yml2213
39c516b71b
- hook_str_magic.js: dfpReport/hyudbwebuif字符串过滤替代魔数(不漏轮次) + 全量请求dump - 采样集: golden+f1..f4+新身份B(0647) — 新身份头12B=旧身份一致(nonce与身份无关) - nonce块: [7cda][版本][69c9f5][计数递增][稳定段] ; 运行时路线终态(Java桥/co-located/回溯全闭) - 触发-捕获-存档 ~40s/轮 全自动; evidence/dfp_live/ 齐全
34 lines
11 KiB
JSON
34 lines
11 KiB
JSON
{"event": "ssl-hooked", "module": "libjavacrypto.so"}
|
|
{"event": "ssl-hooked", "module": "libssl.so"}
|
|
{"event": "ssl-hooked", "module": "libhyssl.so"}
|
|
{"event": "ssl-hooked", "module": "libmarsstn.so"}
|
|
{"event": "ssl-hooked", "module": "libhyquic.so"}
|
|
{"event": "ssl-hooked", "module": "libngtcp2_crypto_boringssl.so"}
|
|
{"event": "ssl-hooked", "module": "libposix_quic_ngtcp.so"}
|
|
{"event": "ssl-hooked", "module": "libhysignalcore.so"}
|
|
{"event": "ssl-hooked", "module": "libhymediatrans.so"}
|
|
{"event": "ssl-hooked", "module": "libYCloudLive.so"}
|
|
{"event": "ssl-hooked", "module": "libhydt.so"}
|
|
{"event": "ssl-heartbeat", "module": "libhydt.so", "writes": 40}
|
|
{"event": "ssl-heartbeat", "module": "libngtcp2_crypto_boringssl.so", "writes": 80}
|
|
{"event": "ssl-heartbeat", "module": "libngtcp2_crypto_boringssl.so", "writes": 120}
|
|
{"event": "ssl-heartbeat", "module": "libhysignalcore.so", "writes": 160}
|
|
{"event": "ssl-heartbeat", "module": "libhyssl.so", "writes": 200}
|
|
{"event": "ssl-heartbeat", "module": "libposix_quic_ngtcp.so", "writes": 240}
|
|
{"event": "ssl-heartbeat", "module": "libhydt.so", "writes": 280}
|
|
{"event": "ssl-heartbeat", "module": "libngtcp2_crypto_boringssl.so", "writes": 320}
|
|
{"event": "ssl-heartbeat", "module": "libhysignalcore.so", "writes": 360}
|
|
{"event": "ssl-heartbeat", "module": "libhyssl.so", "writes": 400}
|
|
{"event": "ssl-heartbeat", "module": "libssl.so", "writes": 440}
|
|
{"event": "ssl-heartbeat", "module": "libposix_quic_ngtcp.so", "writes": 480}
|
|
{"event": "ssl-heartbeat", "module": "libngtcp2_crypto_boringssl.so", "writes": 520}
|
|
{"event": "ssl-heartbeat", "module": "libYCloudLive.so", "writes": 560}
|
|
{"event": "ssl-heartbeat", "module": "libhyquic.so", "writes": 600}
|
|
{"event": "ssl-heartbeat", "module": "libhysignalcore.so", "writes": 640}
|
|
{"event": "ssl-heartbeat", "module": "libYCloudLive.so", "writes": 680}
|
|
{"event": "ssl-heartbeat", "module": "libhyquic.so", "writes": 720}
|
|
{"event": "ssl-heartbeat", "module": "libposix_quic_ngtcp.so", "writes": 760}
|
|
{"event": "ssl-heartbeat", "module": "libngtcp2_crypto_boringssl.so", "writes": 800}
|
|
