609635aba1
TngRootBypassHook 增强 captcha 诊断、TigerTally/JNIC 分层与 HWUI 策略；新增逆向脚本、Frida 工具与 UI dump；同步 MariBank SG hook 与 tng_exit_guard 更新。
42 lines
1.1 KiB
Python
42 lines
1.1 KiB
Python
import zipfile
|
|
import re
|
|
|
|
z = zipfile.ZipFile(r"reverse/dumps/tng_1.9.10_base.apk")
|
|
names = [n for n in z.namelist() if n.endswith(".dex")]
|
|
|
|
# Find packages that look like Promon (short random package + few classes)
|
|
# Also search string markers
|
|
markers = [
|
|
b"promon",
|
|
b"Promon",
|
|
b"PROMON",
|
|
b"xwwqazamx",
|
|
b"Rooting",
|
|
b"jailbroken",
|
|
b"JailBroken",
|
|
b"W:16",
|
|
b"libtngdigital_ewallet",
|
|
]
|
|
|
|
for m in markers:
|
|
hits = 0
|
|
for n in names:
|
|
hits += z.read(n).count(m)
|
|
print(f"marker {m!r}: {hits}")
|
|
|
|
# Extract L.../...; type descriptors that contain 'promon' case-insensitive or weird short pkgs
|
|
pkg_re = re.compile(rb"L([a-z]{6,12})/([A-Za-z0-9_$]{1,20});")
|
|
pkg_counts = {}
|
|
for n in names:
|
|
data = z.read(n)
|
|
for m in pkg_re.findall(data):
|
|
pkg = m[0].decode("ascii", errors="ignore")
|
|
pkg_counts[pkg] = pkg_counts.get(pkg, 0) + 1
|
|
|
|
# Show rare short packages (likely obfuscated)
|
|
cands = [(p, c) for p, c in pkg_counts.items() if 5 <= c <= 500 and p.isalpha() and len(p) <= 12]
|
|
cands.sort(key=lambda x: -x[1])
|
|
print("\ncandidate obfuscated packages:")
|
|
for p, c in cands[:40]:
|
|
print(f" {p}: {c}")
|