c14c759b3824c5b7786f8ce09af865a15343a22044c3d620d7dd845eed78bc6efd7997981818f0be978781e44284dd0007e66bc4135b9c3829057da2c3bb7156dc7469c3b2a713e26531433966eee5e5c5c9bf752529c105d02a1de81099bad347ac337736c835cde2b1fe44cb8e3de3ee4d263687bfbe2bc2bbd2dbe5f9e01237b14ab883de57958ca3f89d0a816d23968aff7cc3d701534190699410a08b52299015abec4448afd2ccafe765d140c3289ac643498dc2c00a5195e2ebc90d1be6f6afbcebc28a9a4819bf12f5e715ccc477908a1988b1537ea92247a2ce679ec8a8e9afe274e562abd9ea84f08ac45819a8511e42074db7728838af7d6179f7410950030b7d46e83ec24cfb4bb01c2fbceda44fdee858ee5878aeca5c5988c22b1dd2c81bceafca0fce0e972d706350dc15dded3da2e592f41414b4311c73542eee8668acad17ccbcecd19fff07a7cb4dcedf8deb957c4370d2b6b84ed68c16aaa112c30e3f9a9354bef53fb488a55eafee9e0348438c4e66c9b1c567e5ff401a4b473a96822015dab921b2b55aaf523eb803cd6c781d92b269515ca287a75f0fda1ce7e6a49d0fd419db54c3eef8ea5e024db6731e36a5393fae4028ea69f8ccb276e87aa421904c5564e61c1e938b71cb63ef5b97ce1182e5f3b2fd94e9db02405b7fdf0af933e732e6d9c7eccbec136be0a672c3600400c0b8c980ca80c", "bt": "libjavacrypto.so!0x38c48 <- libart.so!0x13ded8 <- libart.so!0x1347ec <- libart.so!0x1a9a98 <- libart.so!0x31b110 <- libart.so!0x3124fc <- libart.so!0x685858 <- libart.so!0x12ec98 <- libart.so!0x67f940 <- libart.so!0x12e818"}
|