yml2213
5a138376ca
- Cprivate.java 加密/解密器全文 (XXTEA+MD5密钥变换+尾字长度) - 密钥=SecureRandom 16字符[A-Za-z0-9] (guava.c内存明文! RSA封装上送) - Lyra TLV: (type<<4)|tag, type 0-13 全表 - 捕获密文可用 Cprivate.a(data,会话key) 解密 - key在内存! - 下一步: frida抓guava.c → 真key解密明文
51 lines
2.0 KiB
JavaScript
51 lines
2.0 KiB
JavaScript
// hook ga 的 b209202@0x20110 + k209202@0x219d8 — 抓 JNI 实参 (moderate - 只有 2 个 attach!)
|
|
function pad(h, n){ h=h||'0'; return h.length>=n?h:('0'.repeat(n-h.length)+h); }
|
|
setTimeout(function(){
|
|
var mod = Process.findModuleByName('libturingga.so');
|
|
if (!mod) { console.log('[B2] no ga module'); return; }
|
|
var base = mod.base;
|
|
var hooks = [
|
|
{name:'b209202', off:0x20110, nargs:7},
|
|
{name:'k209202', off:0x219d8, nargs:4},
|
|
];
|
|
hooks.forEach(function(h){
|
|
var addr = base.add(h.off);
|
|
try {
|
|
Interceptor.attach(addr, {
|
|
onEnter: function(args){
|
|
this.t = Date.now();
|
|
var regs = 'a0=' + pad(args[0].toString(16)) + ' a1=' + pad(args[1].toString(16));
|
|
for (var i=h.nargs-2; i<h.nargs; i++) regs += ' a' + i + '=' + pad(args[i].toString(16));
|
|
console.log('[B2] ' + h.name + '.' + h.off.toString(16) + ' enter ' + regs);
|
|
},
|
|
onLeave: function(ret){
|
|
console.log('[B2] ' + h.name + '.' + h.off.toString(16) + ' leave -> ' + pad(ret.toString(16)) + ' dt=' + (Date.now()-this.t) + 'ms');
|
|
}
|
|
});
|
|
console.log('[B2] hooked ' + h.name + ' @' + h.off.toString(16));
|
|
} catch(e) { console.log('[B2] hook ' + h.name + ' FAIL ' + e); }
|
|
});
|
|
|
|
// 监听 DFPService capture (同 hook_str_magic 的过滤)
|
|
var ssl = Process.findModuleByName('libssl.so');
|
|
if (ssl) {
|
|
var f = Module.findExportByName('libssl.so', 'SSL_write');
|
|
if (f) {
|
|
Interceptor.attach(f, {
|
|
onEnter: function(args){
|
|
try {
|
|
var len = args[2].toInt32();
|
|
if (len < 50 || len > 60000) return;
|
|
var b = args[1].readByteArray(Math.min(len, 300));
|
|
var s = Array.from(new Uint8Array(b)).map(function(x){return ('0'+x.toString(16)).slice(-2)}).join('');
|
|
if (s.indexOf('7cda') >= 0 || s.indexOf('dfpReport') >= 0 || s.indexOf('hyudbwebuif') >= 0) {
|
|
console.log('[B2] SSL_write len=' + len);
|
|
}
|
|
} catch(e){}
|
|
}
|
|
});
|
|
console.log('[B2] ssl-write hook ok');
|
|
}
|
|
}
|
|
}, 1000);
|