122 lines
3.7 KiB
Python
122 lines
3.7 KiB
Python
#!/usr/bin/env python3
|
|
"""Hook .datadiv_decode* 字符串解码器, 找 571882cf 魔数 / dfp 相关字符串的来源。
|
|
|
|
libhydeviceid.so 和 libudbauthunify.so 的业务字符串全被 datadiv 混淆,
|
|
运行时才解码。魔数 571882cf664bb39401ee 静态搜不到 -> 一定是解码产物。
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import time
|
|
from pathlib import Path
|
|
|
|
import frida
|
|
|
|
PACKAGE = "com.duowan.kiwi"
|
|
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
|
|
OUT = Path("/Users/yml/codes/douyu_login_py/evidence/dfp_datadiv_capture.json")
|
|
|
|
JS = r"""
|
|
'use strict';
|
|
Process.setExceptionHandler(function(d){ return true; });
|
|
|
|
var MAGIC_HEX = '571882cf664bb39401ee';
|
|
var KEYWORDS = ['dfp', '5718', '82cf', 'b394', 'collect', 'encrypt', 'device'];
|
|
var hooked = 0;
|
|
|
|
function hookMod(modName){
|
|
var m = null;
|
|
try{ m = Process.getModuleByName(modName); }catch(e){ return false; }
|
|
var exps = m.enumerateExports();
|
|
exps.forEach(function(exp){
|
|
if (exp.name.indexOf('datadiv') < 0) return;
|
|
try{
|
|
Interceptor.attach(exp.address, {
|
|
onEnter: function(args){ this.t0=Date.now(); },
|
|
onLeave: function(ret){
|
|
var p = ret;
|
|
var s = '';
|
|
try{ s = p.readUtf8String(); }catch(e){}
|
|
var hit = false;
|
|
if (s && s.length > 3 && s.length < 2000) {
|
|
var low = s.toLowerCase();
|
|
KEYWORDS.forEach(function(k){
|
|
if (low.indexOf(k) >= 0) hit = true;
|
|
});
|
|
}
|
|
if (hit) {
|
|
send({type:'hit', mod:modName, fn:exp.name,
|
|
str: s.slice(0, 300)});
|
|
}
|
|
}
|
|
});
|
|
hooked += 1;
|
|
}catch(e){}
|
|
});
|
|
return true;
|
|
}
|
|
|
|
// 轮询等待模块加载
|
|
var tries = 0;
|
|
var iv = setInterval(function(){
|
|
tries += 1;
|
|
var ok1 = hookMod('libhydeviceid.so');
|
|
var ok2 = hookMod('libudbauthunify.so');
|
|
if (tries % 5 === 0) send({type:'waiting', tries:tries, hooked:hooked});
|
|
if (ok1 && ok2) { clearInterval(iv); send({type:'hooked_count', n:hooked}); }
|
|
if (tries > 60) clearInterval(iv);
|
|
}, 1000);
|
|
"""
|
|
|
|
|
|
def main():
|
|
device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
|
|
pid = device.spawn([PACKAGE])
|
|
print(f"[*] spawned {PACKAGE} pid={pid}")
|
|
session = device.attach(pid)
|
|
session.create_script(
|
|
(RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
|
|
).load()
|
|
session.create_script(
|
|
(RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
|
|
).load()
|
|
device.resume(pid)
|
|
time.sleep(11)
|
|
session.create_script(
|
|
(RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
|
|
).load()
|
|
|
|
events = []
|
|
|
|
def on_message(message, data):
|
|
if message.get("type") == "error":
|
|
print("[JS-ERR]", str(message)[:160]); return
|
|
if message.get("type") != "send":
|
|
return
|
|
p = message.get("payload") or {}
|
|
t = p.get("type")
|
|
if t == "hit":
|
|
print(f"[hit] {p.get('mod')} {p.get('fn')}: {p.get('str')!r}")
|
|
events.append(p)
|
|
elif t == "hooked_count":
|
|
print(f"[*] hooked {p.get('n')} datadiv decoders")
|
|
elif t == "skip":
|
|
print(f"[skip] {p.get('mod')}")
|
|
|
|
script = session.create_script(JS)
|
|
script.on("message", on_message)
|
|
script.load()
|
|
print("[*] 请在手机上 退出登录 -> 重新登录 触发 dfpReport 链 (120s)")
|
|
deadline = time.time() + 120
|
|
try:
|
|
while time.time() < deadline:
|
|
time.sleep(5)
|
|
except KeyboardInterrupt:
|
|
pass
|
|
OUT.write_text(json.dumps(events, ensure_ascii=False, indent=1))
|
|
print(f"[*] 捕获 {len(events)} 条 -> {OUT}")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|