feat(maribank): PH 注册 OTP 突破、SG bypass 与中文文档
菲律宾 SeaBank 在 Root+LSPosed+Shamiko 下 register 已通过并触发 OTP；扩展 SG 包名、加密前 Hook、Magisk 设备伪装脚本，并将 docs 整理为中文操作与风控说明。
This commit is contained in:
mars
@@ -9,6 +9,8 @@ scopes = [
|
||||
"org.telegram.messenger.web",
|
||||
"org.telegram.messenger",
|
||||
"com.miraclegarden.smsmessage",
|
||||
"sg.com.maribankmobile.digitalbank",
|
||||
"ph.seabank.seabank",
|
||||
"au.com.up.money",
|
||||
"au.com.suncorp.marketplace",
|
||||
"au.com.bank86400",
|
||||
|
||||
@@ -1,29 +1,15 @@
|
||||
# MariBank / Hook 相关 logcat（adb 不在 PATH 时也可用）
|
||||
param(
|
||||
[switch]$Clear,
|
||||
[switch]$Follow
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
$sdk = "C:\Users\Administrator\AppData\Local\Android\Sdk"
|
||||
$adb = Join-Path $sdk "platform-tools\adb.exe"
|
||||
|
||||
# Capture MariBank SG hook logs (clears buffer first if -Clear switch passed)
|
||||
param([switch]$Clear)
|
||||
$adb = "C:\Users\Administrator\AppData\Local\Android\Sdk\platform-tools\adb.exe"
|
||||
if (-not (Test-Path $adb)) {
|
||||
Write-Host "adb not found at $adb" -ForegroundColor Red
|
||||
Write-Host "adb not found: $adb" -ForegroundColor Red
|
||||
exit 1
|
||||
}
|
||||
|
||||
$pattern = "MariBankRoot|1201|seabank|ClashMeta|LSPosed-Bridge.*notiMessage"
|
||||
|
||||
if ($Clear) {
|
||||
& $adb logcat -c
|
||||
Write-Host "logcat cleared." -ForegroundColor Green
|
||||
Write-Host "Logcat cleared. Now click Next in MariBank, then run without -Clear:" -ForegroundColor Yellow
|
||||
Write-Host " .\scripts\logcat-maribank.ps1"
|
||||
exit 0
|
||||
}
|
||||
|
||||
if ($Follow) {
|
||||
Write-Host "Following logcat (Ctrl+C to stop)..." -ForegroundColor Cyan
|
||||
& $adb logcat | Select-String -Pattern $pattern
|
||||
} else {
|
||||
& $adb logcat -d | Select-String -Pattern $pattern
|
||||
}
|
||||
& $adb logcat -d 2>&1 | Select-String -Pattern "MariBankRoot|MariBankNative" |
|
||||
Select-String -Pattern "HTTP|outbound|register|faked|finish adb|blocked|ErrorFlow|RegisterViewModel|skip error|late app|late native|assessRisk|risk callback"
|
||||
|
||||
6
scripts/magisk/maribank-device-spoof/module.prop
Normal file
6
scripts/magisk/maribank-device-spoof/module.prop
Normal file
@@ -0,0 +1,6 @@
|
||||
id=maribank_device_spoof
|
||||
name=MariBank Device Spoof
|
||||
version=v1.0
|
||||
versionCode=1
|
||||
author=miraclegarden
|
||||
description=Spoof serial/boot/build props for MariBank SHPSSDK fingerprint. Pair with Shamiko + DenyList for sg.com.maribankmobile.digitalbank. Generates a stable fake serial and android_id on first boot.
