{"id":281,"date":"2024-09-03T15:19:24","date_gmt":"2024-09-03T07:19:24","guid":{"rendered":"http:\/\/www.94i.top\/?p=281"},"modified":"2025-01-17T17:00:25","modified_gmt":"2025-01-17T09:00:25","slug":"frida%e8%bf%87%e6%9f%90%e9%bb%91%e7%9b%92frida%e6%a3%80%e6%b5%8b","status":"publish","type":"post","link":"https:\/\/www.94i.top\/index.php\/2024\/09\/03\/frida%e8%bf%87%e6%9f%90%e9%bb%91%e7%9b%92frida%e6%a3%80%e6%b5%8b\/","title":{"rendered":"Frida\u8fc7\u67d0\u9ed1\u76d2frida\u68c0\u6d4b\u53cahkey\u9006\u5411\u53capost\u8bf7\u6c42\u4f53\u5206\u6790\uff08\u5df2\u5b8c\u7ed3\uff0c\u6587\u672b\u6709\u7b7e\u5230\u811a\u672c\uff09"},"content":{"rendered":"

\u524d\u8a00<\/h1>\n

\u672c\u6587\u7ae0\u4ec5\u505a\u79fb\u52a8\u5b89\u5168\u5b66\u4e60\u4ea4\u6d41\u7528\u9014\uff0c\u4e25\u7981\u4f5c\u5176\u4ed6\u7528\u9014\uff0c\u5982\u679c\u4fb5\u72af\u60a8\u7684\u6743\u76ca\u8bf7\u8054\u7cfb\u6211\u5220\u9664\u3002
\n\u76ee\u6807\u7248\u672c\u662f1.3.332
\n\u6240\u7528\u5de5\u5177: IDA Pro, frida, jadx<\/p>\n

\u5206\u6790<\/h1>\n

\u901a\u8fc7\u4e0b\u9762\u4ee3\u7801\u53ef\u4ee5\u770b\u5230\uff0c\u5728pthread_create\u4e2d\u5bf9frida\u8fdb\u884c\u4e86\u68c0\u6d4b<\/p>\n

function hook_dlsym() {\n    var count = 0\n    console.log("=== HOOKING dlsym ===")\n    var interceptor = Interceptor.attach(Module.findExportByName(null, "dlsym"),\n        {\n            onEnter: function (args) {\n                const name = ptr(args[1]).readCString()\n                \/\/ const module = Process.findModuleByAddress(ptr(this.returnAddress))\n                console.log("[dlsym]", name)\n                if (name == "pthread_create") {\n                    count++\n                }\n            }\n        }\n    )\n    return Interceptor\n}\n\nfunction hook_dlopen() {\n    var interceptor = Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),\n        {\n            onEnter: function (args) {\n                var pathptr = args[0];\n                if (pathptr !== undefined && pathptr != null) {\n                    var path = ptr(pathptr).readCString();\n                    console.log("[LOAD]", path)\n                    if (path.indexOf("libmsaoaidsec.so") > -1) {\n                        hook_dlsym()\n                    }\n                }\n            },\n        }\n    )\n    return interceptor\n}\n\nvar dlopen_interceptor = hook_dlopen()<\/code><\/pre>\n
\u8fc7\u68c0\u6d4b\u4ee3\u7801<\/h1>\n
function create_fake_pthread_create() {\n    const fake_pthread_create = Memory.alloc(4096)\n    Memory.protect(fake_pthread_create, 4096, "rwx")\n    Memory.patchCode(fake_pthread_create, 4096, code => {\n        const cw = new Arm64Writer(code, { pc: ptr(fake_pthread_create) })\n        cw.putRet()\n    })\n    return fake_pthread_create\n}\n\nfunction hook_dlsym() {\n    var count = 0\n    console.log("=== HOOKING dlsym ===")\n    var interceptor = Interceptor.attach(Module.findExportByName(null, "dlsym"),\n        {\n            onEnter: function (args) {\n                const name = ptr(args[1]).readCString()\n                console.log("[dlsym]", name)\n                if (name == "pthread_create") {\n                    count++\n                }\n            },\n            onLeave: function(retval) {\n                if (count == 1) {\n                    retval.replace(fake_pthread_create)\n                }\n                else if (count == 2) {\n                    retval.replace(fake_pthread_create)\n                    \/\/ \u5b8c\u62102\u6b21\u66ff\u6362, \u505c\u6b62hook dlsym\n                    interceptor.detach()\n                }\n            }\n        }\n    )\n    return Interceptor\n}\n\nfunction hook_dlopen() {\n    var interceptor = Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),\n        {\n            onEnter: function (args) {\n                var pathptr = args[0];\n                if (pathptr !== undefined && pathptr != null) {\n                    var path = ptr(pathptr).readCString();\n                    console.log("[LOAD]", path)\n                    if (path.indexOf("libmsaoaidsec.so") > -1) {\n                        hook_dlsym()\n                    }\n                }\n            }\n        }\n    )\n    return interceptor\n}\n\n\/\/ \u521b\u5efa\u865a\u5047pthread_create\nvar fake_pthread_create = create_fake_pthread_create()\nvar dlopen_interceptor = hook_dlopen()<\/code><\/pre>\n
\u9006\u5411<\/h1>\n
jadx\u4e2d\u5206\u6790<\/h2>\n
\u901a\u8fc7jadx\u641c\u7d22\u5b57\u7b26\u4e32heybox_id<\/code>\u5b9a\u4f4d
\n
\"\"<\/div>
\n\u53d1\u73b0\u8fd9\u91cc\u8c03\u7528\u4e86encode\u51fd\u6570
\n
\"\"<\/div>
\n\u53c2\u8003\u4e86\u522b\u4eba\u7684\u601d\u8def\u77e5\u9053\u7528\u5230\u4e86NDKTools\uff0c\u53d1\u73b0\u5934\u6587\u4ef6\u5f15\u7528\u4e2d\u786e\u5b9e\u6709
\n
\"\"<\/div>
\n\u5e76\u4e14NDKTools\u7684encode\u7684\u8c03\u7528\u5728libnative-lib.so\u6587\u4ef6\u4e2d
\n
\"\"<\/div>
\n\u7528jadx\u751f\u6210\u7684frida\u4ee3\u7801hook\u4e00\u4e0bencode\u51fd\u6570\u5f97\u5230\u4e86\u8fd9\u4e9b\u7ed3\u679c\uff0c\u53d1\u73b0\u7b2c\u4e00\u4e2a\u53c2\u6570\u662f\u4e00\u4e2ajava\u7c7b\uff0c\u7b2c\u4e8c\u4e2a\u662f\u63a5\u53e3\u7684\u5b57\u7b26\u4e32\uff0c\u7b2c\u4e09\u4e2a\u662f\u65f6\u95f4\u6233\uff0c\u7b2c\u56db\u4e2a\u662f\u8bf7\u6c42\u4e2d\u7684nonce<\/code>\u53c2\u6570\uff0c\u800chook\u7684\u7ed3\u679c\u5219\u662f\u7c7b\u4f3c<\/strong>hkey<\/code>\u7684\u5b57\u7b26\u4e32\u3002
\n
\"\"<\/div>
\n\u5b9e\u9645\u4e0a\uff0c\u4e0e\u8bf7\u6c42\u5305\u6240\u5bf9\u5e94\u7684hkey<\/code>\u662f8\u4f4d\uff0c\u800cencode\u5f97\u5230\u7684\u7ed3\u679c\u4e3a7\u4f4d\uff0c\u4f46\u662f\u5982\u56fe\u6240\u793ahook\u7684\u8fd9\u4e09\u4e2a\u5730\u65b9\u90fd\u6709\u76f8\u540c\u7684\u503cTyUPTy0qTlwj1f6cMeqKSGbfUZLkdFzI<\/code>\uff0c\u56e0\u6b64\u8fd9\u4e09\u8005\u662f\u5bf9\u5e94\u7684\uff0c\u4e5f\u5c31\u662f\u8bf4encode\u5f97\u5230\u7684\u7ed3\u679c\u4e0e<\/del>nonce<\/code>\u7ecf\u8fc7getVA\u5904\u7406\u540e\u5f97\u5230\u4e86\u6700\u7ec8\u7ed3\u679chkey<\/code>