{"event": "str-magic", "module": "libjavacrypto.so", "num": 4286, "full": "504f5354202f20485454502f312e310d0a692d7665723a20310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6f637465742d73747265616d0d0a436f6e74656e742d4c656e6774683a20343039390d0a486f73743a2077736170692e687579612e636f6d0d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a557365722d4167656e743a206f6b687474702f332e31342e390d0a0d0a0000100310032c3c4c560c68757961756462776562756966096466705265706f72747d00010fd70800010604745265711d00010fc90a06001607616e64726f69642d00010fb3571882cf664bb39401ee7cda1169c9f5289c4d46a1de05113f9b97c67c5fb2479793b015b30011a6c902e7a242e7c820696569724b2704f5547cf7849d70c4ed381b0616447fe6b315952f42dca1045051950db3e43d524cf71f79ff4ec0c8f6f1afb082e6571f28f28edcddb1635eecd613b101bad7df31fdf773783179b3b8da919c7e0a21b0eaec1ff719d052dd17e9b87e4b2f7cac54f36d97ff8fca512c359b2c054c463b72b0b509a17c92e04d39e2c6261b2175d8ae54901db050e79145cd7baa11a07e978c5f394cafdeef8c81063822846e7ec38177f5cd791610bf11070a5322ad7be77ee38f43573df6bdacc6ab5292d68c0374e2ec6147132881c630d675ed2dd971a411a5cd52b9ef1568c13cef2ecfc7eff0b943c608d8a7b529756ffe33000b79643314f2b8d10391c1760da7ac1ab838a3bcc60409650b086e3900d0ea8257e22b72c4f27fedc4e97a9451c0dbde3ba6022161db2e6712df34fe9aee9e316ac1e483b903841222d8d5de2d861d90b877d5d76cdf79d4fef0bb7826d6409e08c91164c64ae5b4ea5bf3efadd006c719bf54a6c62a5c6f04a3f183d123f2a0deb26bbfad8bfc534abaa075a68f39360b896a90d75ca77191e9884ba2a567b5855c0e9802fcfc2bcc37b3443fa469e20806853f9a3567171e378220a7b15dc7c10244fea46d39735c8e8c79511e22eef2a091ed467ea48774292fba2f7122fdab431150cf27207665fe1842f44b93e37649f3fed2595aec109852dc9283e0dcd68865e74bf8bd44789aade35ef7448aa2a20e7d7401445ac443820023bc46a0225afc63068bff007b7418b3efee3b5f5bc86bae31a8fd1dda0e5dd8c1ad37c9736ea0787dfcccce1fd1f0c5346bb71a11f7e2e8139f5b4cff10056caeeee18954045f54f687a1b64407ea8fb1f6c8907f7429b1244b3d0766866cc620e8d2164f6a291ff5730adf5d6ee085b0961b05d8a3c0d32e69d372eede6d5f1f8fa98df3a43949e43450b52271540831bda33e9c493e23842ec58e351f86219aaa90d37afd8951cd81f9c8c41e8f6ccd67cbf158407406abc88d321fdc9c81e4ace91fcb37b32ddf47d9ed1baab3d3cbb3e8c69afaef2166452c5b13ee7b16a8ca6cba69b1b24f810e6392e446a54a53627c6737a9dc56a49fad209c3663aca1d5946e17e2cd98b9ebed86ac86ff336051d0c70432a91e6c09fa6266a43a74ea8588b46db4fe356f0863f146a955a8b197d0d606fc85b43371bcd41b6944f3b0ed9d6898aa2eddd5774375d0b3c89ee9bdf837837a72acfecad9fa03d408d094e01f71fa8be8babfc8041cb95d1464fb160f0ee3af9ce6f50bfcd8b9b4239cea3311e4baf54b33e8e8526211e82a27fbf01900e91b1f03731aff16b5b0f0d67ddd9bfbceb274496b504d4c4511a5d6abfa7400d8d9681e57fb81da687e3e6e815785dbfb26a7d963ce63da1176754b47be10f953ffce9e3d6b87bef4bed96571d8b07b173d4558c7a4b9d9ecd27b0e32dc8dde7d325ba978b8083dd1cd9cda701e581a824eae5dbe114321655f24789b9aa0a664ea6d9e4ad00a3d6b0018d324998ae96a360ac6308d05987123b63e3888ad16b085babae4e2955e3a3b892d8903fadd8cc5963240e6c2ba25850f956d33f8d033cf4dcb7b74a7c80f4b4286e7de439fa1eb9b332b7e8530ff8fa6ae259c766c93363006b1ec069a064fa2a08e5d4d92362937f2e9f5edcb3c166799048699ed73767ef98a75858ea9d4d0d40b7a27046758e38a8f1f35c0d0e9960f4e1f4e53c0b45a3ebd764e427f57753b462667c7ace98185e65021e01a47f4646d4489d933293d08c4a60737fc526ff8c9df329fd87d4cb3669e3a0e7acef6086a51b843989549bdae9e999fe7a1c5fcee6f166d9b9dd9c