yml2213
39c516b71b
- hook_str_magic.js: dfpReport/hyudbwebuif字符串过滤替代魔数(不漏轮次) + 全量请求dump - 采样集: golden+f1..f4+新身份B(0647) — 新身份头12B=旧身份一致(nonce与身份无关) - nonce块: [7cda][版本][69c9f5][计数递增][稳定段] ; 运行时路线终态(Java桥/co-located/回溯全闭) - 触发-捕获-存档 ~40s/轮 全自动; evidence/dfp_live/ 齐全
54 lines
2.7 KiB
JavaScript
54 lines
2.7 KiB
JavaScript
'use strict';
|
|
function emit(row) { try { send(row); } catch (e) {} }
|
|
function hexOfBytes(arr, max) {
|
|
try { return Array.from(Java.array('byte', arr).slice(0, max || 96)).map(b => (b & 0xff).toString(16).padStart(2, '0')).join(''); } catch (e) { return '<err>'; }
|
|
}
|
|
setTimeout(() => {
|
|
try {
|
|
Java.perform(() => {
|
|
const targets = [
|
|
{ cls: 'com.tencent.turingfd.sdk.ams.ga.native', methods: ['a'] },
|
|
{ cls: 'com.tencent.turingfd.sdk.ams.ga.TNative$aa', methods: ['k209202_2A742FA224BA8A2A', 'k87_D2D99D56FECC73FD', 'b209202_2A742FA224BA8A2A', 'f209202_2A742FA224BA8A2A'] },
|
|
{ cls: 'com.tencent.turingfd.sdk.ams.ga.Seedless', methods: ['getAIDCode', 'getAIDTicket', 'getTAIDTicket', 'getOpenIdTicket'] },
|
|
{ cls: 'com.tencent.turingfd.sdk.ams.ga.ITuringDID', methods: ['getAIDCode', 'getAIDTicket'] },
|
|
];
|
|
let hooked = 0;
|
|
for (const t of targets) {
|
|
let K = null;
|
|
try { K = Java.use(t.cls); } catch (e) { continue; }
|
|
for (const mn of t.methods) {
|
|
try {
|
|
K[mn].overloads.forEach(ov => {
|
|
ov.implementation = function () {
|
|
try {
|
|
const args = Array.from(arguments).map((a, ix) => {
|
|
try {
|
|
if (a === null || a === undefined) return String(a);
|
|
if (ov.argumentTypes[ix] && ov.argumentTypes[ix].className === 'byte[]') {
|
|
return 'byte[' + Java.array('byte', a).length + ']:' + hexOfBytes(a, 80);
|
|
}
|
|
const s = String(a);
|
|
return s.length > 160 ? s.slice(0, 80) + '…(' + s.length + ')' : s;
|
|
} catch (e2) { return '<a>'; }
|
|
});
|
|
emit({ event: 'turing-enc', cls: t.cls, method: mn, phase: 'enter', args: args.slice(0, 4) });
|
|
} catch (e3) {}
|
|
const r = ov.apply(this, arguments);
|
|
try {
|
|
if (r !== null && r !== undefined) {
|
|
if (r instanceof Java.use('byte[]')) emit({ event: 'turing-enc', cls: t.cls, method: mn, phase: 'leave', ret: 'byte[' + Java.array('byte', r).length + ']:' + hexOfBytes(r, 96) });
|
|
else { const s = String(r); emit({ event: 'turing-enc', cls: t.cls, method: mn, phase: 'leave', ret: s.length > 160 ? s.slice(0, 80) + '…(' + s.length + ')' : s }); }
|
|
}
|
|
} catch (e4) {}
|
|
return r;
|
|
};
|
|
hooked++;
|
|
});
|
|
} catch (e5) {}
|
|
}
|
|
}
|
|
emit({ event: 'turing-enc-hooks', n: hooked });
|
|
});
|
|
} catch (e) { emit({ event: 'turing-enc-err', msg: String(e).slice(0, 200) }); }
|
|
}, 3000);
|