\n
\"\"<\/div>
\ngetVA\u662f\u4e00\u4e2anative\u51fd\u6570\uff0c\u5728libhbsecurity.so\u6587\u4ef6\u4e2d<\/p>\n
\u90a3\u4e48\u73b0\u5728\u7684\u6838\u5fc3\u4efb\u52a1\u5c31\u662f\u5206\u6790libnative-lib.so<\/del>\u548clibhbsecurity.so\u6587\u4ef6\u4e86\u3002<\/p>\n
\"\"<\/div>
\n\u901a\u8fc7hook getVA\u51fd\u6570\u53d1\u73b0\uff0c\u5f53\u4f20\u5165\u7684str\u503c\u4e3a\u56fa\u5b9a\u503c\u65f6\uff0c\u8fd4\u56de\u7684\u7ed3\u679c\u4e5f\u662f\u56fa\u5b9a\u7684\uff0c\u4e5f\u5c31\u662f\u8bf4\uff0chkey<\/code>\u4ec5\u4e0enonce<\/code>\u6709\u5173\u3002\u5219\u73b0\u5728\u7684\u76ee\u6807\u662f\u5206\u6790nonce<\/code>\u7684\u751f\u6210\u548cgetVA\u5728so\u4e2d\u7684\u7b97\u6cd5\u3002<\/p>\n
\u901a\u8fc7hook RegisterNatives\u65b9\u6cd5\u5f97\u5230\u4e86\uff0c\u52a8\u6001\u6ce8\u518c\u51fd\u6570\u7684\u504f\u79fb\uff1a<\/p>\n
[RegisterNatives] java_class: com.max.security.SecurityTool name: setKA sig: (Ljava\/lang\/String;)V fnPtr: 0x7ed0d635c0 module_name: libhbsecurity.so module_base: 0x7ed0cc0000 offset: 0xa35c0\n[RegisterNatives] java_class: com.max.security.SecurityTool name: setKB sig: (Ljava\/lang\/String;Ljava\/lang\/String;)V fnPtr: 0x7ed0d63c34 module_name: libhbsecurity.so module_base: 0x7ed0cc0000 offset: 0xa3c34\n[RegisterNatives] java_class: com.max.security.SecurityTool name: setKM sig: (Ljava\/lang\/String;Ljava\/lang\/String;)V fnPtr: 0x7ed0d63d80 module_name: libhbsecurity.so module_base: 0x7ed0cc0000 offset: 0xa3d80\n[RegisterNatives] java_class: com.max.security.SecurityTool name: setKT sig: (Ljava\/lang\/String;Ljava\/lang\/String;)V fnPtr: 0x7ed0d63ecc module_name: libhbsecurity.so module_base: 0x7ed0cc0000 offset: 0xa3ecc\n[RegisterNatives] java_class: com.max.security.SecurityTool name: setKN sig: (Ljava\/lang\/String;Ljava\/lang\/String;)V fnPtr: 0x7ed0d63fd8 module_name: libhbsecurity.so module_base: 0x7ed0cc0000 offset: 0xa3fd8\n[RegisterNatives] java_class: com.max.security.SecurityTool name: setKD sig: (Ljava\/lang\/String;Ljava\/lang\/String;)V fnPtr: 0x7ed0d640e0 module_name: libhbsecurity.so module_base: 0x7ed0cc0000 offset: 0xa40e0\n[RegisterNatives] java_class: com.max.security.SecurityTool name: setKC sig: (Ljava\/lang\/String;Ljava\/lang\/String;)V fnPtr: 0x7ed0d642d8 module_name: libhbsecurity.so module_base: 0x7ed0cc0000 offset: 0xa42d8\n[RegisterNatives] java_class: com.max.security.SecurityTool name: getVX sig: (Landroid\/content\/Context;Ljava\/lang\/String;)Ljava\/lang\/String; fnPtr: 0x7ed0d645d0 module_name: libhbsecurity.so module_base: 0x7ed0cc0000 offset: 0xa45d0\n[RegisterNatives] java_class: com.max.security.SecurityTool name: getVA sig: (Landroid\/content\/Context;Ljava\/lang\/String;)Ljava\/lang\/String; fnPtr: 0x7ed0d64834 module_name: libhbsecurity.so module_base: 0x7ed0cc0000 offset: 0xa4834\n[RegisterNatives] java_class: com.max.security.SecurityTool name: getVB sig: (I)I fnPtr: 0x7ed0d65954 module_name: libhbsecurity.so module_base: 0x7ed0cc0000 offset: 0xa5954\n[RegisterNatives] java_class: