yml2213
dc109c5dba
- libturingmfa JNI 表: b87_(SparseArray,[B,Map,I)impl@0x25c98 + f87_ — 加密核心入口 - ELF 间隙洞察: LOAD-2 vaddr未4K对齐->unidbg映射崩因; mmap2补映射过导出 - TuringProbe.java: 装库+预注册类+gap补映射+直调框架(封送待办) - 路线: 直调b87_喂真实blob->SparseArray明文; ga侧JNI表同法
49 lines
1.7 KiB
JavaScript
49 lines
1.7 KiB
JavaScript
'use strict';
|
|
function emit(row) { try { send(row); } catch (e) {} }
|
|
const seen = {};
|
|
setTimeout(() => {
|
|
let addr = null;
|
|
try {
|
|
for (const m of Process.enumerateModules()) {
|
|
if (m.name !== 'libart.so') continue;
|
|
const syms = m.enumerateSymbols();
|
|
for (const sm of syms) {
|
|
if (sm.name.indexOf('RegisterNatives') >= 0) { addr = sm.address; break; }
|
|
}
|
|
}
|
|
} catch (e) {}
|
|
if (addr === null) { emit({ event: 'rn-err', msg: 'no sym' }); return; }
|
|
emit({ event: 'rn-hooked', at: addr });
|
|
Interceptor.attach(addr, {
|
|
onEnter(args) {
|
|
try {
|
|
const cls = args[1];
|
|
const methods = args[2];
|
|
const n = args[3].toInt32();
|
|
if (n <= 0 || n > 500) return;
|
|
// 读 class 名 (jclass -> 从 vtable 附近读太复杂, 只读方法表)
|
|
const rows = [];
|
|
for (let i = 0; i < n; i++) {
|
|
const off = methods.add(i * 24);
|
|
const namePtr = off.readPointer();
|
|
const sigPtr = off.add(8).readPointer();
|
|
const fnPtr = off.add(16).readPointer();
|
|
const mod = Process.findModuleByAddress(fnPtr);
|
|
const name = namePtr.readUtf8String(80) || '?';
|
|
const sig = sigPtr.readUtf8String(80) || '?';
|
|
rows.push({
|
|
name: name.length > 60 ? name.slice(0, 60) : name,
|
|
sig: sig.length > 50 ? sig.slice(0, 50) : sig,
|
|
impl: (mod ? mod.name + '!' + fnPtr.sub(mod.base) : fnPtr.toString()),
|
|
});
|
|
}
|
|
const key = rows.map(r => r.name + r.impl).join('|');
|
|
if (!seen[key]) {
|
|
seen[key] = true;
|
|
emit({ event: 'rn-table', n, rows: rows.slice(0, 60) });
|
|
}
|
|
} catch (e) { emit({ event: 'rn-err', msg: String(e).slice(0, 120) }); }
|
|
},
|
|
});
|
|
}, 1500);
|