|
||||
50
scripts/magisk/maribank-device-spoof/post-fs-data.sh
Normal file
50
scripts/magisk/maribank-device-spoof/post-fs-data.sh
Normal file
@@ -0,0 +1,50 @@
|
||||
#!/system/bin/sh
|
||||
# Early boot: spoof read-only props before most apps start.
|
||||
# resetprop is provided by Magisk.
|
||||
|
||||
MODDIR=${0%/*}
|
||||
LOGTAG="maribank_device_spoof"
|
||||
|
||||
log() {
|
||||
echo "[$LOGTAG] $*" >> /cache/maribank_device_spoof.log 2>/dev/null
|
||||
echo "[$LOGTAG] $*"
|
||||
}
|
||||
|
||||
if [ ! -f "$MODDIR/serial.txt" ]; then
|
||||
# 16-char alphanumeric serial, stable across reboots
|
||||
SERIAL=$(cat /proc/sys/kernel/random/uuid 2>/dev/null | tr -d '-' | cut -c1-16)
|
||||
[ -z "$SERIAL" ] && SERIAL="MB$(date +%s | tail -c 9)"
|
||||
echo "$SERIAL" > "$MODDIR/serial.txt"
|
||||
fi
|
||||
SERIAL=$(cat "$MODDIR/serial.txt")
|
||||
|
||||
log "serial=$SERIAL"
|
||||
|
||||
# --- device identity (SHPSSDK / attestation often reads these) ---
|
||||
resetprop -n ro.serialno "$SERIAL"
|
||||
resetprop -n ro.boot.serialno "$SERIAL"
|
||||
resetprop -n ro.boot.serialno "$SERIAL"
|
||||
resetprop -n persist.sys.serialno "$SERIAL"
|
||||
|
||||
# --- hide root / debug fingerprint ---
|
||||
resetprop -n ro.debuggable 0
|
||||
resetprop -n ro.secure 1
|
||||
resetprop -n ro.adb.secure 1
|
||||
resetprop -n ro.build.type user
|
||||
resetprop -n ro.build.tags release-keys
|
||||
resetprop -n ro.boot.verifiedbootstate green
|
||||
resetprop -n ro.boot.flash.locked 1
|
||||
resetprop -n ro.boot.vbmeta.device_state locked
|
||||
resetprop -n vendor.boot.vbmeta.device_state locked
|
||||
resetprop -n ro.boot.veritymode enforcing
|
||||
resetprop -n ro.boot.warranty_bit 0
|
||||
resetprop -n ro.crypto.state encrypted
|
||||
|
||||
# --- adb off (match Java-layer bypass) ---
|
||||
resetprop -n init.svc.adbd stopped
|
||||
resetprop -n init.svc.adb stopped
|
||||
resetprop -n service.adb.root 0
|
||||
resetprop -n persist.sys.adb_enable 0
|
||||
resetprop -n persist.adb.wifi.enabled 0
|
||||
|
||||
log "post-fs-data done"
|
||||
37
scripts/magisk/maribank-device-spoof/service.sh
Normal file
37
scripts/magisk/maribank-device-spoof/service.sh
Normal file
@@ -0,0 +1,37 @@
|
||||
#!/system/bin/sh
|
||||
# After boot: rotate Settings.Secure.android_id once (global, affects all apps).
|
||||
|
||||
MODDIR=${0%/*}
|
||||
LOGTAG="maribank_device_spoof"
|
||||
|
||||
log() {
|
||||
echo "[$LOGTAG] $*" >> /cache/maribank_device_spoof.log 2>/dev/null
|
||||
}
|
||||
|
||||
# Wait for SettingsProvider
|
||||
i=0
|
||||
while [ "$(getprop sys.boot_completed)" != "1" ] && [ "$i" -lt 120 ]; do
|
||||
sleep 1
|
||||
i=$((i + 1))
|
||||
done
|
||||
sleep 3
|
||||
|
||||
if [ ! -f "$MODDIR/android_id.txt" ]; then
|
||||
# 16 hex chars (standard ANDROID_ID format)
|
||||
AID=$(cat /proc/sys/kernel/random/uuid 2>/dev/null | tr -d '-' | cut -c1-16)
|
||||
[ -z "$AID" ] && AID="$(date +%s | md5sum 2>/dev/null | cut -c1-16)"
|
||||
echo "$AID" > "$MODDIR/android_id.txt"
|
||||
fi
|
||||
AID=$(cat "$MODDIR/android_id.txt")
|
||||
|
||||
settings put secure android_id "$AID" 2>/dev/null
|
||||
log "android_id=$AID"
|
||||
|
