live-hub-py/tools/frida/hook_heapkey.js

// str-magic 命中后: Java 堆枚举 Guava/Perseus + 16字符密钥串扫描
'use strict';
function emit(row){ try{ send(row); }catch(e){} }
function hex16(b){ var h=''; for(var i=0;i<b.length;i++) h+=('0'+b[i].toString(16)).slice(-2); return h; }
for (const mod of Process.enumerateModules()) {
  let addr = null;
  try { addr = mod.getExportByName('SSL_write'); } catch(e){}
  if (!addr) continue;
  Interceptor.attach(addr, {
    onEnter(args){
      try {
        var num = args[2].toInt32();
        if (num < 60 || num > 60000) return;
        var u = new Uint8Array(args[1].readByteArray(num));
        var s = '';
        for (var i=0;i<u.length;i++) s += (u[i]>=32 && u[i]<127) ? String.fromCharCode(u[i]) : '.';
        if (s.indexOf('dfpReport') < 0 && s.indexOf('hyudbwebuif') < 0) return;
        emit({event:'str-hit', num:num});
        // 立即堆枚举 Guava (会话密钥类!)
        setTimeout(function(){
          try {
            Java.perform(function(){
              Java.enumerateClassLoaders({
                onMatch: function(loader){
                  try {
                    Java.classFactory.loader = loader;
                    Java.choose('com.tencent.turingfd.sdk.ams.ga.Guava', {
                      onMatch: function(inst){
                        try {
                          var c = inst.c.value;
                          var d = inst.d.value;
                          var b = inst.b.value;
                          emit({event:'heap-guava', c:c, d:d, bLen: b ? b.length : -1, a: inst.a.value});
                        } catch(e){ emit({event:'heap-guava-e', e:String(e).substring(0,80)}); }
                      },
                      onComplete: function(){}
                    });
                    Java.choose('com.tencent.turingfd.sdk.ams.ga.Perseus', {
                      onMatch: function(inst){
                        try {
                          var g = inst.b.value;
                          emit({event:'heap-perseus', c: g ? g.c.value : null});
                        } catch(e){}
                      },
                      onComplete: function(){ emit({event:'heap-done'}); }
                    });
                  } catch(e){}
                },
                onComplete: function(){}
              });
            });
          } catch(e){ emit({event:'heap-exc', e:String(e).substring(0,100)}); }
        }, 300);
      } catch(e){}
    }
  });
}