yml2213
49c5c36c05
- 诊断报告: attach 主进程静默退出/EGL 崩溃, 仅约 4s 窗口可抓帧 - scripts: attach/spawn/hook/emu 系列 Frida 脚本与抓帧/验证工具 - evidence: identity/reqchain/frame/inputbuf/magic_buf/propedge 抓取样本, emu_* 存活对比, diag_* 策略实验, baseline 裸测基准
118 lines
3.9 KiB
Python
118 lines
3.9 KiB
Python
#!/usr/bin/env python3
|
|
"""对照测试: attach + bypass 存活(多轮), 附加 main hook 存活(多轮)。
|
|
每种配置重复 ROUNDS 次, 记录每次的存活时间与崩溃点, 避免单次误判。
|
|
"""
|
|
from __future__ import annotations
|
|
import frida, time, subprocess, json
|
|
from pathlib import Path
|
|
|
|
REMOTE = "127.0.0.1:31878"
|
|
PACKAGE = "com.duowan.kiwi"
|
|
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
|
|
BYPASSES = ["bypass_msaoaid_maps_art_callsite.js", "mask_frida_maps_only.js", "patch_guard_block_termination.js"]
|
|
|
|
MAIN_JS_HOOK = """
|
|
'use strict';
|
|
send({type:'armed'});
|
|
function hexb(p,n){try{return Array.from(new Uint8Array(p.readByteArray(n))).map(b=>('0'+b.toString(16)).slice(-2)).join('');}catch(e){return '';}}
|
|
function head(p,n){try{return p.readCString(n);}catch(e){return '';}}
|
|
// 只 hook SSL_write, 最小主 hook
|
|
try{
|
|
var r=new ApiResolver('module');
|
|
r.enumerateMatchesSync('exports:*!SSL_write').forEach(function(m){
|
|
Interceptor.attach(m.address,{onEnter:function(a){
|
|
var len=a[2].toInt32();
|
|
if(len<50||len>50000)return;
|
|
var h=head(a[1],Math.min(len,1500));
|
|
if(h.indexOf('dfpReport')>=0||h.indexOf('dckey')>=0){
|
|
send({cls:h.indexOf('dfpReport')>=0?'dfpReport':'dckey',len:len});
|
|
}
|
|
}});
|
|
});
|
|
send({type:'hooked'});
|
|
}catch(e){send({type:'err',e:String(e)});}
|
|
"""
|
|
|
|
ROUNDS = 3
|
|
OBSERVE = 35 # 每轮观察秒数
|
|
|
|
|
|
def launch():
|
|
subprocess.run(["adb","-s","127.0.0.1:5555","shell","am","force-stop",PACKAGE], capture_output=True)
|
|
time.sleep(1.2)
|
|
subprocess.run(["adb","-s","127.0.0.1:5555","shell","monkey","-p",PACKAGE,"-c","android.intent.category.LAUNCHER","1"], capture_output=True)
|
|
|
|
|
|
def get_pid(d, timeout=20):
|
|
for _ in range(timeout):
|
|
r = subprocess.run(["adb","-s","127.0.0.1:5555","shell","pidof",PACKAGE], capture_output=True, text=True)
|
|
p = r.stdout.strip()
|
|
if p:
|
|
return int(p)
|
|
time.sleep(1)
|
|
return None
|
|
|
|
|
|
def load_bypass(s):
|
|
for name in BYPASSES:
|
|
try:
|
|
sc = s.create_script((RE/"evidence/scripts"/name).read_text()); sc.load(); time.sleep(0.2)
|
|
except Exception as e:
|
|
print(f" bp {name} err {e}", flush=True)
|
|
|
|
|
|
def observe(d, pid, s, with_hook, tag):
|
|
t0 = time.time()
|
|
events = []
|
|
if with_hook:
|
|
sc = s.create_script(MAIN_JS_HOOK)
|
|
sc.on('message', lambda m, dd: events.append(m.get('payload')) if m.get('type')=='send' else None)
|
|
sc.load()
|
|
# 观察
|
|
prev = 0
|
|
died_at = None
|
|
for t in [5, 10, 15, 20, 25, 30, OBSERVE]:
|
|
time.sleep(t - prev); prev = t
|
|
try:
|
|
alive = [p for p in d.enumerate_processes() if p.pid == pid]
|
|
except Exception:
|
|
broken = True
|
|
died_at = t
|
|
break
|
|
if not alive:
|
|
died_at = t
|
|
break
|
|
status = f"DEAD at +{died_at}s" if died_at else f"alive>{OBSERVE}s"
|
|
dfp = [e for e in events if isinstance(e, dict) and e.get('cls')=='dfpReport']
|
|
print(f" [{tag}] {status} | dfp hooks={len(dfp)}", flush=True)
|
|
return status, len(dfp)
|
|
|
|
|
|
def run_round(d, with_hook):
|
|
launch()
|
|
pid = get_pid(d)
|
|
if not pid:
|
|
return "launch-fail", 0
|
|
try:
|
|
s = d.attach(pid)
|
|
except Exception as e:
|
|
return f"attach-err {e}", 0
|
|
load_bypass(s)
|
|
return observe(d, pid, s, with_hook, "hook" if with_hook else "bypass-only")
|
|
|
|
|
|
def main():
|
|
d = frida.get_device_manager().add_remote_device(REMOTE)
|
|
print("=== A: 纯 attach + bypass (无主hook), 重复 %d 轮 ===" % ROUNDS, flush=True)
|
|
for i in range(1, ROUNDS+1):
|
|
st, n = run_round(d, with_hook=False)
|
|
print(f" A#{i}: {st}", flush=True)
|
|
time.sleep(2)
|
|
print("=== B: attach + bypass + SSL_write主hook, 重复 %d 轮 ===" % ROUNDS, flush=True)
|
|
for i in range(1, ROUNDS+1):
|
|
st, n = run_round(d, with_hook=True)
|
|
print(f" B#{i}: {st} (dfp={n})", flush=True)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main() |