64 lines
1.8 KiB
Python
64 lines
1.8 KiB
Python
#!/usr/bin/env python3
|
|
"""侦察: 虎牙App 加载的模块中, 哪些含 dfp/hydevice/tsc/xxtea/aes 相关符号。
|
|
|
|
决定 dfpReport 加密体生成所在的 so, 再针对性 hook。
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import frida
|
|
|
|
PACKAGE = "com.duowan.kiwi"
|
|
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
|
|
|
|
JS = r"""
|
|
'use strict';
|
|
var mods = Process.enumerateModules();
|
|
var kw = /dfp|hydevice|deviceid|tsc|udb|xxtea|aes|finger|crypt|secsdk|turing|risk/;
|
|
var out = [];
|
|
mods.forEach(function(m){
|
|
var n = m.name;
|
|
if (kw.test(n.toLowerCase())) out.push({name:n, base:String(m.base), size:m.size});
|
|
});
|
|
send({type:'mods', list:out});
|
|
"""
|
|
|
|
|
|
def main():
|
|
device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
|
|
pid = device.spawn([PACKAGE])
|
|
print(f"[*] spawned {PACKAGE} pid={pid}")
|
|
session = device.attach(pid)
|
|
session.create_script(
|
|
(RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
|
|
).load()
|
|
session.create_script(
|
|
(RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
|
|
).load()
|
|
device.resume(pid)
|
|
time.sleep(11)
|
|
session.create_script(
|
|
(RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
|
|
).load()
|
|
script = session.create_script(JS)
|
|
|
|
def on_message(message, data):
|
|
if message.get("type") == "send":
|
|
payload = message.get("payload") or {}
|
|
if payload.get("type") == "mods":
|
|
for m in payload["list"]:
|
|
print(f" {m['name']:<32} {m['base']} size={m['size']}")
|
|
|
|
script.on("message", on_message)
|
|
script.load()
|
|
time.sleep(8)
|
|
print("[*] done")
|
|
session.detach()
|
|
|
|
|
|
if __name__ == "__main__":
|
|
import time
|
|
main()
|