yml2213
b06a768eb2
- hook_ssl_magic.js: SSL_write明文扫魔数, 命中即全量dump+杀进程 - 捕获: 3798B POST (hyudbwebuif/dfpReport, tReq tag1=[10B魔数]+3531B密文) - 触发: 清turing状态重注册 (备份tar零副作用) - 动态插件定位: libturingmfa.so(v87)/libturingga.so(v2.92.2) - evidence/dfp_live/ 存档; docs §11.47
91 lines
3.7 KiB
JavaScript
91 lines
3.7 KiB
JavaScript
'use strict';
|
|
function emit(row) { try { send(row); } catch (e) {} }
|
|
function btOk() {
|
|
try {
|
|
return Thread.backtrace(this.context, Backtracer.ACCURATE).slice(0, 8).map(a => {
|
|
const m = Process.findModuleByAddress(a);
|
|
return m ? m.name + '!' + a.sub(m.base) : a.toString();
|
|
}).join(' <- ');
|
|
} catch (e) { return ''; }
|
|
}
|
|
// tReq = [571882cf664bb39401ee][cipher] — 过滤向量/字符串写入
|
|
const PREF = [0x57, 0x18, 0x82, 0xcf];
|
|
const seen = {};
|
|
function probeBuf(p, len) {
|
|
try {
|
|
if (len < 4) return false;
|
|
const b = p.readByteArray(4);
|
|
const u = new Uint8Array(b);
|
|
return u[0] === PREF[0] && u[1] === PREF[1] && u[2] === PREF[2] && u[3] === PREF[3];
|
|
} catch (e) { return false; }
|
|
}
|
|
const VECWRITE = '_ZN6udbjce15JceOutputStreamINS_12BufferWriterEE5writeINSt6__ndk19allocatorIcEEEEvRKNS4_6vectorIcT_EEh';
|
|
const STRWRITE = '_ZN6udbjce15JceOutputStreamINS_12BufferWriterEE5writeERKNSt6__ndk112basic_stringIcNS3_11char_traitsIcEENS3_9allocatorIcEEEEh';
|
|
let installed = 0;
|
|
for (const mod of Process.enumerateModules()) {
|
|
for (const [name, kind] of [[VECWRITE, 'vec'], [STRWRITE, 'str']]) {
|
|
let addr = null;
|
|
try { addr = mod.getExportByName(name); } catch (e) {}
|
|
if (addr === null) continue;
|
|
Interceptor.attach(addr, {
|
|
onEnter(args) {
|
|
let data, len;
|
|
try {
|
|
if (kind === 'vec') {
|
|
const begin = args[1].readPointer();
|
|
const end = args[1].add(8).readPointer();
|
|
len = end.sub(begin).toInt32();
|
|
data = begin;
|
|
} else {
|
|
const flag = args[1].readU8();
|
|
if ((flag & 1) === 0) { len = flag >> 1; data = args[1].add(1); }
|
|
else { len = args[1].add(8).readU64().toNumber(); data = args[1].add(16).readPointer(); }
|
|
}
|
|
} catch (e) { return; }
|
|
if (!probeBuf(data, len)) return;
|
|
const key = mod.name + '|' + kind;
|
|
if (seen[key]) return;
|
|
seen[key] = true;
|
|
let hex = '';
|
|
try {
|
|
const n = Math.min(len, 96);
|
|
hex = Array.from(new Uint8Array(data.readByteArray(n))).map(b => b.toString(16).padStart(2, '0')).join('');
|
|
} catch (e) {}
|
|
emit({ event: 'treq-magic', module: mod.name, kind, len, head: hex, bt: btOk() });
|
|
},
|
|
});
|
|
installed++;
|
|
}
|
|
}
|
|
emit({ event: 'treq-hooks', installed });
|
|
// 动态重扫: 每 2s 对新加载模块补挂 (插件/lib 延迟加载场景)
|
|
const seenMods = {};
|
|
setInterval(() => {
|
|
for (const m of Process.enumerateModules()) {
|
|
if (seenMods[m.name]) continue;
|
|
seenMods[m.name] = true;
|
|
for (const [name, kind] of [[VECWRITE, 'vec'], [STRWRITE, 'str']]) {
|
|
let addr = null;
|
|
try { addr = m.getExportByName(name); } catch (e) {}
|
|
if (addr === null) continue;
|
|
try {
|
|
Interceptor.attach(addr, {
|
|
onEnter(args) {
|
|
let data, len;
|
|
try {
|
|
if (kind === 'vec') { const b = args[1].readPointer(); const e = args[1].add(8).readPointer(); len = e.sub(b).toInt32(); data = b; }
|
|
else { const f = args[1].readU8(); if ((f & 1) === 0) { len = f >> 1; data = args[1].add(1); } else { len = args[1].add(8).readU64().toNumber(); data = args[1].add(16).readPointer(); } }
|
|
} catch (e2) { return; }
|
|
if (!probeBuf(data, len)) return;
|
|
const key = m.name + '|' + kind;
|
|
if (seen[key] === undefined) { seen[key] = true; } else return;
|
|
let hex = '';
|
|
try { hex = Array.from(new Uint8Array(data.readByteArray(Math.min(len, 96)))).map(b => b.toString(16).padStart(2, '0')).join(''); } catch (e3) {}
|
|
emit({ event: 'treq-magic', module: m.name, kind, len, head: hex, bt: btOk() });
|
|
},
|
|
});
|
|
} catch (e4) {}
|
|
}
|
|
}
|
|
}, 2000);
|