||||
# Clear MariBank cache so SHPSSDK re-collects with new props (optional, user can disable)
|
||||
PKG="sg.com.maribankmobile.digitalbank"
|
||||
if [ -f "$MODDIR/clear_maribank_on_boot" ]; then
|
||||
pm clear "$PKG" 2>/dev/null
|
||||
log "pm clear $PKG"
|
||||
fi
|
||||
|
||||
log "service.sh done"
|
||||
75
scripts/maribank-scheme-b-finish.ps1
Normal file
75
scripts/maribank-scheme-b-finish.ps1
Normal file
@@ -0,0 +1,75 @@
|
||||
# Finish scheme B after reboot: LSPosed scope + verify spoof + clear MariBank
|
||||
param([switch]$Reboot)
|
||||
$ErrorActionPreference = "Stop"
|
||||
$ProjectRoot = Split-Path -Parent $PSScriptRoot
|
||||
$adb = "C:\Users\Administrator\AppData\Local\Android\Sdk\platform-tools\adb.exe"
|
||||
$Pkg = "sg.com.maribankmobile.digitalbank"
|
||||
$WaitSeconds = 60
|
||||
|
||||
Write-Host "Checking adb ($WaitSeconds s timeout)..." -ForegroundColor Cyan
|
||||
$deadline = (Get-Date).AddSeconds($WaitSeconds)
|
||||
$ready = $false
|
||||
while ((Get-Date) -lt $deadline) {
|
||||
$lines = & $adb devices 2>&1
|
||||
if ($lines -match "1C081FDF600K5Q\s+device") {
|
||||
$ready = $true
|
||||
break
|
||||
}
|
||||
if ($lines -match "\tunauthorized") {
|
||||
Write-Host "Device connected but UNAUTHORIZED — unlock phone and tap Allow USB debugging." -ForegroundColor Red
|
||||
}
|
||||
Start-Sleep -Seconds 2
|
||||
}
|
||||
if (-not $ready) {
|
||||
Write-Host @"
|
||||
|
||||
No adb device found after ${WaitSeconds}s.
|
||||
|
||||
On Pixel 6:
|
||||
1. USB cable connected (data port, not charge-only)
|
||||
2. Settings -> Developer options -> USB debugging ON
|
||||
3. USB mode: File transfer / PTP
|
||||
4. Unlock screen -> tap Allow on RSA prompt
|
||||
5. Re-run: .\scripts\maribank-scheme-b-finish.ps1
|
||||
|
||||
If USB debugging was turned off earlier, you must enable it on the phone first.
|
||||
|
||||
"@ -ForegroundColor Yellow
|
||||
exit 1
|
||||
}
|
||||
Start-Sleep -Seconds 2
|
||||
|
||||
Write-Host "`n=== Modules ===" -ForegroundColor Cyan
|
||||
& $adb shell su -c "ls /data/adb/modules/"
|
||||
& $adb shell su -c "magisk --denylist status"
|
||||
|
||||
Write-Host "`n=== Identity ===" -ForegroundColor Cyan
|
||||
& $adb shell su -c "getprop ro.serialno; getprop ro.boot.serialno; settings get secure android_id"
|
||||
& $adb shell su -c "cat /data/adb/modules/maribank_device_spoof/serial.txt 2>/dev/null; cat /data/adb/modules/maribank_device_spoof/android_id.txt 2>/dev/null"
|
||||
|
||||
Write-Host "`n=== LSPosed scope (MariBank SG) ===" -ForegroundColor Cyan
|
||||
$apkPath = (& $adb shell pm path com.miraclegarden.smsmessage.xposed 2>$null) -replace '^package:', ''
|
||||
$apkPath = $apkPath.Trim()
|
||||
if (-not $apkPath) {
|
||||
Write-Host "Xposed module not installed" -ForegroundColor Red
|
||||
exit 1
|
||||
}
|
||||
& $adb shell su -c "cp /data/adb/lspd/config/modules_config.db /sdcard/Download/modules_config.db; chmod 644 /sdcard/Download/modules_config.db"
|
||||
$db = Join-Path $env:TEMP "modules_config_finish.db"
|
||||
& $adb pull /sdcard/Download/modules_config.db $db | Out-Null
|
||||
python "$ProjectRoot\scripts\configure-lsposed.py" $db $apkPath
