yml2213
5a138376ca
- Cprivate.java 加密/解密器全文 (XXTEA+MD5密钥变换+尾字长度) - 密钥=SecureRandom 16字符[A-Za-z0-9] (guava.c内存明文! RSA封装上送) - Lyra TLV: (type<<4)|tag, type 0-13 全表 - 捕获密文可用 Cprivate.a(data,会话key) 解密 - key在内存! - 下一步: frida抓guava.c → 真key解密明文
23 lines
1.0 KiB
JavaScript
23 lines
1.0 KiB
JavaScript
// 轻量 Java hook: Cprivate.b(byte[] data, byte[] key) — 抓明文+密钥 (单点 hook, 不扫内存!)
|
|
setTimeout(function(){
|
|
try {
|
|
Java.perform(function(){
|
|
try {
|
|
var Cpr = Java.use('com.tencent.turingfd.sdk.ams.ga.Cprivate');
|
|
var Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon');
|
|
Cpr.b.overload('[B','[B').implementation = function(a, b){
|
|
try {
|
|
var plainHex = Melon.a(a); // a() = byte[] -> hex? (Melon.a(byte[]) = hex!)
|
|
var keyHex = Melon.a(b);
|
|
console.log('[CPR] Cprivate.b data-len=' + a.length + ' key-len=' + b.length);
|
|
console.log('[CPR] key=' + keyHex);
|
|
console.log('[CPR] data-head=' + (plainHex ? plainHex.substring(0, 160) : 'null'));
|
|
} catch(e) { console.log('[CPR] dump-exc ' + e); }
|
|
return this.b(a, b);
|
|
};
|
|
console.log('[CPR] hooked Cprivate.b');
|
|
} catch(e2) { console.log('[CPR] no Cprivate: ' + e2); }
|
|
});
|
|
} catch(e) { console.log('[CPR] perm-exc ' + e); }
|
|
}, 1500);
|