Mars
59970a84a8
新增 MariBank/SeaBank PH Root 与 SHPSSDK bypass、riskToken 净化及 Up/Suncorp/ubank 消息 Hook；整理 reverse/ 脚本与 Frida 工具链，并补充当日工作说明文档。
43 lines
1.5 KiB
Python
43 lines
1.5 KiB
Python
# -*- coding: utf-8 -*-
|
|
import re
|
|
import sys
|
|
import zipfile
|
|
|
|
KEYS = [
|
|
b"rooted", b"jailbroken", b"RootBeer", b"isRoot", b"checkRoot", b"detectRoot",
|
|
b"SafetyNet", b"PlayIntegrity", b"magisk", b"/su", b"tamper", b"safemode",
|
|
b"SafeMode", b"xposed", b"lsposed", b"frida", b"emulator", b"debuggable",
|
|
b"Integrity", b"jailbreak", b"factory settings", b"RiskDevice", b"DeviceRisk",
|
|
b"root device", b"seabank", b"SeaBank", b"MariBank", b"alc", b"ALC",
|
|
]
|
|
|
|
|
|
def scan_apk(apk_path):
|
|
with zipfile.ZipFile(apk_path) as zf:
|
|
for name in sorted(zf.namelist()):
|
|
if not name.endswith(".dex"):
|
|
continue
|
|
data = zf.read(name)
|
|
print("=== %s (%d bytes) ===" % (name, len(data)))
|
|
hits = set()
|
|
for key in KEYS:
|
|
start = 0
|
|
while True:
|
|
idx = data.find(key, start)
|
|
if idx < 0:
|
|
break
|
|
s = max(0, idx - 40)
|
|
e = min(len(data), idx + len(key) + 60)
|
|
chunk = re.sub(rb"[^\x20-\x7e]+", b" ", data[s:e])
|
|
chunk = chunk.decode("ascii", "ignore").strip()
|
|
if len(chunk) > 8:
|
|
hits.add(chunk)
|
|
start = idx + 1
|
|
for hit in sorted(hits):
|
|
print(" ", hit)
|
|
print()
|
|
|
|
|
|
if __name__ == "__main__":
|
|
scan_apk(sys.argv[1] if len(sys.argv) > 1 else "reverse/apks/seabank_ph_base.apk")
|