feat: MariBank 风控 bypass、澳洲银行 Hook 与 reverse 逆向工作区
新增 MariBank/SeaBank PH Root 与 SHPSSDK bypass、riskToken 净化及 Up/Suncorp/ubank 消息 Hook;整理 reverse/ 脚本与 Frida 工具链,并补充当日工作说明文档。
This commit is contained in:
20
reverse/scripts/analyze_shps_so.py
Normal file
20
reverse/scripts/analyze_shps_so.py
Normal file
@@ -0,0 +1,20 @@
|
||||
# -*- coding: utf-8 -*-
|
||||
import re
|
||||
import subprocess
|
||||
from pathlib import Path
|
||||
|
||||
SO = Path(__file__).resolve().parent.parent / "extracted" / "native" / "libshpssdk_bank.so"
|
||||
ndk = Path(r"C:\Users\Administrator\AppData\Local\Android\Sdk\ndk\21.4.7075529\toolchains\llvm\prebuilt\windows-x86_64\bin")
|
||||
readelf = ndk / "llvm-readelf.exe"
|
||||
out = subprocess.check_output([str(readelf), "-Ws", str(SO)], universal_newlines=True, errors="replace")
|
||||
print("=== JNI Java_* ===")
|
||||
for line in out.splitlines():
|
||||
if "Java_com_shopee" in line:
|
||||
print(line)
|
||||
print("\n=== risk/root/token strings in .dynsym FUNC ===")
|
||||
data = SO.read_bytes()
|
||||
for m in re.finditer(rb"[\x20-\x7e]{4,}", data):
|
||||
s = m.group().decode("latin1")
|
||||
if any(k in s.lower() for k in ["risk", "root", "hook", "token", "proc/", "magisk", "xposed", "emulator", "assess"]):
|
||||
if len(s) < 120:
|
||||
print(s)
|
||||
Reference in New Issue
Block a user