yml2213
f20cc67239
- 结构: getDfpConfig(81B密文配置)->selectOperator(SDID+hyudb_ts)->dfpReport(10B魔数+3988B密文体)->服务端回t1/SDID - 魔数/协议串147库全零: 运行时装配/turing混淆; Java无dfp类 - 关键材料: mpdc_108298_1=32hex设备号0399ED0B...; ga2 1860B; .turing.dat 76B - Java全量hook方案弃用(闪退); turing=工业级SDK, 建议独立子项目
24 lines
1.1 KiB
Python
24 lines
1.1 KiB
Python
import subprocess, sys, time
|
|
pkg="com.duowan.kiwi"
|
|
adb = lambda *a: subprocess.run(["adb"]+list(a), capture_output=True, text=True)
|
|
adb("shell","su","-c","if ! pgrep -f /data/local/tmp/fs152; then nohup /data/local/tmp/fs152 -l 127.0.0.1:31878 >/data/local/tmp/fs152.log 2>&1 & fi")
|
|
time.sleep(1.5)
|
|
import frida
|
|
dev = frida.get_device_manager().add_remote_device("127.0.0.1:31878")
|
|
# attach the CURRENT running process (not spawn — just attach for the scan)
|
|
procs = [p for p in dev.enumerate_processes() if p.name == pkg or (p.parameters or {}).get('name')==pkg or pkg in p.name]
|
|
if not procs:
|
|
print("app not running, spawn...", file=sys.stderr)
|
|
pid = dev.spawn([pkg]); dev.resume(pid); time.sleep(12)
|
|
procs = [p for p in dev.enumerate_processes() if pkg in p.name]
|
|
target = procs[0]
|
|
print(f"attaching {target.pid} {target.name}")
|
|
session = dev.attach(target.pid)
|
|
def on_message(msg, data):
|
|
if msg.get('type')=='send':
|
|
print("SCAN:", msg['payload'])
|
|
session.create_script(open('/Users/yml/codes/douyu_login_py/tools/frida/scan_magic.js').read()).on('message', on_message).load()
|
|
time.sleep(18)
|
|
try: session.detach()
|
|
except: pass
|