105 lines
3.2 KiB
Python
105 lines
3.2 KiB
Python
#!/usr/bin/env python3
|
|
"""完整导出 libhydeviceid.so .data 段解密后的全部字符串(不截断)。
|
|
|
|
.resume 后 .data 已被 datadiv 就地解密为明文。dump 全部字节 + 全部
|
|
字符串(带偏移)到 JSON, 供离线分析 XXTEA key / 魔数 / t1 来源。
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import time
|
|
from pathlib import Path
|
|
|
|
import frida
|
|
|
|
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
|
|
OUT = Path("/Users/yml/codes/douyu_login_py/evidence/dfp_datadiv_full.json")
|
|
|
|
JS = r"""
|
|
'use strict';
|
|
Process.setExceptionHandler(function(d){ return true; });
|
|
send({type:'armed'});
|
|
|
|
var RANGES = [
|
|
[0x36aec0, 0x6e75], // .rodata
|
|
[0x3b2460, 0x74d8], // .data.rel.ro
|
|
[0x3bb000, 0x2fc08], // .data
|
|
];
|
|
|
|
function dumpSec(m, off, size){
|
|
try{
|
|
var base = m.base.add(off);
|
|
var raw = base.readByteArray(size);
|
|
var bytes = Array.from(new Uint8Array(raw));
|
|
var strs = [];
|
|
var cur = '';
|
|
var curOff = 0;
|
|
for (var i = 0; i < bytes.length; i++) {
|
|
var c = bytes[i];
|
|
if (c >= 32 && c < 127) { if (!cur) curOff = i; cur += String.fromCharCode(c); }
|
|
else {
|
|
if (cur.length >= 4) strs.push([off + curOff, cur]);
|
|
cur = '';
|
|
}
|
|
}
|
|
if (cur.length >= 4) strs.push([off + curOff, cur]);
|
|
return {sec: off.toString(16), size: size, n: strs.length, strs: strs};
|
|
}catch(e){ return {sec: off.toString(16), err: String(e)}; }
|
|
}
|
|
|
|
var tries = 0;
|
|
var iv = setInterval(function(){
|
|
tries += 1;
|
|
var m = null;
|
|
try{ m = Process.getModuleByName('libhydeviceid.so'); }catch(e){}
|
|
if (m) {
|
|
clearInterval(iv);
|
|
var out = [];
|
|
RANGES.forEach(function(r){ out.push(dumpSec(m, r[0], r[1])); });
|
|
send({type:'all', ranges: out});
|
|
} else if (tries > 100) { clearInterval(iv); send({type:'no_mod'}); }
|
|
}, 50);
|
|
"""
|
|
|
|
|
|
def main():
|
|
device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
|
|
pid = device.spawn(["com.duowan.kiwi"])
|
|
print(f"[*] spawned pid={pid}", flush=True)
|
|
session = device.attach(pid)
|
|
|
|
def on_message(message, data):
|
|
if message.get("type") == "error":
|
|
print("[JS-ERR]", str(message)[:200], flush=True); return
|
|
if message.get("type") != "send":
|
|
return
|
|
p = message.get("payload") or {}
|
|
t = p.get("type")
|
|
if t == "all":
|
|
total = sum(r.get('n', 0) for r in p.get('ranges', []))
|
|
print(f"[*] 完成, 共 {total} 条字符串 -> {OUT}", flush=True)
|
|
OUT.write_text(json.dumps(p.get('ranges'), ensure_ascii=False))
|
|
elif t == "no_mod":
|
|
print("[*] 模块未加载", flush=True)
|
|
|
|
script = session.create_script(JS)
|
|
script.on("message", on_message)
|
|
script.load()
|
|
print("[*] 主JS 已装载(resume前), 加载 bypass + resume", flush=True)
|
|
session.create_script(
|
|
(RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
|
|
).load()
|
|
session.create_script(
|
|
(RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
|
|
).load()
|
|
device.resume(pid)
|
|
time.sleep(11)
|
|
session.create_script(
|
|
(RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
|
|
).load()
|
|
time.sleep(5)
|
|
print("[*] dump 完成, 结束", flush=True)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main() |