com.max.security.SecurityTool name: getVC sig: (Landroid\/content\/Context;Ljava\/lang\/String;)Ljava\/lang\/String; fnPtr: 0x7ed0d65a58 module_name: libhbsecurity.so module_base: 0x7ed0cc0000 offset: 0xa5a58\n[RegisterNatives] java_class: com.max.security.SecurityTool name: getVD sig: (Landroid\/content\/Context;Ljava\/lang\/String;)Ljava\/lang\/String; fnPtr: 0x7ed0d65e44 module_name: libhbsecurity.so module_base: 0x7ed0cc0000 offset: 0xa5e44\n[RegisterNatives] java_class: com.max.security.SecurityTool name: resetVA sig: ()V fnPtr: 0x7ed0d66428 module_name: libhbsecurity.so module_base: 0x7ed0cc0000 offset: 0xa6428<\/code><\/pre>\n
\u7136\u540e\u53ef\u4ee5\u7528hook\u51fd\u6570\u5bf9\u8fd9\u4e9b\u51fd\u6570\u8fdb\u884chook
\nhook\u51fd\u6570\u6a21\u677f\uff1a<\/p>\n
function hook_sub_AC990(){\n    Java.perform(function () {\n        var a45d = Module.findBaseAddress("libhbsecurity.so")\n        a45d = a45d.add(0xA35C0)\n        Interceptor.attach(a45d,{\n            onEnter:function(arg){\n                \/\/console.log(hexdump(arg[1]))\n                \/\/console.log(hexdump(arg[2]));\n\n                \/\/console.log("\u53c2\u65700\uff1a",arg[0].readInt())\n                console.log("\u53c2\u65700\uff1a",arg[0].readInt())\n                console.log("\u53c2\u65701\uff1a",arg[1].readInt())\n                console.log("\u53c2\u65702\uff1a",arg[2].readInt())\n                console.log("\u53c2\u65703\uff1a",arg[3].readInt())\n            },\n            onLeave:function(ret){\n                console.log("\u8fd4\u56de\u503c\uff1b",ret.toString())\n\n            }\n        })\n\n    });\n}<\/code><\/pre>\n
hook\u4e86so\u5c42\u4e2d\u7684\u51fd\u6570sub_A6620<\/strong>\uff0c\u5b83\u7684\u4f5c\u7528\u662f\u83b7\u53d6\u4e00\u4e2a\u5b57\u7b26\u4e32\u53c2\u6570\uff0c\u5b9e\u9645\u4e0a\u83b7\u53d6\u5230\u7684\u5c31\u662fnonce<\/code>\u7684\u503c<\/p>\n
ida\u4e2d\u5206\u6790<\/h2>\n
\u901a\u8fc7\u5206\u6790\u6d41\u7a0b\u53d1\u73b0getVA\u4f3c\u4e4e\u4ec5\u4e0esub_A4834\u51fd\u6570\u6709\u5173\uff0c\u63a8\u6d4bgetVA\u51fd\u6570\u5728so\u4e2d\u5e94\u8be5\u4e3asub_A4834\u51fd\u6570-2024-09-05 17:17<\/del><\/p>\n
2024-09-08
\n\u901a\u8fc7\u4e86\u89e3RegisterNatives\u51fd\u6570\uff0c\u627e\u5230\u4e86getva\u5bf9\u5e94\u5728so\u4e2d\u7684\u65b9\u6cd5\u4e3asub_A4834\uff0c\u8be5\u65b9\u6cd5\u6709\u56db\u4e2a\u53c2\u6570\uff0c\u7b2c\u4e00\u4e2a\u4e3aenv<\/code>\uff0c\u7b2c\u4e8c\u4e2a\u4e3ajava\u7c7b\uff0c\u7b2c\u4e09\u4e2a\u4e3acontext<\/code>\uff0c\u7b2c\u56db\u4e2a\u4e3anonce<\/code>\uff0c\u7528frida\u53bbhook\u8be5\u51fd\u6570\uff0c\u53d1\u73b0\u6253\u5370\u51fa\u6765\u7684\u8fd9\u4e9b\u53c2\u6570\u7684\u5b57\u7b26\u4e32\u90fd\u662f\u5730\u5740\uff0c\u4f7f\u7528frida\u7684readCstring\u4e5f\u65e0\u6cd5\u6b63\u786e\u6253\u5370\uff0c\u4eca\u65e5\u5076\u7136\u53d1\u73b0\u8fd9\u4e2a\u51fd\u6570\u53ef\u4ee5\u5c06\u5730\u5740\u6b63\u786e\u8f6c\u6362\u4e3a\u5b57\u7b26\u4e32\uff0c\u540c\u65f6\u53d1\u73b0context<\/code>\u4e5f\u53ef\u4ee5\u6253\u5370\u51fa\u6765\uff0c\u540c\u6837\u7684\uff0c\u8fd4\u56de\u503c\u4e5f\u53ef\u4ee5\u6253\u5370\u51fa\u6765\u3002<\/p>\n
