yml2213
b06a768eb2
- hook_ssl_magic.js: SSL_write明文扫魔数, 命中即全量dump+杀进程 - 捕获: 3798B POST (hyudbwebuif/dfpReport, tReq tag1=[10B魔数]+3531B密文) - 触发: 清turing状态重注册 (备份tar零副作用) - 动态插件定位: libturingmfa.so(v87)/libturingga.so(v2.92.2) - evidence/dfp_live/ 存档; docs §11.47
13 lines
990 B
JSON
13 lines
990 B
JSON
{"event": "ssl-hook", "module": "libjavacrypto.so"}
|
|
{"event": "ssl-hook", "module": "libssl.so"}
|
|
{"event": "ssl-hook", "module": "libhyssl.so"}
|
|
{"event": "ssl-hook", "module": "libmarsstn.so"}
|
|
{"event": "ssl-hook", "module": "libhyquic.so"}
|
|
{"event": "ssl-hook", "module": "libngtcp2_crypto_boringssl.so"}
|
|
{"event": "ssl-hook", "module": "libposix_quic_ngtcp.so"}
|
|
{"event": "ssl-hook", "module": "libhysignalcore.so"}
|
|
{"event": "ssl-hook", "module": "libhymediatrans.so"}
|
|
{"event": "ssl-hook", "module": "libYCloudLive.so"}
|
|
{"event": "ssl-hook", "module": "libhydt.so"}
|
|
{"event": "ssl-magic", "module": "libjavacrypto.so", "num": 4201, "off": 257, "head": "571882cf664bb39401ee7cda1189c1750c9c4d56ddf3a91b0881cc464cb378e0397bdaa32175b402f2fa7ca4ad383247925ee3e31158ad8b6631b964f9c12ee6475e037bc5508deb6de633ac5100c8fde3b712b36cd6b570ec55131e60a866817e5e29da3128d1ef2eb49b88a9c1da529e208e3be6ae1383583aba1490d4643a06386723d5e2134f81830671d9ad1bfce909530228c2f84e9133a501a5486fd7", "bt": ""}
|