Mars
59970a84a8
新增 MariBank/SeaBank PH Root 与 SHPSSDK bypass、riskToken 净化及 Up/Suncorp/ubank 消息 Hook；整理 reverse/ 脚本与 Frida 工具链，并补充当日工作说明文档。
25 lines
1.0 KiB
Python
25 lines
1.0 KiB
Python
# -*- coding: utf-8 -*-
|
|
import os, re, sys
|
|
|
|
def scan_dir(base, pat):
|
|
rx = re.compile(pat, re.I)
|
|
all_m = set()
|
|
for dex in sorted(os.listdir(base)):
|
|
if not dex.endswith('.dex'):
|
|
continue
|
|
data = open(os.path.join(base, dex), 'rb').read()
|
|
strs = set(m.group().decode('ascii', 'ignore') for m in re.finditer(rb'[\x20-\x7e]{5,}', data))
|
|
all_m |= {s for s in strs if rx.search(s)}
|
|
return sorted(all_m)
|
|
|
|
apps = {
|
|
'up': (r'(HandlerService|NotificationHandler|showNotification|RemoteMessage|Util\$NotificationType|processPush|handleMessage|up/money/notifications)'),
|
|
'suncorp': (r'SuncorpMessagingService|onMessageReceived|showNotification|NotificationDetails|pushNotification|FirebaseService'),
|
|
'ubank': (r'MoEFireBase|MessagingService|onMessageReceived|showNotification|Will try to show|bank86400|MoEngage'),
|
|
}
|
|
root = sys.argv[1]
|
|
for app, pat in apps.items():
|
|
print('\n====', app, '====')
|
|
for s in scan_dir(os.path.join(root, app), pat)[:60]:
|
|
print(s)
|