\/\/string\nfunction jstring2Str(jstring) { \/\/\u4ecefrida_common_funs.js\u4e2dcopy\u51fa\u6765\n    var ret;\n    Java.perform(function() {\n        var String = Java.use("java.lang.String");\n        ret = Java.cast(jstring, String);\/\/jstring->String\n    });\n    return ret;\n}\n\/\/context\n function jcontext2context(jcontext){\n    var ret;\n    Java.perform(function() {\n        var context = Java.use("android.content.Context");\n        ret = Java.cast(jcontext, context);\/\/jstring->String\n    });\n    return ret;\n }<\/code><\/pre>\n
\"\"<\/div>
\n\u6574\u4f53hook\u4ee3\u7801<\/p>\n
function hook_sub_AC990() {  \n    Java.perform(function () {  \n        var baseAddr = Module.findBaseAddress("libhbsecurity.so");  \n        if (baseAddr === null) {  \n            console.log("\u65e0\u6cd5\u627e\u5230\u6a21\u5757\u57fa\u5730\u5740");  \n            return;  \n        }  \n        var funcPtr = baseAddr.add(0xA4834);  \n\n        Interceptor.attach(funcPtr, {  \n            onEnter: function (args) {  \n                \/\/ \u5047\u8bbe\u53c2\u6570\u662f\u6307\u9488\uff0c\u4f46\u5177\u4f53\u7c7b\u578b\u672a\u77e5  \n                console.log("\u53c2\u65703\uff08\u6307\u9488\uff09\uff1a", args[1]);  \n\n                \/\/ \u5c06JNI\u6307\u9488\u8f6c\u6362\u4e3aJava\u5bf9\u8c61  \n                var ContextClass = Java.use("android.content.Context");  \n                var StringClass = Java.use("java.lang.String");  \n\n                \/\/ \u6253\u5370\u53c2\u6570  \n                console.log("Context: " + jcontext2context(args[2])); \/\/ \u6ce8\u610f\uff1a\u8fd9\u901a\u5e38\u4e0d\u4f1a\u6309\u9884\u671f\u5de5\u4f5c\uff0c\u56e0\u4e3a\u9700\u8981\u9002\u5f53\u7684\u8f6c\u6362  \n                console.log("String: " + jstring2Str(args[3])); \/\/ \u8fd9\u540c\u6837\u9700\u8981\u6b63\u786e\u7684\u8f6c\u6362  \n\n                \/\/ \u6216\u8005\uff0c\u5982\u679c\u53c2\u6570\u662f\u6574\u6570\u6216\u7ed3\u6784\u4f53\u7684\u6307\u9488\uff0c\u4f60\u53ef\u80fd\u9700\u8981\u5176\u4ed6\u65b9\u5f0f\u6765\u89e3\u6790\u5b83\u4eec  \n            },  \n            onLeave: function (retval) {  \n                \/\/ \u68c0\u67e5\u8fd4\u56de\u503c\u662f\u5426\u770b\u8d77\u6765\u50cf\u4e00\u4e2a\u6709\u6548\u7684\u5730\u5740  \n                console.log("\u8fd4\u56de\u503c: " + jstring2Str(retval)); \/\/ \u8fd9\u540c\u6837\u9700\u8981\u6b63\u786e\u7684\u8f6c\u6362 \n            }  \n        });  \n    });  \n}<\/code><\/pre>\n
\u56e0\u6b64\uff0c\u53ef\u4ee5\u5f97\u51fa\u7ed3\u8bbahkey<\/code>\u7684\u751f\u6210\u903b\u8f91\u5c31\u5728\u51fd\u6570sub_A4834\u4e2d\uff0c\u90a3\u4e48\u4e0b\u9762\u7684\u4efb\u52a1\u5c31\u662f\u5206\u6790\u51fd\u6570sub_A4834<\/p>\n
2024-09-12
\n
\"\"<\/div>
\nhook\u6b64\u51fd\u6570\u53ef\u4ee5\u5f97\u5230\u5982\u4e0b\u7ed3\u679c
\n
\"\"<\/div>