7a26d1659220defdeac0c00a13f682a5374bf88edff5133f165845763735027a5ebd7f21aa586001431ca8c717a24c2e140469157e8434f9f88fb0105132fc78d7ec5a72a4115e5dabf741635243436e687b3074bdb600047ff0ce3181ea4df4eed3f598af225e5aac97f12954b5b2c137f32f39a7ab9b88b5f445a2d113d3daba8ffc6cfed80ad8b1e23c557ba85bf0dea7ed03206fbdc404083b1ad7df9ccf3427a7e9d81a30d836335b2259542e13a0a6ab200dd120bfb76412e845881358f639241a9313a77c6e45977009c559edea6f5b732fdca21eb2388d79dc48c5616ccbd817d346b4f39a3eabaccbf694dc618e2b3aad39047b653a0c6afb833da8fb91dfa5fb53cb96266d7b76d31a37451eff4d3c5c844e3777d02994531243a40cf2ff8efbb3c54fd90c20b3fada195a1de88319160faab677d27c5e7ff67d8f4d79029b89e033f35383831ed7526630c714bc18f00a17e8f2b2f4e7d9b017a65838f2dfb1c9faa69ad2eaa11452cf67c51b8443ce0b49afbd001f31fade971f237351b8a801db3b0ca2c2052d718aa76fa9dcab1a629e69e56ce525727b9afaf7b6b35b6c16137bc6d2553b0c9bee3821ca5a1317f132ba83bb8c24bd750684910078afa37bbbb7f55374e46777a3d8ff2adf1e7b4176a77366ac9fd4310cbe5fe4f7d6bc8ea8e302ce864a85f15c1def6669705ec60784d666047d2d17cde379b8858c22efb22f2feb23bedbd3ac3c4e9b8dc0a563b15fa098ba9f5fece6d6c1d6661dc8c7ac55ef401105721a6d08e56430527e7f61df76016dff869bbce1fc8a65e8c831102e547fdba20aa669b5e282eef75797146b7a7df550c04dd160c7434c9857506e633a22997ee38fd9d9161ad03a754c8efc3fcb96a3192eba946edc1de4f1fb21daa6d1550107bc7d07029d714f1438aadba48763bcc455f785b06804b241da15f55502b88fb37d7731000042fa2317a1b2c53d3d1e09cf8a2976bde63cb2363cd5c47e975dd0e8ee2d4aba4d8347d8a5c635739fcaf3018ab65c02e083d0c04bd140ffa0c500050f6f5b678eda74f33ed47c86117526bf81d19ced47c3dfe7482d079253858653feda2593b725cad1612725cfda94a977f2fb8bd7f4885c70583d0269ea30d5ca75edb662698b3792ff6979204d47ebb49979550923cbf414c45b87c6d5d74616d7fb33d5f656064fae252c985010825d791adf1b7070e9909c53d4df880b9aafdca6ea191f57c3a807faa0536f1a6c5687abff9d825f889ef2051d36acbc0872a88e9c35b09523da4867acb30691b0db8ba4bbffee8ffb55b96656fcfacc9498fc0bdff5c90bc8f741117f6d4239258efc14a423cee18d932828a6ec9130be295a77ed30d99a7114b3c33ae44c6af554b65dedc10dd0758678d36e1dec0bbc893bac5f5cf229fb7ba1dd9742c1333d46aec8a1bf1e8b492f7e494b778614c7428b57fcdce23ca8107b85902a958e700ae37e4823ab71ae754f59b71c3f6aee8ccdcc024a090c66be3ddefcca80524820ffab1e85f4d4be15e15a1bba5cf19d44ccaaacd88039a104bc8372ecd1b18db48042432b5740461f2055bf066f564cc4761c1316cbfacecf62e19b5d38ee4dfbb910a956619661df645c85ce84013f67299b14cf784d494344eceb651ed45057aa62d90683b171ab38165091b00b89adedfad1f1f44be6677a4aa89fc50bb8b99fb15bedbc1e40a7c5f76d1218fef53b863b0c1e1e4841cad4419af95a9736b420780b47e8c5ba24c5e837eb4705567760a476928c443496fd2a6f27789476e56202b4ab08d56c177948992a2a311999b9b93f9499301b7e7aeefe8604f1a205d77958b6fa0d728de4b0e7c5c66489106f142f04ff591d8e56ba07fa6985cd8632c64ddeca4a19c5b9ef4875dba37a34fcb61fa34a8c4bde907559410f10c24739c3bc37ee3921f23ca2ec1b61a66b38dd6c3378cbd2302dfd11a474cf918637b7f1a567e6bb6dc88c48ac84971b045f50679855b04f0214513b771ab19c580bab53a1c