122 lines
4.0 KiB
Python
122 lines
4.0 KiB
Python
#!/usr/bin/env python3
|
|
"""resume 前加载 datadiv hook: 抓 JNI_OnLoad 阶段批量解密的字符串。
|
|
|
|
libhydeviceid.so 的 .datadiv_decode* 在 so 加载/JNI_OnLoad 时执行，
|
|
用内部 XXTEA 解密业务字符串(含可能的魔数/dfp 配置)。必须在 resume 前
|
|
装载 hook 才能抓到加载期调用。命中(5718 或长可读串)即持久化。
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import time
|
|
from pathlib import Path
|
|
|
|
import frida
|
|
|
|
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
|
|
OUT = Path("/Users/yml/codes/douyu_login_py/evidence/dfp_datadiv_preload.json")
|
|
|
|
JS = r"""
|
|
'use strict';
|
|
Process.setExceptionHandler(function(d){ return true; });
|
|
send({type:'armed'});
|
|
|
|
function hex(p, n){
|
|
try{ return Array.from(new Uint8Array(p.readByteArray(n))).map(x=>('0'+x.toString(16)).slice(-2)).join(''); }
|
|
catch(e){ return 'ERR'; }
|
|
}
|
|
|
|
var hookedCount = 0;
|
|
function hookModule(modName){
|
|
var m = null;
|
|
try{ m = Process.getModuleByName(modName); }catch(e){ return; }
|
|
m.enumerateExports().forEach(function(exp){
|
|
if (exp.name.indexOf('datadiv') < 0) return;
|
|
try{
|
|
Interceptor.attach(exp.address, {
|
|
onEnter: function(){ this.t0 = Date.now(); },
|
|
onLeave: function(ret){
|
|
var p = ret;
|
|
if (p.isNull()) return;
|
|
var h64 = '';
|
|
try{ h64 = hex(p, 96); }catch(e){ return; }
|
|
if (h64.indexOf('ERR') >= 0) return;
|
|
var low = h64.toLowerCase();
|
|
var str = '';
|
|
try{ str = p.readUtf8String(); }catch(e){}
|
|
var hit = low.indexOf('5718') >= 0 || (str && str.length >= 8);
|
|
if (hit) {
|
|
send({type:'dd', mod:modName, fn:exp.name, off:exp.address.sub(m.base).toString(),
|
|
h96:h64, str:str, dt:Date.now()-this.t0});
|
|
}
|
|
}
|
|
});
|
|
hookedCount += 1;
|
|
}catch(e){}
|
|
});
|
|
}
|
|
|
|
// 轮询等 so 加载 (JNI_OnLoad 前必须挂上!)
|
|
var iv = setInterval(function(){
|
|
hookModule('libhydeviceid.so');
|
|
hookModule('libudbauthunify.so');
|
|
if (hookedCount > 100) { clearInterval(iv); send({type:'hooked', n:hookedCount}); }
|
|
else if (hookedCount > 0) { clearInterval(iv); send({type:'hooked', n:hookedCount}); }
|
|
}, 20);
|
|
"""
|
|
|
|
|
|
def main():
|
|
device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
|
|
pid = device.spawn(["com.duowan.kiwi"])
|
|
print(f"[*] spawned pid={pid}", flush=True)
|
|
session = device.attach(pid)
|
|
|
|
events = []
|
|
|
|
def on_message(message, data):
|
|
if message.get("type") == "error":
|
|
print("[JS-ERR]", str(message)[:200], flush=True); return
|
|
if message.get("type") != "send":
|
|
return
|
|
p = message.get("payload") or {}
|
|
t = p.get("type")
|
|
if t == "dd":
|
|
print(f"[dd] {p.get('mod')} {p.get('fn')}({p.get('off')}) "
|
|
f"dt={p.get('dt')}ms str={p.get('str')!r}", flush=True)
|
|
print(f" h96: {p.get('h96')}", flush=True)
|
|
events.append(p)
|
|
OUT.write_text(json.dumps(events, indent=1))
|
|
elif t == "hooked":
|
|
print(f"[*] hooked {p.get('n')} datadiv (resume前)", flush=True)
|
|
elif t == "armed":
|
|
pass
|
|
|
|
# 主 hook 在 resume 前 load!
|
|
script = session.create_script(JS)
|
|
script.on("message", on_message)
|
|
script.load()
|
|
print("[*] 主hook 已装载(resume前), 现在加载 bypass + resume", flush=True)
|
|
|
|
session.create_script(
|
|
(RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
|
|
).load()
|
|
session.create_script(
|
|
(RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
|
|
).load()
|
|
device.resume(pid)
|
|
time.sleep(11)
|
|
session.create_script(
|
|
(RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
|
|
).load()
|
|
print("[*] 已 resume, 请触发登录 (命中即 pkill, 脚本会持续到手动停)", flush=True)
|
|
try:
|
|
while True:
|
|
time.sleep(5)
|
|
except KeyboardInterrupt:
|
|
pass
|
|
print(f"[*] 结束, {len(events)} 条 -> {OUT}", flush=True)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main() |