yml2213
f20cc67239
- 结构: getDfpConfig(81B密文配置)->selectOperator(SDID+hyudb_ts)->dfpReport(10B魔数+3988B密文体)->服务端回t1/SDID - 魔数/协议串147库全零: 运行时装配/turing混淆; Java无dfp类 - 关键材料: mpdc_108298_1=32hex设备号0399ED0B...; ga2 1860B; .turing.dat 76B - Java全量hook方案弃用(闪退); turing=工业级SDK, 建议独立子项目
26 lines
1.2 KiB
Python
26 lines
1.2 KiB
Python
import subprocess, sys, time
|
|
pkg="com.duowan.kiwi"
|
|
adb = lambda *a: subprocess.run(["adb"]+list(a), capture_output=True, text=True)
|
|
adb("shell","su","-c","if ! pgrep -f /data/local/tmp/fs152; then nohup /data/local/tmp/fs152 -l 127.0.0.1:31878 >/data/local/tmp/fs152.log 2>&1 & fi")
|
|
time.sleep(1.5)
|
|
import frida
|
|
dev = frida.get_device_manager().add_remote_device("127.0.0.1:31878")
|
|
pid = dev.spawn([pkg]); print("spawned", pid)
|
|
session = dev.attach(pid)
|
|
bypass = open("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0/evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read()
|
|
session.create_script(bypass).load()
|
|
dev.resume(pid)
|
|
print("resumed; waiting 25s for app init + dfpReport...")
|
|
time.sleep(8)
|
|
def on_message(msg, data):
|
|
if msg.get('type')=='send' and isinstance(msg.get('payload'), dict) and msg['payload'].get('event')=='magic-scan':
|
|
print("SCAN total:", msg['payload'].get('total'))
|
|
for h in (msg['payload'].get('hits') or [])[:30]:
|
|
print(" ", h['mod'], h['off'])
|
|
script = session.create_script(open("scan_magic.js").read())
|
|
script.on('message', on_message)
|
|
script.load()
|
|
time.sleep(10)
|
|
try: session.detach()
|
|
except: pass
|