|
||||
& $adb push $db /sdcard/Download/modules_config.db | Out-Null
|
||||
& $adb shell su -c "cp /sdcard/Download/modules_config.db /data/adb/lspd/config/modules_config.db; rm -f /data/adb/lspd/config/modules_config.db-wal /data/adb/lspd/config/modules_config.db-shm; chmod 660 /data/adb/lspd/config/modules_config.db"
|
||||
|
||||
Write-Host "`n=== Disable USB debug + clear MariBank ===" -ForegroundColor Cyan
|
||||
& $adb shell su -c "settings put global adb_enabled 0; settings put global development_settings_enabled 0"
|
||||
& $adb shell su -c "pm clear $Pkg"
|
||||
|
||||
Write-Host "`n=== Done ===" -ForegroundColor Green
|
||||
Write-Host "Open MariBank -> Sign up -> enter phone -> Next"
|
||||
Write-Host "Log: adb logcat -d | Select-String 'MariBankEncrypt|MariBankAttest|3100012|deviceFingerprint'"
|
||||
|
||||
if ($Reboot) {
|
||||
Write-Host "Rebooting..." -ForegroundColor Yellow
|
||||
& $adb reboot
|
||||
}
|
||||
121
scripts/maribank-spoof-device.ps1
Normal file
121
scripts/maribank-spoof-device.ps1
Normal file
@@ -0,0 +1,121 @@
|
||||
# MariBank device spoof — Magisk resetprop + optional module install
|
||||
# Usage:
|
||||
# .\scripts\maribank-spoof-device.ps1 # apply resetprop once via adb su
|
||||
# .\scripts\maribank-spoof-device.ps1 -InstallModule # zip & push Magisk module
|
||||
# .\scripts\maribank-spoof-device.ps1 -NewIdentity # regenerate serial/android_id files on device
|
||||
# .\scripts\maribank-spoof-device.ps1 -ClearMariBank # pm clear MariBank after spoof
|
||||
param(
|
||||
[switch]$InstallModule,
|
||||
[switch]$NewIdentity,
|
||||
[switch]$ClearMariBank,
|
||||
[string]$DeviceSerial = ""
|
||||
)
|
||||
|
||||
$ErrorActionPreference = "Stop"
|
||||
$ProjectRoot = Split-Path -Parent $PSScriptRoot
|
||||
|
||||
$adb = "C:\Users\Administrator\AppData\Local\Android\Sdk\platform-tools\adb.exe"
|
||||
$ModuleDir = Join-Path $PSScriptRoot "magisk\maribank-device-spoof"
|
||||
$Pkg = "sg.com.maribankmobile.digitalbank"
|
||||
|
||||
if (-not (Test-Path $adb)) {
|
||||
Write-Host "adb not found: $adb" -ForegroundColor Red
|
||||
exit 1
|
||||
}
|
||||
|
||||
function Invoke-AdbShell($cmd) {
|
||||
& $adb shell "su -c '$cmd'" 2>&1
|
||||
}
|
||||
|
||||
function Test-Magisk {
|
||||
$m = Invoke-AdbShell "command -v resetprop 2>/dev/null || ls /data/adb/magisk/magisk 2>/dev/null"
|
||||
return ($LASTEXITCODE -eq 0 -and "$m" -match "resetprop|magisk")
|
||||
}
|
||||
|
||||
Write-Host "=== MariBank Device Spoof (方案 B: Magisk resetprop) ===" -ForegroundColor Cyan
|
||||
& $adb devices -l
|
||||
|
||||
if (-not (Test-Magisk)) {
|
||||
Write-Host "Magisk/resetprop not found on device. Install Magisk first." -ForegroundColor Red
|
||||
exit 1
|
||||
}
|
||||
|
||||
if ($InstallModule) {
|
||||
$zipPath = Join-Path $env:TEMP "maribank-device-spoof.zip"
|
||||
if (Test-Path $zipPath) { Remove-Item $zipPath -Force }
|
||||
# Use tar (Windows 10+) for Unix paths; Magisk needs post-fs-data.sh at zip root
|
||||
Push-Location $ModuleDir
|
||||
tar -a -cf $zipPath module.prop post-fs-data.sh service.sh
|
||||
Pop-Location
|
||||
Write-Host "Pushing module to /sdcard/Download/ ..."
