83 lines
3.2 KiB
JavaScript
83 lines
3.2 KiB
JavaScript
// R39: 登录时 udbauthunify md5 正确捕获 — sret 约定: x0=out槽, x1=in
|
|
'use strict';
|
|
function emit(o){ try{ send(o); }catch(e){} }
|
|
function hexb(p,n){ try{ return Array.from(new Uint8Array(p.readByteArray(n))).map(b=>('0'+b.toString(16)).slice(-2)).join(''); }catch(e){ return ''; } }
|
|
function rdStr(p){
|
|
// libc++ std::string: b0&1==0 -> SSO (len=b0>>1, data=+1); else heap (len@+8, data@*+16)
|
|
try {
|
|
var b0 = p.readU8();
|
|
if ((b0 & 1) === 0){
|
|
var l = b0 >> 1;
|
|
if (l > 22) return {t:'susp', len:l, v: hexb(p.add(1), 48)};
|
|
return {t:'s', len:l, v: p.add(1).readUtf8String(l)};
|
|
}
|
|
var hl = p.add(8).readU64().toNumber();
|
|
if (hl > 8192) return {t:'err', v:'too long '+hl};
|
|
return {t:'b64h', len:hl, v: hexb(p.add(16).readPointer(), Math.min(hl, 512))};
|
|
} catch(e){ return {t:'err', v:String(e)}; }
|
|
}
|
|
var n = 0;
|
|
function armUdb(){
|
|
var u = Process.findModuleByName('libudbauthunify.so');
|
|
if (!u) return false;
|
|
try {
|
|
Interceptor.attach(u.base.add(0x32e71c), {
|
|
onEnter(args){
|
|
this.outp = args[0];
|
|
this.in1 = rdStr(args[1]);
|
|
this.in2 = rdStr(args[2]);
|
|
this.raw = [hexb(args[1], 64), hexb(args[2], 64)];
|
|
this.lr = String(this.returnAddress);
|
|
},
|
|
onLeave(){
|
|
if (n > 300) return;
|
|
n++;
|
|
emit({event:'udb-md5', in1:this.in1, in2:this.in2, raw:this.raw,
|
|
out: rdStr(this.outp), lr:this.lr});
|
|
}
|
|
});
|
|
emit({event:'udb-armed'});
|
|
return true;
|
|
} catch(e){ emit({event:'udb-e', e:String(e).substring(0,150)}); return false; }
|
|
}
|
|
var armed = false;
|
|
var poll = setInterval(function(){ if (armUdb()){ armed=true; clearInterval(poll); } }, 200);
|
|
// Java digest 带输入 (登录 Java 侧可能也算)
|
|
setImmediate(function(){
|
|
Java.perform(function(){
|
|
try {
|
|
var MD = Java.use('java.security.MessageDigest');
|
|
var pend = {};
|
|
MD.update.overload('[B').implementation = function(b){
|
|
try {
|
|
var k=this.hashCode();
|
|
if(!pend[k]) pend[k]=[];
|
|
if (pend[k].length<8) pend[k].push(Array.prototype.map.call(b,function(x){return ('0'+(x&0xff).toString(16)).slice(-2);}).join('').substring(0,2048));
|
|
} catch(e){}
|
|
return this.update(b);
|
|
};
|
|
MD.digest.overload().implementation = function(){
|
|
var out=this.digest();
|
|
try {
|
|
var k=this.hashCode();
|
|
var oh=Array.prototype.map.call(out,function(b){return ('0'+(b&0xff).toString(16)).slice(-2);}).join('');
|
|
emit({event:'java-digest', algo:this.getAlgorithm(), out:oh, in_parts:(pend[k]||[]).join('')});
|
|
delete pend[k];
|
|
} catch(e){}
|
|
return out;
|
|
};
|
|
MD.digest.overload('[B').implementation = function(b){
|
|
var out=this.digest(b);
|
|
try {
|
|
var oh=Array.prototype.map.call(out,function(b2){return ('0'+(b2&0xff).toString(16)).slice(-2);}).join('');
|
|
var ih=Array.prototype.map.call(b,function(x){return ('0'+(x&0xff).toString(16)).slice(-2);}).join('');
|
|
emit({event:'java-digest', algo:this.getAlgorithm(), out:oh, in_parts:ih.substring(0,4096)});
|
|
} catch(e){}
|
|
return out;
|
|
};
|
|
emit({event:'java-md5-hooked'});
|
|
} catch(e){}
|
|
});
|
|
});
|
|
emit({event:'script-loaded'});
|