yml2213
08fcf5c34c
- 配方: frida-server -l 0.0.0.0 + 清状态(保留登录) + str_magic → 40s命中 - 3新POST (4384/4267/4261B, cipher@70) 存 evidence/dfp_live/ - Java Cprivate XXTEA + Perseus 会话密钥 + Lyra TLV 全解 - 报告加密 = 第三路径 (JNI族+XTEA核心+Java三重钩子全0调用!) - cprivate.py 解密器就绪 (key一到即解)
71 lines
2.8 KiB
JavaScript
71 lines
2.8 KiB
JavaScript
// 双钩 (send() 事件格式!): Cprivate.b(明文+密钥!) + Perseus.a 会话密钥
|
|
setTimeout(function(){
|
|
function S(o){ try { send(o); } catch(e){} }
|
|
try {
|
|
Java.perform(function(){
|
|
var hooked = 0;
|
|
try {
|
|
var Cpr = null, Melon = null;
|
|
Java.enumerateClassLoaders({
|
|
onMatch: function(loader){
|
|
try {
|
|
Java.classFactory.loader = loader;
|
|
var c = Java.use('com.tencent.turingfd.sdk.ams.ga.private');
|
|
if (c) { Cpr = c; Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon'); }
|
|
} catch(e){}
|
|
},
|
|
onComplete: function(){}
|
|
});
|
|
if (!Cpr) { Cpr = Java.use('com.tencent.turingfd.sdk.ams.ga.private'); Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon'); }
|
|
var Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon');
|
|
Cpr.b.overload('[B','[B').implementation = function(a, b){
|
|
var out = this.b(a, b);
|
|
try {
|
|
S({event:'cpr-b', dlen:a.length, klen:b.length,
|
|
key:Melon.a(b), dhead:(Melon.a(a)||'').substring(0,300)});
|
|
} catch(e){ S({event:'cpr-err', e:String(e)}); }
|
|
return out;
|
|
};
|
|
hooked++;
|
|
} catch(e){ S({event:'cpr-nohook', e:String(e).substring(0,120)}); }
|
|
try {
|
|
var Perseus = Java.use('com.tencent.turingfd.sdk.ams.ga.Perseus');
|
|
var Guava = Java.use('com.tencent.turingfd.sdk.ams.ga.Guava');
|
|
Perseus.a.implementation = function(){
|
|
this.a();
|
|
try {
|
|
var g = this.b.value;
|
|
if (g) S({event:'perseus-key', c:g.c.value, b1:g.a.value, blen: g.b.value ? g.b.value.length : -1});
|
|
} catch(e){}
|
|
};
|
|
hooked++;
|
|
} catch(e2){ S({event:'cpr-noperseus', e:String(e2).substring(0,120)}); }
|
|
S({event:'cpr-installed', hooked:hooked});
|
|
});
|
|
} catch(e) { S({event:'cpr-perm', e:String(e).substring(0,120)}); }
|
|
}, 1200);
|
|
|
|
// 兜底: SSL_write 抓 dfpReport 密文 (串过滤!)
|
|
try {
|
|
var sslw = Module.findExportByName('libssl.so', 'SSL_write');
|
|
if (sslw) {
|
|
Interceptor.attach(sslw, {
|
|
onEnter: function(args){
|
|
try {
|
|
var len = args[2].toInt32();
|
|
if (len < 50 || len > 60000) return;
|
|
var b = args[1].readByteArray(Math.min(len, 2000));
|
|
var u = new Uint8Array(b);
|
|
var s = '';
|
|
for (var i=0;i<u.length;i++) s += String.fromCharCode(u[i]);
|
|
if (s.indexOf('dfpReport') >= 0 || u.length>10 && (u[0]==0x7c || u[1]==0xda)) {
|
|
var hex = Array.prototype.map.call(u, function(x){return ('0'+x.toString(16)).slice(-2)}).join('');
|
|
send({event:'ssl-dfp', len:len, head:hex.substring(0,120)});
|
|
}
|
|
} catch(e){}
|
|
}
|
|
});
|
|
send({event:'ssl-hooked'});
|
|
}
|
|
} catch(e) { send({event:'ssl-fail', e:String(e).substring(0,100)}); }
|