|
||||
& $adb push $zipPath /sdcard/Download/maribank-device-spoof.zip
|
||||
Write-Host @"
|
||||
|
||||
Module zip pushed. On phone:
|
||||
1. Magisk -> Modules -> Install from storage -> maribank-device-spoof.zip
|
||||
2. Reboot
|
||||
3. Enable Shamiko (see below)
|
||||
|
||||
"@ -ForegroundColor Yellow
|
||||
}
|
||||
|
||||
if ($NewIdentity) {
|
||||
Write-Host "Removing saved identity (module will regenerate on next boot) ..."
|
||||
Invoke-AdbShell "rm -f /data/adb/modules/maribank_device_spoof/serial.txt /data/adb/modules/maribank_device_spoof/android_id.txt"
|
||||
}
|
||||
|
||||
if ($DeviceSerial -eq "") {
|
||||
$DeviceSerial = -join ((48..57) + (65..90) + (97..122) | Get-Random -Count 16 | ForEach-Object { [char]$_ })
|
||||
}
|
||||
$AndroidId = -join ((48..57) + (97..102) | Get-Random -Count 16 | ForEach-Object { [char]$_ })
|
||||
|
||||
Write-Host "Applying one-shot resetprop (serial=$DeviceSerial android_id=$AndroidId) ..."
|
||||
|
||||
$props = @(
|
||||
"resetprop ro.serialno $DeviceSerial",
|
||||
"resetprop ro.boot.serialno $DeviceSerial",
|
||||
"resetprop persist.sys.serialno $DeviceSerial",
|
||||
"resetprop ro.debuggable 0",
|
||||
"resetprop ro.secure 1",
|
||||
"resetprop ro.build.tags release-keys",
|
||||
"resetprop ro.boot.verifiedbootstate green",
|
||||
"resetprop ro.boot.flash.locked 1",
|
||||
"resetprop ro.boot.vbmeta.device_state locked",
|
||||
"resetprop ro.boot.veritymode enforcing",
|
||||
"resetprop init.svc.adbd stopped",
|
||||
"resetprop persist.sys.adb_enable 0"
|
||||
)
|
||||
foreach ($p in $props) {
|
||||
Invoke-AdbShell $p | Out-Null
|
||||
}
|
||||
Invoke-AdbShell "settings put secure android_id $AndroidId" | Out-Null
|
||||
|
||||
Write-Host "Verify:" -ForegroundColor Green
|
||||
Invoke-AdbShell "getprop ro.serialno; getprop ro.boot.serialno; settings get secure android_id"
|
||||
|
||||
if ($ClearMariBank) {
|
||||
Write-Host "Clearing MariBank app data ..."
|
||||
Invoke-AdbShell "pm clear $Pkg"
|
||||
Write-Host "MariBank data cleared. Cold start Sign up again." -ForegroundColor Green
|
||||
}
|
||||
|
||||
Write-Host @"
|
||||
|
||||
--- Shamiko checklist (required for scheme B) ---
|
||||
1. Magisk -> Settings -> Configure DenyList -> enable DenyList
|
||||
2. DenyList -> add $Pkg (all sub-processes)
|
||||
3. Install Shamiko module (Magisk repo / GitHub releases)
|
||||
4. Magisk -> Settings -> hide Magisk app (optional)
|
||||
5. LSPosed: keep module scoped to MariBank; soft reboot MariBank after spoof
|
||||
6. Turn OFF USB debugging before testing register (or rely on Xposed adb bypass)
|
||||
|
||||
To install persistent module:
|
||||
.\scripts\maribank-spoof-device.ps1 -InstallModule
|
||||
|
||||
To force new identity on next boot:
|
||||
.\scripts\maribank-spoof-device.ps1 -NewIdentity -InstallModule
|
||||
(then reboot)
|
||||
|
||||
Log on device: /cache/maribank_device_spoof.log
|
||||
|
||||
"@ -ForegroundColor Cyan
|
||||
Reference in New Issue
Block a user