yml2213
49c5c36c05
- 诊断报告: attach 主进程静默退出/EGL 崩溃, 仅约 4s 窗口可抓帧 - scripts: attach/spawn/hook/emu 系列 Frida 脚本与抓帧/验证工具 - evidence: identity/reqchain/frame/inputbuf/magic_buf/propedge 抓取样本, emu_* 存活对比, diag_* 策略实验, baseline 裸测基准
56 lines
2.1 KiB
Python
56 lines
2.1 KiB
Python
#!/usr/bin/env python3
|
|
"""attach + 全部 bypass: 观察 attach 路径加载 bypass 后 App 是否存活。
|
|
用于定位 attach 后反调试点。
|
|
"""
|
|
from __future__ import annotations
|
|
import frida, time, subprocess
|
|
from pathlib import Path
|
|
|
|
REMOTE = "127.0.0.1:31878"
|
|
PACKAGE = "com.duowan.kiwi"
|
|
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
|
|
BYPASSES = ["bypass_msaoaid_maps_art_callsite.js", "mask_frida_maps_only.js", "patch_guard_block_termination.js"]
|
|
|
|
|
|
def main():
|
|
subprocess.run(["adb","-s","127.0.0.1:5555","shell","am","force-stop",PACKAGE], capture_output=True)
|
|
time.sleep(1)
|
|
subprocess.run(["adb","-s","127.0.0.1:5555","shell","monkey","-p",PACKAGE,"-c","android.intent.category.LAUNCHER","1"], capture_output=True)
|
|
print("app launched normally, waiting 8s...", flush=True)
|
|
time.sleep(8)
|
|
d = frida.get_device_manager().add_remote_device(REMOTE)
|
|
ps = [p for p in d.enumerate_processes() if 'kiwi' in p.name or 'duowan' in p.name]
|
|
if not ps:
|
|
print("no kiwi process", flush=True); return
|
|
pid = ps[0].pid
|
|
print("attach pid", pid, flush=True)
|
|
s = d.attach(pid)
|
|
for name in BYPASSES:
|
|
try:
|
|
sc = s.create_script((RE/"evidence/scripts"/name).read_text())
|
|
def on_msg(m, dd, n=name):
|
|
if m.get('type')=='send':
|
|
print(f"[{n}] {m.get('payload')}", flush=True)
|
|
elif m.get('type')=='error':
|
|
print(f"[{n}] ERR {str(m)[:120]}", flush=True)
|
|
sc.on('message', on_msg)
|
|
sc.load(); time.sleep(0.3)
|
|
except Exception as e:
|
|
print(f"[{name}] load ERR {e}", flush=True)
|
|
print("all bypass loaded. observing 30s", flush=True)
|
|
prev = 0
|
|
for t in [3, 6, 10, 15, 20, 30]:
|
|
time.sleep(t - prev); prev = t
|
|
try:
|
|
alive = [p for p in d.enumerate_processes() if p.pid == pid]
|
|
except Exception:
|
|
break
|
|
print(f" +{t}s alive={bool(alive)}", flush=True)
|
|
if not alive:
|
|
print(f"=> DEAD at +{t}s", flush=True); break
|
|
try: s.detach()
|
|
except: pass
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main() |