- turing类定位(ga果汁混淆系) + Java载荷hook零触发(=全native, 路线关闭) - 静态密钥假设否定; 流式密文实锤 - 交接: 密文x3/请求全文/组件/工具/触发方法全收录 (docs §11.49)
59 lines
2.6 KiB
JavaScript
59 lines
2.6 KiB
JavaScript
'use strict';
|
|
function emit(row) { try { send(row); } catch (e) {} }
|
|
setTimeout(() => {
|
|
try {
|
|
Java.perform(() => {
|
|
const found = [];
|
|
Java.enumerateLoadedClasses({
|
|
onMatch(name) {
|
|
if (/Turing|turing|DFp|Dfp|dfp/i.test(name)) found.push(name);
|
|
},
|
|
onComplete() {
|
|
emit({ event: 'turing-classes', list: found.slice(0, 30) });
|
|
const hooked = {};
|
|
for (const cn of found.slice(0, 20)) {
|
|
try {
|
|
const K = Java.use(cn);
|
|
const ms = K.class.getDeclaredMethods();
|
|
for (const m of ms) {
|
|
const mn = m.getName();
|
|
const pt = m.getParameterTypes();
|
|
const hasPayload = Array.from(pt).some(t => ['byte[]','java.lang.String','[B','java.util.Map'].indexOf(t.getName()) >= 0);
|
|
if (!hasPayload) continue;
|
|
const dsc = m.toGenericString ? m.toGenericString().slice(0, 120) : mn;
|
|
try {
|
|
K[mn].overloads.forEach(ov => {
|
|
const key = cn + '#' + mn + '#' + ov.argumentTypes.length;
|
|
if (hooked[key]) return;
|
|
hooked[key] = true;
|
|
ov.implementation = function () {
|
|
try {
|
|
const args = Array.from(arguments).map((a, ix) => {
|
|
try {
|
|
if (a === null || a === undefined) return String(a);
|
|
if (ov.argumentTypes[ix] && ov.argumentTypes[ix].className === 'byte[]') {
|
|
const arr = Java.array('byte', a);
|
|
return 'byte[' + arr.length + ']:' + Array.from(arr.slice(0, 60)).map(b => (b & 0xff).toString(16).padStart(2, '0')).join('');
|
|
}
|
|
const s = String(a);
|
|
return s.length > 120 ? s.slice(0, 60) + '…(' + s.length + ')' : s;
|
|
} catch (e2) { return '<a>'; }
|
|
});
|
|
emit({ event: 'turing-jni', cls: cn, method: mn, nArgs: args.length, args: args.slice(0, 5) });
|
|
} catch (e3) {}
|
|
return ov.apply(this, arguments);
|
|
};
|
|
});
|
|
} catch (e4) {}
|
|
}
|
|
} catch (e5) {}
|
|
}
|
|
emit({ event: 'turing-hooks-done', n: Object.keys(hooked).length });
|
|
},
|
|
});
|
|
});
|
|
} catch (e) {
|
|
emit({ event: 'turing-err', msg: String(e).slice(0, 200) });
|
|
}
|
|
}, 3500);
|