Files
live-hub-py/tools/frida/hook_turing_jni.js
T
yml2213 0944e9c86b docs(huya): R19 turing运行时路线终态 — 专项交接资产齐备
- turing类定位(ga果汁混淆系) + Java载荷hook零触发(=全native, 路线关闭)
- 静态密钥假设否定; 流式密文实锤
- 交接: 密文x3/请求全文/组件/工具/触发方法全收录 (docs §11.49)
2026-08-29 06:29:34 +08:00

59 lines
2.6 KiB
JavaScript

'use strict';
function emit(row) { try { send(row); } catch (e) {} }
setTimeout(() => {
try {
Java.perform(() => {
const found = [];
Java.enumerateLoadedClasses({
onMatch(name) {
if (/Turing|turing|DFp|Dfp|dfp/i.test(name)) found.push(name);
},
onComplete() {
emit({ event: 'turing-classes', list: found.slice(0, 30) });
const hooked = {};
for (const cn of found.slice(0, 20)) {
try {
const K = Java.use(cn);
const ms = K.class.getDeclaredMethods();
for (const m of ms) {
const mn = m.getName();
const pt = m.getParameterTypes();
const hasPayload = Array.from(pt).some(t => ['byte[]','java.lang.String','[B','java.util.Map'].indexOf(t.getName()) >= 0);
if (!hasPayload) continue;
const dsc = m.toGenericString ? m.toGenericString().slice(0, 120) : mn;
try {
K[mn].overloads.forEach(ov => {
const key = cn + '#' + mn + '#' + ov.argumentTypes.length;
if (hooked[key]) return;
hooked[key] = true;
ov.implementation = function () {
try {
const args = Array.from(arguments).map((a, ix) => {
try {
if (a === null || a === undefined) return String(a);
if (ov.argumentTypes[ix] && ov.argumentTypes[ix].className === 'byte[]') {
const arr = Java.array('byte', a);
return 'byte[' + arr.length + ']:' + Array.from(arr.slice(0, 60)).map(b => (b & 0xff).toString(16).padStart(2, '0')).join('');
}
const s = String(a);
return s.length > 120 ? s.slice(0, 60) + '…(' + s.length + ')' : s;
} catch (e2) { return '<a>'; }
});
emit({ event: 'turing-jni', cls: cn, method: mn, nArgs: args.length, args: args.slice(0, 5) });
} catch (e3) {}
return ov.apply(this, arguments);
};
});
} catch (e4) {}
}
} catch (e5) {}
}
emit({ event: 'turing-hooks-done', n: Object.keys(hooked).length });
},
});
});
} catch (e) {
emit({ event: 'turing-err', msg: String(e).slice(0, 200) });
}
}, 3500);