66 lines
2.0 KiB
Python
66 lines
2.0 KiB
Python
#!/usr/bin/env python3
|
|
"""诊断: spawn + bypass 后进程是否存活, 崩溃原因是什么。
|
|
|
|
对照组: 不改写数据段。对比之前 patch_t1_experiment(改写 3 处)是否崩溃。
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import time
|
|
from pathlib import Path
|
|
|
|
import frida
|
|
|
|
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
|
|
|
|
JS = r"""
|
|
'use strict';
|
|
Process.setExceptionHandler(function(d){
|
|
send({type:'exception', code:d.code, addr:String(d.address), ctx:d.context});
|
|
return true;
|
|
});
|
|
send({type:'armed'});
|
|
setInterval(function(){ send({type:'alive', t:Date.now()}); }, 3000);
|
|
"""
|
|
|
|
|
|
def main():
|
|
device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
|
|
pid = device.spawn(["com.duowan.kiwi"])
|
|
print(f"[*] spawned pid={pid}", flush=True)
|
|
session = device.attach(pid)
|
|
|
|
session.on("detached", lambda reason, crash: print(
|
|
f"[DETACHED] reason={reason} crash={crash}", flush=True))
|
|
|
|
def on_message(message, data):
|
|
if message.get("type") == "error":
|
|
print("[JS-ERR]", str(message)[:200], flush=True); return
|
|
if message.get("type") != "send":
|
|
return
|
|
p = message.get("payload") or {}
|
|
t = p.get("type")
|
|
if t == "armed":
|
|
print("[*] armed", flush=True)
|
|
elif t == "exception":
|
|
print(f"[EXCEPTION] code={p.get('code')} addr={p.get('addr')}", flush=True)
|
|
elif t == "alive":
|
|
print("[*] alive", flush=True)
|
|
|
|
script = session.create_script(JS)
|
|
script.on("message", on_message)
|
|
script.load()
|
|
print("[*] 主JS 已装载(resume前), 加载 bypass + resume", flush=True)
|
|
session.create_script(
|
|
(RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
|
|
).load()
|
|
session.create_script(
|
|
(RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
|
|
).load()
|
|
device.resume(pid)
|
|
print("[*] resumed, 观察 30s", flush=True)
|
|
time.sleep(30)
|
|
print("[*] 结束", flush=True)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main() |