\n\u8fd9\u4e24\u4e2a\u503c\u662f\u4e00\u5bf9\u5e94\u7684\u3002\u53c2\u65702\u5bf9\u5e94jmethodID\u7684\u5730\u5740\uff0c\u53c2\u65703\u5bf9\u5e94\u4f20\u5165\u8be5\u65b9\u6cd5\u53c2\u6570\u7684\u5730\u5740\uff0c\u53ef\u4ee5\u770b\u5230\u4e24\u6b21hook\u5bf9\u5e94\u7684jmethodID\u662f\u4e00\u6837\u7684\uff0c\u53ea\u6709\u53c2\u6570\u4e0d\u540c\u3002
\n
\"\"<\/div>
\nhook\u4ee3\u7801<\/p>\n
function hook_sub_func() {    \n    Java.perform(function () {    \n        var baseAddr = Module.findBaseAddress("libhbsecurity.so");    \n        if (baseAddr === null) {    \n            console.log("\u65e0\u6cd5\u627e\u5230\u6a21\u5757\u57fa\u5730\u5740");    \n            return;    \n        }    \n        var funcPtr = baseAddr.add(0xA3268);    \n        \/\/var ptrv156 = baseAddr.add(0x168);\n        \/\/console.log("v156\uff1a",hexdump(ptrv156))\n        Interceptor.attach(funcPtr, {    \n            onEnter: function (args) {    \n                \/\/ \u8fd9\u91cc\u53ef\u4ee5\u6dfb\u52a0\u4e00\u4e9b\u8fdb\u5165\u51fd\u6570\u524d\u7684\u5904\u7406  \n                console.log("========\u5f00\u59cb=========");\n                console.log("\u53c2\u65701\uff1a",jclass2class(args[1])); \/\/jclass\n                console.log("\u53c2\u65702\uff1a",(args[2])); \/\/jmethodID\n                console.log("\u53c2\u65703\uff1a",(args[3])); \/\/\u5e94\u8be5\u662f\u65b9\u6cd5\u53c2\u6570\n                console.log("\u53c2\u65704\uff1a",jstring2Str(args[4])); \/\/ \u5e94\u8be5\u662f\u7f16\u7801\u683c\u5f0f\n                \/\/console.log("\u53c2\u65701\uff1a",args[1].readCString());\n            },    \n            onLeave: function (retval) {    \n                console.log("\u8fd4\u56de\u503c\uff1a",jstring2Str(ptr(retval)));\n                console.log("========\u7ed3\u675f=========");\n            }    \n        });    \n    });    \n}<\/code><\/pre>\n
2024-09-14
\n\u53c2\u65703\u7684\u7c7b\u578b\u4e3a[B\uff0c\u786e\u8ba4\u662f\u5426\u4e3a Java \u5f15\u7528\u5730\u5740\uff1a\u5728 Frida \u7684 Java \u73af\u5883\u4e2d\uff0c\u5730\u5740\u53ef\u80fd\u5e76\u4e0d\u662f\u76f4\u63a5\u7684\u7269\u7406\u5185\u5b58\u5730\u5740\uff0c\u800c\u662f JVM \u5f15\u7528\u7684\u67d0\u79cd\u5f62\u5f0f\u3002\u8003\u8651\u5982\u4f55\u5728Java\u5c42\u4e2d\u5bf9\u5176\u8fdb\u884c\u5904\u7406<\/p>\n
\u6b64\u4ee3\u7801\u5c06\u4e00\u4e9bjava\u7c7b\u578b\u8fdb\u884c\u8f6c\u6362\uff0c\u4e0d\u518d\u9700\u8981\u7528jstring2string<\/p>\n
function objectToString(obj) {\n    var result;\n    Java.perform(function() {\n        result = Java.cast(obj, Java.use("java.lang.Object")).toString();  \/\/ \u8f6c\u6362\u4e3a String \u8868\u793a\n    });\n    return result;\n}<\/code><\/pre>\n
2024-09-24 <\/p>\n
var javaclass = Java.vm.tryGetEnv().getByteArrayElements(args[3]);\nconsole.log("byte_ptr: ",hexdump(ptr(javaclass)));<\/code><\/pre>\n
\u4f7f\u7528\u6b64\u65b9\u6cd5\u53ef\u4ee5\u6253\u5370\u51faargs[3]\u7684\u503c
\n
\"\"<\/div>
