live-hub-py/tools/frida/hook_final.js

// 终极: SSL抓POST(full!) + 堆取Guava密钥 + Java Cprivate.a当场解密!
function emit(o){ try{ send(o); }catch(e){} }
let gotKey = null, tried = 0;
for (const mod of Process.enumerateModules()) {
  let addr = null;
  try { addr = mod.getExportByName('SSL_write'); } catch(e){}
  if (!addr) continue;
  Interceptor.attach(addr, {
    onEnter(args){
      try {
        var num = args[2].toInt32();
        if (num < 60 || num > 60000) return;
        var u = new Uint8Array(args[1].readByteArray(num));
        var s = '';
        for (var i=0;i<u.length;i++) s += (u[i]>=32 && u[i]<127) ? String.fromCharCode(u[i]) : '.';
        if (s.indexOf('dfpReport') < 0 && s.indexOf('hyudbwebuif') < 0) return;
        var hex = Array.prototype.map.call(u, function(x){return ('0'+x.toString(16)).slice(-2)}).join('');
        emit({event:'post-full', num:num, hex:hex});
        // 堆取密钥
        setTimeout(function(){
          try {
            Java.perform(function(){
              Java.enumerateClassLoaders({
                onMatch: function(loader){
                  try {
                    Java.classFactory.loader = loader;
                    Java.choose('com.tencent.turingfd.sdk.ams.ga.Perseus', {
                      onMatch: function(inst){
                        try {
                          var g = inst.b.value;
                          if (g && !gotKey) { gotKey = g.c.value; emit({event:'key', c:gotKey}); }
                        } catch(e){}
                      },
                      onComplete: function(){
                        if (gotKey && tried < 3) {
                          tried++;
                          try {
                            var C = Java.use('com.tencent.turingfd.sdk.ams.ga.private');
                            var Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon');
                            // 密文 = body内 magic@后; 简化: 用整 POST 找 571882cf...
                            var needle = [0x57,0x18,0x82,0xcf,0x66,0x4b,0xb3,0x94,0x01,0xee];
                            var idx = hex.indexOf('571882cf664bb39401ee');
                            var cipherHex = idx >= 0 ? hex.substring(idx+20) : '';
                            if (cipherHex.length > 16) {
                              var bytes = [];
                              for (var i=0;i<cipherHex.length;i+=2) bytes.push(parseInt(cipherHex.substr(i,2),16));
                              var arr = Java.array('byte', bytes);
                              var karr = Java.use('java.lang.String').$new(gotKey).getBytes('UTF-8');
                              var plain = C.a(arr, karr);
                              if (plain === null) emit({event:'dec-null'});
                              else emit({event:'dec-ok', len:plain.length, hex:Melon.a(plain).substring(0,800)});
                            }
                          } catch(e){ emit({event:'dec-e', e:String(e).substring(0,120)}); }
                        }
                      }
                    });
                  } catch(e){}
                },
                onComplete: function(){}
              });
            });
          } catch(e){}
        }, 400);
      } catch(e){}
    }
  });
}