yml2213
49c5c36c05
- 诊断报告: attach 主进程静默退出/EGL 崩溃, 仅约 4s 窗口可抓帧 - scripts: attach/spawn/hook/emu 系列 Frida 脚本与抓帧/验证工具 - evidence: identity/reqchain/frame/inputbuf/magic_buf/propedge 抓取样本, emu_* 存活对比, diag_* 策略实验, baseline 裸测基准
124 lines
3.6 KiB
Python
124 lines
3.6 KiB
Python
#!/usr/bin/env python3
|
|
"""attach 模式抓模拟器自生成 32hex hdid (对比真机 ed0db8...).
|
|
|
|
核心: hook libudbauthunify.so:
|
|
- BusinessCfg::setSafeDeviceId(0x26A2E0): a1+1008=sd, a1+1088=hdid (两者都写)
|
|
- BusinessCfg::getHdid(0x26A484): this+1088 是 std::string 对象
|
|
- createWupDeviceInfo(0x2746A0): 返回结构 +152 = hdid std::string
|
|
App 正常启动后 attach, 不做 spawn (spawn 挂起会 EGL 闪退)。
|
|
"""
|
|
import sys, time, json
|
|
import frida
|
|
|
|
REMOTE = "127.0.0.1:31878"
|
|
PACKAGE = "com.duowan.kiwi"
|
|
|
|
JS = r"""
|
|
'use strict';
|
|
function readStdString(p){
|
|
if (p.isNull()) return null;
|
|
try{
|
|
var first = p.readU8();
|
|
if ((first & 1) === 0) {
|
|
// short string: len = first>>1
|
|
var len = first >> 1;
|
|
return p.add(1).readUtf8String(len > 0 && len < 128 ? len : 0) || '';
|
|
} else {
|
|
var data = p.readPointer();
|
|
var len = p.add(8).readU64();
|
|
if (len > 0 && len < 512) return data.readUtf8String(len) || '';
|
|
return null;
|
|
}
|
|
}catch(e){ return null; }
|
|
}
|
|
function log(t, m){ send({t:t, m:m}); }
|
|
|
|
function tryInstall(){
|
|
var md = Process.findModuleByName('libudbauthunify.so');
|
|
if (!md){ return false; }
|
|
log('mod', md.base.toString() + ' size=' + md.size);
|
|
|
|
// setSafeDeviceId: a2=sd, a3=hdid (std::string*)
|
|
Interceptor.attach(md.base.add(0x26A2E0), {
|
|
onEnter: function(a){
|
|
this.sd = readStdString(a[1]);
|
|
this.hd = readStdString(a[2]);
|
|
},
|
|
onLeave: function(){
|
|
log('setSafeDeviceId', JSON.stringify({sd: (this.sd||'').slice(0,48), hd: (this.hd||'').slice(0,48)}));
|
|
}
|
|
});
|
|
|
|
// getHdid: this+1088 = std::string
|
|
Interceptor.attach(md.base.add(0x26A484), {
|
|
onEnter: function(a){ this.thiz = a[0]; },
|
|
onLeave: function(){
|
|
try{
|
|
var s = readStdString(this.thiz.add(1088));
|
|
log('getHdid', s ? ''+s : 'EMPTY');
|
|
}catch(e){ log('getHdid', 'ERR ' + e); }
|
|
}
|
|
});
|
|
|
|
// createWupDeviceInfo 输出 +152 hdid
|
|
Interceptor.attach(md.base.add(0x2746A0), {
|
|
onLeave: function(ret){
|
|
try{
|
|
var s = readStdString(ret.add(152));
|
|
log('wupDeviceInfo.hdid', s ? ''+s : 'EMPTY');
|
|
}catch(e){}
|
|
}
|
|
});
|
|
|
|
log('hooked', 'all');
|
|
return true;
|
|
}
|
|
|
|
var installed = false;
|
|
function poll(){
|
|
if (!installed){ installed = tryInstall(); }
|
|
if (!installed){ setTimeout(poll, 300); }
|
|
}
|
|
poll();
|
|
"""
|
|
|
|
def main():
|
|
dev = frida.get_device_manager().add_remote_device(REMOTE)
|
|
# 找 App 进程 attach
|
|
pid = None
|
|
for p in dev.enumerate_processes():
|
|
if p.name and PACKAGE in p.name:
|
|
pid = p.pid
|
|
break
|
|
if not pid:
|
|
print("App 未运行, 先启动:", PACKAGE)
|
|
import subprocess
|
|
subprocess.run(["adb", "-s", "127.0.0.1:5555", "shell",
|
|
"monkey -p %s -c android.intent.category.LAUNCHER 1" % PACKAGE],
|
|
capture_output=True)
|
|
time.sleep(12) # 等 lib 加载
|
|
for p in dev.enumerate_processes():
|
|
if p.name and PACKAGE in p.name:
|
|
pid = p.pid
|
|
break
|
|
if not pid:
|
|
print("仍找不到进程"); return
|
|
print("attach pid =", pid, flush=True)
|
|
session = dev.attach(pid)
|
|
|
|
def on_message(msg, data):
|
|
if msg.get("type") == "send":
|
|
pl = msg["payload"]
|
|
print("[%s] %s" % (pl["t"], pl["m"]), flush=True)
|
|
elif msg.get("type") == "error":
|
|
print("JSErr:", str(msg)[:200], flush=True)
|
|
|
|
script = session.create_script(JS)
|
|
script.on("message", on_message)
|
|
script.load()
|
|
print("等待 hook 事件 (60s)...", flush=True)
|
|
time.sleep(60)
|
|
print("done", flush=True)
|
|
|
|
if __name__ == "__main__":
|
|
main() |