yml2213
f20cc67239
- 结构: getDfpConfig(81B密文配置)->selectOperator(SDID+hyudb_ts)->dfpReport(10B魔数+3988B密文体)->服务端回t1/SDID - 魔数/协议串147库全零: 运行时装配/turing混淆; Java无dfp类 - 关键材料: mpdc_108298_1=32hex设备号0399ED0B...; ga2 1860B; .turing.dat 76B - Java全量hook方案弃用(闪退); turing=工业级SDK, 建议独立子项目
60 lines
2.5 KiB
JavaScript
60 lines
2.5 KiB
JavaScript
'use strict';
|
|
function emit(row) {
|
|
try { send(row); } catch (e) {}
|
|
}
|
|
// dfpReport 链 Java hook: 找 dfp/udbdf 类 -> hook 请求方法 -> 抓 tReq blob + 调用栈
|
|
function bx() {
|
|
try {
|
|
return Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()).split("\n").slice(0, 14).join(" | ");
|
|
} catch (e) { return ''; }
|
|
}
|
|
setTimeout(() => {
|
|
try {
|
|
Java.perform(() => {
|
|
const hits = [];
|
|
Java.enumerateLoadedClasses({
|
|
onMatch(name) {
|
|
if (/dfp|Dfp|DFP|udbdf|Udbdf/.test(name)) hits.push(name);
|
|
},
|
|
onComplete() {
|
|
emit({ event: 'dfp-classes', list: hits.slice(0, 60), total: hits.length });
|
|
for (const cn of hits.slice(0, 40)) {
|
|
try {
|
|
const K = Java.use(cn);
|
|
const methods = K.class.getDeclaredMethods();
|
|
for (const m of methods) {
|
|
const mn = m.getName();
|
|
if (/post|report|send|build|req|encrypt|get|init/i.test(mn) && m.getParameterTypes().length <= 6) {
|
|
try {
|
|
K[mn].overloads.forEach(ov => {
|
|
ov.implementation = function () {
|
|
const args = Array.from(arguments).map(a => {
|
|
try {
|
|
if (a === null || a === undefined) return String(a);
|
|
if (a instanceof Java.use("byte[]")) {
|
|
const arr = Java.array('byte', a);
|
|
return 'byte[' + arr.length + ']:' + Array.from(arr.slice(0, 48)).map(b => (b & 0xff).toString(16).padStart(2, '0')).join('');
|
|
}
|
|
const s = String(a);
|
|
if (s.length > 200) return s.slice(0, 80) + ('…len' + s.length);
|
|
if (s.indexOf('dfp') >= 0 || s.indexOf('udbdf') >= 0 || s.indexOf('571882cf') >= 0) return s;
|
|
return s.slice(0, 60);
|
|
} catch (e2) { return '<arg>'; }
|
|
});
|
|
emit({ event: 'dfp-call', cls: cn, method: mn, args: args.slice(0, 6), stack: bx() });
|
|
return ov.apply(this, arguments);
|
|
};
|
|
});
|
|
} catch (e3) {}
|
|
}
|
|
}
|
|
} catch (e4) {}
|
|
}
|
|
},
|
|
});
|
|
});
|
|
} catch (e) {
|
|
emit({ event: 'dfp-err', msg: String(e) });
|
|
}
|
|
}, 4000);
|