Mars
59970a84a8
新增 MariBank/SeaBank PH Root 与 SHPSSDK bypass、riskToken 净化及 Up/Suncorp/ubank 消息 Hook；整理 reverse/ 脚本与 Frida 工具链，并补充当日工作说明文档。
20 lines
656 B
Python
20 lines
656 B
Python
# -*- coding: utf-8 -*-
|
|
import re
|
|
from pathlib import Path
|
|
|
|
native = Path(__file__).resolve().parent.parent / "extracted" / "native"
|
|
needles = [b"uvwuvwuv", b"NativeEncrypt", b"encryptByRSA", b"aesEncrypt"]
|
|
for so in sorted(native.glob("lib*.so")):
|
|
data = so.read_bytes()
|
|
hits = []
|
|
for n in needles:
|
|
if n in data:
|
|
hits.append(n.decode())
|
|
if not hits:
|
|
continue
|
|
print("\n===", so.name, hits, "===")
|
|
for m in sorted(set(re.findall(rb"Java_com_shopee_bke_[A-Za-z0-9_]+", data))):
|
|
s = m.decode()
|
|
if any(k in s.lower() for k in ("encrypt", "utils", "crypto", "jni")):
|
|
print(" ", s)
|