135 lines
4.6 KiB
Python
135 lines
4.6 KiB
Python
#!/usr/bin/env python3
|
|
"""内存扫描: 找魔数 571882cf664bb39401ee 在进程内存中的位置。
|
|
|
|
App 组装 dfpReport 时魔数一定在内存中。扫描模块内存,
|
|
定位后 dump 周围字节 + 反查所在模块/偏移。
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import time
|
|
from pathlib import Path
|
|
|
|
import frida
|
|
|
|
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
|
|
|
|
JS = r"""
|
|
'use strict';
|
|
Process.setExceptionHandler(function(d){ return true; });
|
|
send({type:'armed'});
|
|
|
|
var MAGIC8 = [0x57,0x18,0x82,0xcf,0x66,0x4b,0xb3,0x94];
|
|
|
|
function scanRange(base, size, name){
|
|
try{
|
|
var m = Memory.scanSync(base, size, '57 18 82 cf 66 4b b3 94');
|
|
m.forEach(function(x){
|
|
var addr = x.address;
|
|
var ctx = [];
|
|
try{
|
|
var bytes = addr.sub(16).readByteArray(48);
|
|
ctx = Array.from(new Uint8Array(bytes));
|
|
}catch(e){}
|
|
send({type:'found', mod:name, addr:String(addr),
|
|
offInMod: addr.sub(base).toString(),
|
|
ctx: ctx.map(function(b){return ('0'+b.toString(16)).slice(-2);}).join(' ')});
|
|
});
|
|
}catch(e){}
|
|
}
|
|
|
|
function doScan(){
|
|
var mods = Process.enumerateModules();
|
|
mods.forEach(function(m){
|
|
var n = m.name.toLowerCase();
|
|
if (n.indexOf('hydevice')>=0 || n.indexOf('udb')>=0 || n.indexOf('tsc')>=0 ||
|
|
n.indexOf('hycrypto')>=0 || n.indexOf('libc')>=0 || n.indexOf('kiwi')>=0) {
|
|
try{ scanRange(m.base, m.size, m.name); }catch(e){}
|
|
}
|
|
});
|
|
// 也扫匿名可读内存 (堆)
|
|
try{
|
|
Process.enumerateRanges('r--').forEach(function(r){
|
|
if (r.size > 1024*1024*256) return; // 跳过超大段
|
|
try{
|
|
var m = Memory.scanSync(r.base, r.size, '57 18 82 cf 66 4b b3 94');
|
|
m.forEach(function(x){
|
|
var ctx = [];
|
|
try{ ctx = Array.from(new Uint8Array(x.address.sub(16).readByteArray(48))); }catch(e){}
|
|
// dump 魔数前 256B + 后 512B 的 ascii 找明文
|
|
var pre = '', post = '';
|
|
try{ pre = x.address.sub(256).readUtf8String(); }catch(e){}
|
|
try{ post = x.address.add(10).readUtf8String(); }catch(e){}
|
|
send({type:'found_heap', addr:String(x.address),
|
|
ctx: ctx.map(function(b){return ('0'+b.toString(16)).slice(-2);}).join(' '),
|
|
pre: pre, post: post});
|
|
});
|
|
}catch(e){}
|
|
});
|
|
}catch(e){}
|
|
send({type:'scan_done'});
|
|
}
|
|
|
|
// 每 5 秒扫一次, 实时找魔数 (App 登录触发 dfpReport 时出现)
|
|
var iv = setInterval(function(){
|
|
try{ doScan(); }catch(e){ send({type:'scan_err', e:String(e)}); }
|
|
}, 5000);
|
|
"""
|
|
|
|
|
|
def main():
|
|
device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
|
|
pid = device.spawn(["com.duowan.kiwi"])
|
|
print(f"[*] spawned pid={pid}")
|
|
session = device.attach(pid)
|
|
session.create_script(
|
|
(RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
|
|
).load()
|
|
session.create_script(
|
|
(RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
|
|
).load()
|
|
device.resume(pid)
|
|
time.sleep(11)
|
|
session.create_script(
|
|
(RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
|
|
).load()
|
|
|
|
def on_message(message, data):
|
|
if message.get("type") == "error":
|
|
print("[JS-ERR]", str(message)[:160], flush=True); return
|
|
if message.get("type") != "send":
|
|
return
|
|
p = message.get("payload") or {}
|
|
t = p.get("type")
|
|
if t == "found":
|
|
print(f"[FOUND] {p.get('mod')} @{p.get('addr')} off={p.get('offInMod')}", flush=True)
|
|
print(f" ctx: {p.get('ctx')}", flush=True)
|
|
elif t == "found_heap":
|
|
print(f"[FOUND-HEAP] @{p.get('addr')}", flush=True)
|
|
print(f" ctx: {p.get('ctx')}", flush=True)
|
|
pre = p.get('pre', '') or ''
|
|
post = p.get('post', '') or ''
|
|
if pre.strip(): print(f" pre256: {pre[:256]!r}", flush=True)
|
|
if post.strip(): print(f" post512: {post[:512]!r}", flush=True)
|
|
elif t == "mods":
|
|
print(f"[*] modules: {p.get('n')}", flush=True)
|
|
elif t == "scan_done":
|
|
print("[*] scan tick done", flush=True)
|
|
elif t == "scan_err":
|
|
print(f"[scan_err] {p.get('e')}", flush=True)
|
|
|
|
script = session.create_script(JS)
|
|
script.on("message", on_message)
|
|
script.load()
|
|
print("[*] 内存扫描中 (每5s), 请在手机上 退出登录->重新登录 (持续扫描, 命中即停止)", flush=True)
|
|
try:
|
|
while True:
|
|
time.sleep(5)
|
|
except KeyboardInterrupt:
|
|
pass
|
|
print("[*] done", flush=True)
|
|
session.detach()
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|