yml2213
2fe23e4274
- Java.choose 堆枚举 @SSL_write 命中 = 密钥体系! (16字符随机, 每注册轮换) - 多POST结构对比: 密文紧跟magic, 头版本位 01/11 变体 - Java Cprivate.a x 会话密钥 x 0-48切片 = 全null → 13.4.22传输≠Cprivate! - hook_final/hook_brute 可复用捕获体系
72 lines
3.2 KiB
JavaScript
72 lines
3.2 KiB
JavaScript
// 多切片×多密钥暴力: Java 真 Cprivate.a
|
|
function emit(o){ try{ send(o); }catch(e){} }
|
|
let klist = [];
|
|
for (const mod of Process.enumerateModules()) {
|
|
let addr = null;
|
|
try { addr = mod.getExportByName('SSL_write'); } catch(e){}
|
|
if (!addr) continue;
|
|
Interceptor.attach(addr, {
|
|
onEnter(args){
|
|
try {
|
|
var num = args[2].toInt32();
|
|
if (num < 60 || num > 60000) return;
|
|
var u = new Uint8Array(args[1].readByteArray(num));
|
|
var s = '';
|
|
for (var i=0;i<u.length;i++) s += (u[i]>=32 && u[i]<127) ? String.fromCharCode(u[i]) : '.';
|
|
if (s.indexOf('dfpReport') < 0 && s.indexOf('hyudbwebuif') < 0) return;
|
|
var hex = Array.prototype.map.call(u, function(x){return ('0'+x.toString(16)).slice(-2)}).join('');
|
|
emit({event:'post', num:num, hex:hex});
|
|
setTimeout(function(){
|
|
try {
|
|
Java.perform(function(){
|
|
var keys = [];
|
|
Java.enumerateClassLoaders({
|
|
onMatch: function(loader){
|
|
try {
|
|
Java.classFactory.loader = loader;
|
|
Java.choose('com.tencent.turingfd.sdk.ams.ga.Perseus', {
|
|
onMatch: function(inst){
|
|
try {
|
|
var g = inst.b.value;
|
|
if (g && keys.indexOf(g.c.value) < 0) keys.push(g.c.value);
|
|
} catch(e){}
|
|
},
|
|
onComplete: function(){
|
|
try {
|
|
var C = Java.use('com.tencent.turingfd.sdk.ams.ga.private');
|
|
var Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon');
|
|
var idx = hex.indexOf('571882cf664bb39401ee');
|
|
if (idx < 0) return;
|
|
var all = hex.substring(idx+20);
|
|
var tot = keys.length;
|
|
for (var ki=0; ki<tot; ki++) {
|
|
var key = keys[ki];
|
|
var karr = Java.use('java.lang.String').$new(key).getBytes('UTF-8');
|
|
for (var off=0; off<=48; off+=2) {
|
|
var cph = all.substring(off);
|
|
if (cph.length < 16 || cph.length % 8 !== 0) continue;
|
|
var bytes = [];
|
|
for (var i=0;i<cph.length;i+=2) bytes.push(parseInt(cph.substr(i,2),16));
|
|
var arr = Java.array('byte', bytes);
|
|
var plain = C.a(arr, karr);
|
|
if (plain !== null) {
|
|
emit({event:'DEC-OK', key:key, off:off, len:plain.length, hex:Melon.a(plain).substring(0,400)});
|
|
}
|
|
}
|
|
}
|
|
emit({event:'brute-done', keys:keys.length});
|
|
} catch(e){ emit({event:'brute-e', e:String(e).substring(0,120)}); }
|
|
}
|
|
});
|
|
} catch(e){}
|
|
},
|
|
onComplete: function(){}
|
|
});
|
|
});
|
|
} catch(e){}
|
|
}, 300);
|
|
} catch(e){}
|
|
}
|
|
});
|
|
}
|