Mars
59970a84a8
新增 MariBank/SeaBank PH Root 与 SHPSSDK bypass、riskToken 净化及 Up/Suncorp/ubank 消息 Hook；整理 reverse/ 脚本与 Frida 工具链，并补充当日工作说明文档。
135 lines
4.1 KiB
Markdown
135 lines
4.1 KiB
Markdown
# 澳大利亚银行 App 逆向报告
|
||
|
||
从 Pixel 6 设备拉取 APK（2026-07-02），用 DEX 字符串扫描 + 类名分析确定 Hook 点。
|
||
|
||
APK 位置（本地，未入库）：`reverse/apks/*-base.apk`
|
||
|
||
---
|
||
|
||
## 1. 包名与架构
|
||
|
||
| App | 包名 | 技术栈 | 推送方案 |
|
||
|-----|------|--------|----------|
|
||
| **Up** | `au.com.up.money` | React Native | 原生 `HandlerService` + RN Firebase |
|
||
| **Suncorp** | `au.com.suncorp.marketplace` | Kotlin 原生 | `SuncorpMessagingService` (FCM) |
|
||
| **ubank** | `au.com.bank86400` | Capacitor (Web) | MoEngage + Capacitor FCM 插件 |
|
||
|
||
---
|
||
|
||
## 2. Hook 点（已实现）
|
||
|
||
### Up Bank
|
||
|
||
| 路径 | 类 | 方法 |
|
||
|------|-----|------|
|
||
| **FCM 主路径** | `au.com.up.money.notifications.HandlerService` | `onMessageReceived(RemoteMessage)` |
|
||
| **前台兜底** | `android.app.NotificationManager` | `notify(...)` |
|
||
|
||
相关类（DEX 中发现）：
|
||
|
||
- `au.com.up.money.notifications.handlers.NotificationHandler`
|
||
- `au.com.up.money.notifications.Util$NotificationType`
|
||
- `Lio/invertase/firebase/messaging/ReactNativeFirebaseMessagingService`（RN 层，已由 HandlerService 覆盖）
|
||
|
||
### Suncorp Bank
|
||
|
||
| 路径 | 类 | 方法 |
|
||
|------|-----|------|
|
||
| **FCM 主路径** | `au.com.suncorp.marketplace.base.application.SuncorpMessagingService` | `onMessageReceived(RemoteMessage)` |
|
||
| **前台兜底** | `NotificationManager.notify` | extras 取 title/text |
|
||
|
||
相关：
|
||
|
||
- `FirebaseService.registerPushNotification`
|
||
- `BankingPaymentNotification` / `incomingPaymentNotification`
|
||
- `NotificationDetailsPresenter` / `NotificationDetailsActivity`
|
||
|
||
### ubank
|
||
|
||
| 路径 | 类 | 方法 |
|
||
|------|-----|------|
|
||
| **MoEngage FCM** | `com.moengage.firebase.MoEFireBaseMessagingService` | `onMessageReceived(RemoteMessage)` |
|
||
| **Capacitor FCM** | `io.capawesome.capacitorjs.plugins.firebase.messaging.MessagingService` | `onMessageReceived(RemoteMessage)` |
|
||
| **前台兜底** | `NotificationManager.notify` | extras |
|
||
|
||
日志字符串：`onMessageReceived() : Will try to show push`、`Not a MoEngage Payload`
|
||
|
||
---
|
||
|
||
## 3. 源码位置（xposed-module）
|
||
|
||
| 文件 | 说明 |
|
||
|------|------|
|
||
| `hook/UpBankMessageHook.java` | Up 专用 |
|
||
| `hook/SuncorpBankMessageHook.java` | Suncorp 专用 |
|
||
| `hook/UbankMessageHook.java` | ubank 专用 |
|
||
| `hook/BankHookHelper.java` | RemoteMessage / Notification 解析、去重 |
|
||
| `hook/BankNotificationHook.java` | 三家共用的 notify 兜底 |
|
||
|
||
日志 source 标识：
|
||
|
||
- `xposed_up` / `xposed_up_notify`
|
||
- `xposed_suncorp` / `xposed_suncorp_notify`
|
||
- `xposed_ubank` / `xposed_ubank_notify`
|
||
|
||
---
|
||
|
||
## 4. 数据提取逻辑
|
||
|
||
### RemoteMessage（FCM）
|
||
|
||
1. `getNotification().getTitle()` / `getBody()`
|
||
2. 若 body 为空 → 拼接 `getData()` 键值对
|
||
|
||
### Notification（前台兜底）
|
||
|
||
从 `extras` 读取：
|
||
|
||
- `EXTRA_TITLE` / `EXTRA_TEXT`
|
||
- `EXTRA_BIG_TEXT`
|
||
- `gcm.n.title` / `gcm.n.body`
|
||
|
||
---
|
||
|
||
## 5. 安装与验证
|
||
|
||
```powershell
|
||
powershell -ExecutionPolicy Bypass -File scripts\install-full.ps1
|
||
```
|
||
|
||
1. notiMessage **应用列表** 添加三家银行
|
||
2. LSPosed 作用域勾选：**银行 App + notiMessage + xposed 模块**
|
||
3. 强制停止银行 App 后重开
|
||
4. 测试：
|
||
|
||
```powershell
|
||
adb logcat | findstr /i "notiMessageHook/Bank notiMessageHook/Up notiMessageHook/Suncorp notiMessageHook/ubank HookMessageReceiver"
|
||
```
|
||
|
||
| 场景 | 期望 |
|
||
|------|------|
|
||
| 银行 App **前台** 收到推送 | `[Hook/xposed_up]` 等 |
|
||
| 银行 App **后台** 弹通知 | 通知通道 或 `xposed_*_notify` |
|
||
|
||
---
|
||
|
||
## 6. 限制与后续
|
||
|
||
- 银行可能 **不在通知里显示金额**（安全策略），Hook 也只能拿到 App 愿意展示的内容
|
||
- ubank 非 MoEngage 载荷会走 Capacitor 路径，需实测哪条触发
|
||
- 若 FCM 加密或仅静默同步，需再 Hook 业务层（如 `TransactionHistoryResponse`）——当前 DEX 未见稳定明文入库点
|
||
- 逆向脚本：`reverse/scripts/scan_dex.py`、`reverse/scripts/scan_target.py`
|
||
|
||
---
|
||
|
||
## 7. 复现逆向
|
||
|
||
```powershell
|
||
$adb = "$env:LOCALAPPDATA\Android\Sdk\platform-tools\adb.exe"
|
||
# 拉 base.apk
|
||
& $adb shell pm path au.com.up.money
|
||
& $adb pull <path> reverse/apks/up-base.apk
|
||
# 扫描
|
||
python reverse/scripts/scan_dex.py reverse/extracted
|
||
```
|