\n\u8fd8\u53ef\u4ee5\u53d1\u73b0\u5176\u4e2d\u6709RSA<\/strong>\u5173\u952e\u5b57\u548c\u4e00\u4e32\u5b57\u7b26\u4e32HPPDCEAENEHBFHPASRDCAMNHJLAAPF<\/code>\uff0c\u731c\u6d4b\u53ef\u80fd\u548cRSA\u7b97\u6cd5\u6709\u5173<\/del><\/p>\n
2024-09-28
\nhkey\u7684\u751f\u6210\u65b9\u5f0f\u4e3a\uff1a\u8bf7\u6c42\u7684\u63a5\u53e3+\u79d2\u7ea7\u65f6\u95f4\u6233+imei+heybox_id\u8fdb\u884chmacsha512\u52a0\u5bc6\u540e\u5f97\u5230\u7684\u7ed3\u679c\u518d\u8fdb\u884c\u6807\u51c6crc32\u8ba1\u7b97\u5373\u53ef\u5f97\u5230hkey\uff0c\u81f3\u4e8ehmacsha512\u52a0\u5bc6\u7684\u5bc6\u94a5\u5c31\u81ea\u5df1\u627e\u5427<\/p>\n
Python\u5b9e\u73b0<\/h1>\n
\u6b64\u5185\u5bb9\u5df2\u9690\u85cf
\n
<\/div><\/p>\n
\u603b\u7ed3<\/h1>\n
2024-09-28
\nhkey\u7b97\u6cd5\uff0c\u652f\u6301\u7248\u672c\uff081.3.332, 1.3.336\uff09
\n
\"\"<\/div><\/p>\n
\u8865\u5145 \uff08\u5173\u4e8edata_report\u7684post\u8bf7\u6c42\u4e2d\u7684\u8bf7\u6c42\u4f53\uff092024-10-06<\/h1>\n
\u8bf7\u6c42\u4f53\u4e2d\u6709\u4e09\u4e2a\u53c2\u6570\uff1adata,key,sid
\n
\"\"<\/div>
\n
\"\"<\/div><\/p>\n
data\u53c2\u6570<\/h2>\n
\u52a0\u5bc6\u65b9\u5f0f\uff1aAES\/CBC\/PKCS7Padding
\n\u4f7f\u7528\u968f\u673a16\u4f4d\u957f\u5ea6\u5b57\u7b26\u4e32\u6765\u751f\u6210AES\u5bc6\u94a5\uff0c\u521d\u59cb\u5316\u5411\u91cf\u4e3aabcdefghijklmnop<\/code>\u3002\u6709\u6b64\u4e24\u4e2a\u503c\u5373\u53ef\u8fdb\u884cAES\u52a0\u5bc6\u3002
\n\u660e\u6587\uff1a
\n\u6570\u636e\u7c7b\u4f3c\u4e3a
\"\"<\/div>
\n\u5c06\u6b64\u6570\u636e\u8fdb\u884cGZIP\u538b\u7f29\uff0c\u518d\u8f6c\u4e3a\u5b57\u8282\u6570\u7ec4\u3002<\/p>\n
key\u53c2\u6570<\/h2>\n
\u52a0\u5bc6\u65b9\u5f0f\uff1aRSA\/ECB\/PKCS1Padding
\n\u968f\u673a16\u4f4d\u957f\u5ea6\u5b57\u7b26\u4e32\u8f6c\u5b57\u8282\u6570\u7ec4\u540e\u8fdb\u884cRSA\u52a0\u5bc6\u7684\u7ed3\u679c\u8fdb\u884cbase64\u683c\u5f0f\u7f16\u7801\u3002
\n\u516c\u94a5\u4e3a<\/p>\n
-----BEGIN RSA PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDZgjVwAiKTjZ55nG+mW6r3TSU4\nECvNYqDMIS\/bhCj2QaH5GI\/KZb2TBp+CBvUj9SLFnmJQ0kzHzHoGZCQ88VevCffF\n7JePGF9cmKQqotlfTKbV4oxV5iLz7JSG6b\/Vg7AXtrTolNtWsa8HiB0tI0YClYaQ\nlOXm4UxLeSxQwSFETwIDAQAB\n-----END RSA PUBLIC KEY-----<\/code><\/pre>\n
sid\u53c2\u6570<\/h2>\n
\u52a0\u5bc6\u65b9\u5f0f\uff1aMD5
\n\u5bf9\u4e24\u4e2a\u5b57\u7b26\u4e32\u8fdb\u884cMD5\u52a0\u5bc6\uff0c\u7136\u540e\u62fc\u63a5\u8d77\u6765
\"\"<\/div>
\"\"<\/div>
\n\u7b2c\u4e00\u6bb5\u4e3a\u53c2\u6570key\u52a0\u4e0a\u65f6\u95f4\u6233\u7136\u540eMD5\uff0c\u7b2c\u4e8c\u6bb5\u4e3a\u53c2\u6570data\u76f4\u63a5MD5\uff0c\u56e0\u6b64\u5982\u679c\u6709\u4e86\u53c2\u6570data\u548c\u53c2\u6570key\u7684\u751f\u6210\uff0c\u5219sid\u7684\u751f\u6210\u4e5f\u5c31\u6709\u4e86\u3002<\/p>\n
\u6ce8\uff1a16\u4f4d\u968f\u673a\u6570\u4e3adata\u53c2\u6570\u52a0\u5bc6\u65f6\u751f\u6210AES\u5bc6\u94a5\u7684\u503c\uff0c\u540c\u65f6\u662fkey\u53c2\u6570\u7684\u660e\u6587\u5b57\u7b26\u4e32<\/p>\n
Python\u590d\u73b0<\/h2>\n