07629d46e3716239f94ddb10ec5c8519184b369f272b7d857a2755355725fc2c72a1cdd7da314e2c421d0e8030fcc96b9fe7152ed4663881187347c90224262dc96b2041284fa072703480af05a749633b30d2e62bada0a1b393e06896aea9391a8df64c42db3f705b51782aaea57f6b6b091e311eb4aa5e75efbddd1d644a0ddf4cd32daaa6de7bed1a62061e4e6baaaed8683544b1d18c73aa5a023996a5325cc0d4bf4df7bc3bb78c0adbb71c5d94d22e7bc7819ee9a89b17b70dae31ae37ba0a6fbff6cb78689807343dde8de557b371846c4f2d4778979c5d1966a64d375a9c90567ffdefe21b27087537aac02b96a88958e2e1b64615ac7602f886b5d6c6f10eaa8d38e5a5bc26422dd5b742c8196af07c6198cc8b940acf63d81e0c33fa6b4093f38d7e927b6f8abaa6636cc0752cde577fe3fa2e4f7d4eefb7a4a20362014f5fe40b5654e744c173954c5c0222af2a5b2a1cb6f80966554c50ec518bc6eaca3466b0ea9e93a936413cee974dc00f6947e5c738efddf3534275535bc0f7488c3a91ad5ae70d6127b5a19c8ced18eefe783358b324b5d8f14f2614f7bc9c4c187d669c7b1a747909a961189faf6e4ee93d7a1c938a02240f76682f5b3ac14cd9c378383545d9da6f738f3c624f7b8db33a4483442ff64ce3b212053b861b9acfd3ee626645f8a75479414f0716bfac7860b2654fbfc6e5290c284ea8b35f6c8a1efbfe330e34fe2bf5cc2464bbb2624dfa5be511347c46a9095c6d5b9beb9c2f00811d8135ebbd86d4ad262ff6c7b58efc6c421266d6d6cbafc0da1413874524a6367828633521e29e3bbc5ceebf0610ca291c6f44c6cc1f70d4e4677c5f78612da8f18a06a1c74267afc0c0afbb2addd455844d2ec5b15015f4b0501fd682415c6cc030d56a2b2e52c46ba8854c23a479c8d26fe898af3b0a5e36f864d00b280533355d573cfebb9c1856a9e464ef3ca60d123dfb56ec86b1892e31b40fdaf05f85d3b57fffa0da2b1bb114e8a9b498ecc1a520e8a740ebf17d167503f529e1b3e0205930ec354be886d4be1d3198956563f0523a7c17a1da663bef257cca7472b629331620d19e4af1d8c98e9a42fa763073ad22f5be425eb2643e512de1f2a51596cee9f6d208399793558d8d82a17f597a78a67aefc22fb1c311ac25ab94d37f4e39a066ec3198eb3dc2b32499d968db6b33e21e24e646219198d8bf0bfbc255b2245094cc07b833fd81840b762a7cc8bb5bdfdaf1949556fdb008df72e754e5346dc9da13cadde6acbea5747644dc5dde6c8a098f7bb8f4e453a737ce7e0d0df6f02fd4e2a321a44aac53bc1dde34ed156b7f171ef8f78177eab98f15e9da35ff7575f2bc44ffc59b87a8eec5e641885a3bd693f676489853de495c3084542476140d0238734c6434cd87fd63175e9058dbae2f3fd435808eb46349d3a01358ef9558a4429d766af316ab27b5856e4d70e8a01c418646091621722618148b15507e63e434d23634e32efc945e07ceb919a25e35776647b400d6bf36cc72b4b745d57440833a94bc9ebd78d65923aa76126796057c063885f65f986058f09d7a4b6e865c01ebd75fcc312bd391ca54eb6fb8101bded18d7576695bfdddf49ba4dbf44882b3b3a8d4a380854040e3a0998de2ac9a40dcd78d01ad0bc62604b374233efdbde9a9f253e069c88420e6e3b92f3c14c724048598f0c042e8e576e347994c333600400c0b8c980ca80c", "bt": "libjavacrypto.so!0x38c48 <- libart.so!0x13ded8 <- libart.so!0x1347ec <- libart.so!0x1a9a98 <- libart.so!0x31b110 <- libart.so!0x3124fc <- libart.so!0x685858 <- libart.so!0x12ec98 <- libart.so!0x67f940 <- libart.so!0x12e818 <- libart.so!0x681fbc <- libart.so!0x12e918 <- libart.so!0x681fbc <- libart.so!0x12e918 <- libart.so!0x308a38 <- libart.so!0x66e3a8"}
|
|
{"event": "co-done", "n": 0, "regions": 6}
|