yml2213
49c5c36c05
- 诊断报告: attach 主进程静默退出/EGL 崩溃, 仅约 4s 窗口可抓帧 - scripts: attach/spawn/hook/emu 系列 Frida 脚本与抓帧/验证工具 - evidence: identity/reqchain/frame/inputbuf/magic_buf/propedge 抓取样本, emu_* 存活对比, diag_* 策略实验, baseline 裸测基准
90 lines
2.5 KiB
Python
90 lines
2.5 KiB
Python
#!/usr/bin/env python3
|
|
"""抓模拟器自生成 32hex hdid — attach 主进程版 (PID=10200).
|
|
|
|
hook libudbauthunify.so:
|
|
- BusinessCfg::setSafeDeviceId(0x26A2E0): a2=sd, a3=hdid
|
|
- BusinessCfg::getHdid(0x26A484): this+1088 = std::string
|
|
- createWupDeviceInfo(0x2746A0): 返回 +152 = hdid
|
|
"""
|
|
import time, frida
|
|
|
|
REMOTE = "127.0.0.1:31878"
|
|
PID = 10200
|
|
|
|
JS = r"""
|
|
'use strict';
|
|
function readStdString(p){
|
|
if (p.isNull()) return null;
|
|
try{
|
|
var first = p.readU8();
|
|
if ((first & 1) === 0) {
|
|
var len = first >> 1;
|
|
return (len>0 && len<256) ? p.add(1).readUtf8String(len) : '';
|
|
} else {
|
|
var data = p.readPointer();
|
|
var len = p.add(8).readU64();
|
|
return (len>0 && len<1024) ? data.readUtf8String(len) : null;
|
|
}
|
|
}catch(e){ return null; }
|
|
}
|
|
function log(t,m){ send({t:t,m:m}); }
|
|
|
|
function install(){
|
|
var md = Process.findModuleByName('libudbauthunify.so');
|
|
if(!md){ log('err','no module'); return; }
|
|
log('mod','base='+md.base+' size='+md.size);
|
|
|
|
Interceptor.attach(md.base.add(0x26A2E0), {
|
|
onEnter:function(a){ this.sd=readStdString(a[1]); this.hd=readStdString(a[2]); },
|
|
onLeave:function(){ log('setSafeDeviceId', JSON.stringify({sd:(this.sd||'').slice(0,48), hd:(this.hd||'').slice(0,48)})); }
|
|
});
|
|
|
|
Interceptor.attach(md.base.add(0x26A484), {
|
|
onEnter:function(a){ this.thiz=a[0]; },
|
|
onLeave:function(){
|
|
try{
|
|
var s=readStdString(this.thiz.add(1088));
|
|
log('getHdid', (s!==null&&s!==undefined?'':s)||'EMPTY');
|
|
}catch(e){ log('getHdid','ERR '+e); }
|
|
}
|
|
});
|
|
|
|
Interceptor.attach(md.base.add(0x2746A0), {
|
|
onLeave:function(ret){
|
|
try{
|
|
var s=readStdString(ret.add(152));
|
|
if (s) log('wupDevInfo.hdid', ''+s);
|
|
}catch(e){}
|
|
}
|
|
});
|
|
|
|
// 也 hook libhydeviceid 数据区常见字符串? 先看 getHdid 输出
|
|
log('hooked','all OK');
|
|
}
|
|
|
|
install();
|
|
"""
|
|
|
|
def main():
|
|
dev = frida.get_device_manager().add_remote_device(REMOTE)
|
|
pid = PID
|
|
try:
|
|
s = dev.attach(pid)
|
|
except Exception as e:
|
|
print("attach失败:", e); return
|
|
print("attached", pid, flush=True)
|
|
sc = s.create_script(JS)
|
|
def on_msg(m,d):
|
|
if m.get('type')=='send':
|
|
p=m['payload']
|
|
print("[%s] %s" % (p['t'], p['m']), flush=True)
|
|
elif m.get('type')=='error':
|
|
print("JSErr:", str(m)[:200], flush=True)
|
|
sc.on('message', on_msg)
|
|
sc.load()
|
|
print("等待 90s ...", flush=True)
|
|
time.sleep(90)
|
|
print("done", flush=True)
|
|
|
|
if __name__ == "__main__":
|
|
main() |