yml2213
f20cc67239
- 结构: getDfpConfig(81B密文配置)->selectOperator(SDID+hyudb_ts)->dfpReport(10B魔数+3988B密文体)->服务端回t1/SDID - 魔数/协议串147库全零: 运行时装配/turing混淆; Java无dfp类 - 关键材料: mpdc_108298_1=32hex设备号0399ED0B...; ga2 1860B; .turing.dat 76B - Java全量hook方案弃用(闪退); turing=工业级SDK, 建议独立子项目
20 lines
623 B
JavaScript
20 lines
623 B
JavaScript
'use strict';
|
|
// 扫描进程内魔数 571882cf664bb39401ee
|
|
const PATTERN = '57 18 82 cf 66 4b b3 94 01 ee';
|
|
const mods = Process.enumerateModules();
|
|
const hits = [];
|
|
for (const m of mods) {
|
|
if (m.size > 300 * 1024 * 1024) continue;
|
|
try {
|
|
Memory.scan(m.base, m.size, PATTERN, {
|
|
onMatch(addr, size) {
|
|
const mm = Process.findModuleByAddress(addr);
|
|
const off = mm ? addr.sub(mm.base) : addr;
|
|
hits.push({ mod: mm ? mm.name : '?', off: off.toString() });
|
|
},
|
|
onComplete() {},
|
|
});
|
|
} catch (e) {}
|
|
}
|
|
send({ event: 'magic-scan', hits: hits.slice(0, 40), total: hits.length });
|