\u6ce8\u610f\uff1a\u7531\u4e8ebase64\u7684\u7f16\u7801\u683c\u5f0f\u95ee\u9898\uff0cjava\u5c42\u4e2d\u7684base64\u7f16\u7801\u4f1a\u5bf9\u5b57\u7b26\u4e32\u6bcf76\u4e2a\u5b57\u7b26\u540e\u52a0\u4e00\u4e2a\u6362\u884c\u7b26\uff0c\u5982\u679c\u8981\u5728python\u4e2d\u590d\u73b0\uff0c\u9700\u8981\u624b\u52a8\u53bb\u5904\u7406\u3002\u5904\u7406base64\u6362\u884c\u7b26\u7684\u4ee3\u7801\u5982\u4e0b\uff1a<\/p>\n
def insert_newline_every_76_chars(input_str):\n    # \u7528\u5217\u8868\u6765\u4fdd\u5b58\u7ed3\u679c\n    result = []\n\n    # \u5faa\u73af\u904d\u5386\u5b57\u7b26\u4e32\uff0c\u6bcf76\u4e2a\u5b57\u7b26\u5207\u7247\n    for i in range(0, len(input_str), 76):\n        result.append(input_str[i:i+76])  # \u6bcf\u6b21\u53d676\u4e2a\u5b57\u7b26\n\n    # \u5c06\u5207\u7247\u540e\u7684\u90e8\u5206\u7528 '%0A' \u8fde\u63a5\n    return '\\n'.join(result)<\/code><\/pre>\n
\u8fd8\u8981\u6ce8\u610f\u7684\u662f\uff0c\u53c2\u6570data\u5728\u5b8c\u6210\u6bcf76\u4e2a\u5b57\u7b26\u6362\u884c\u540e\uff0c\u7ed3\u5c3e\u52a0\u4e00\u4e2a\\n\u518d\u53bb\u8fdb\u884cMD5\u8ba1\u7b97\uff0c\u800c\u53c2\u6570key\u5b8c\u6210\u6362\u884c\u7b26\u6dfb\u52a0\u540e\uff0c\u7ed3\u5c3e\u52a0\u4e00\u4e2a\\n\u518d\u52a0\u65f6\u95f4\u6233\u518d\u8fdb\u884cMD5\u8ba1\u7b97\u3002<\/p>\n
\u6ce8\uff1a\u5728\u6d4b\u8bd5\u8bf7\u6c42\u65f6\uff0c\u8bf7\u6c42\u5931\u8d25\u62a5\u4e24\u79cd\u9519\u8bef\uff0c\u7b2c\u4e00\u79cd\u662f\u8bf7\u6c42\u5931\u8d25\u4e86<\/strong>\uff0c\u7b2c\u4e8c\u79cd\u662f\u975e\u6cd5\u8bf7\u6c42<\/strong>\u3002\u5f53\u65f6\u95f4\u6233\u8ddd\u79bb\u5f53\u524d\u65f6\u95f4\u6233\u8f83\u8fdc\u65f6\uff0c\u4f1a\u62a5\u8bf7\u6c42\u5931\u8d25\u4e86\uff0c\u800c\u65f6\u95f4\u6233\u8ddd\u79bb\u8f83\u8fd1\u65f6\uff0c\u62a5\u9519\u975e\u6cd5\u8bf7\u6c42\u3002<\/p>\n
\u590d\u73b0\u4ee3\u7801<\/h3>\n
\u6b64\u5185\u5bb9\u5df2\u9690\u85cf
\n
<\/div>
\n\u53c2\u8003\uff1a\u7ed5\u8fc7\u6700\u65b0\u7248bilibili app\u53cdfrida\u673a\u5236<\/a><\/p>\n
\u7b7e\u5230\u53ca\u65e5\u5e38\u4efb\u52a1\u811a\u672c<\/h1>\n
Github<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
\u524d\u8a00 \u672c\u6587\u7ae0\u4ec5\u505a\u79fb\u52a8\u5b89\u5168\u5b66\u4e60\u4ea4\u6d41\u7528\u9014\uff0c\u4e25\u7981\u4f5c\u5176\u4ed6\u7528\u9014\uff0c\u5982\u679c\u4fb5\u72af\u60a8\u7684\u6743\u76ca\u8bf7\u8054\u7cfb\u6211\u5220\u9664\u3002 \u76ee\u6807\u7248\u672c\u662f1.3.332 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[],"class_list":["post-281","post","type-post","status-publish","format-standard","hentry","category-13"],"_links":{"self":[{"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/posts\/281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/comments?post=281"}],"version-history":[{"count":52,"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/posts\/281\/revisions"}],"predecessor-version":[{"id":628,"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/posts\/281\/revisions\/628"}],"wp:attachment":[{"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/media?parent=281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/categories?post=281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/tags?post=281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}