18ae42ec63
1.9.10 将 xwwqazamx 重命名为 vhvlnqgy，Login 闪退为 vhvlnqgy.bd:16；Xposed 双包名解析并 short-circuit R/bl、拦截 bd 异常。Zygisk 扩展 non-promon SEGV pc+4 与 ABRT/TRAP 一律 pc+4，修复 Login 稳定；注册页 stack_chk abort 待续攻。
25 lines
905 B
Python
25 lines
905 B
Python
"""Dump vhvlnqgy bl/R/bd method refs from TNG 1.9.10 dex."""
|
|
import re
|
|
import zipfile
|
|
|
|
APK = r"reverse/dumps/tng_1.9.10_base.apk"
|
|
with zipfile.ZipFile(APK) as z:
|
|
data = b"".join(z.read(n) for n in z.namelist() if n.endswith(".dex"))
|
|
|
|
for cls in ["Lvhvlnqgy/bl;", "Lvhvlnqgy/R;", "Lvhvlnqgy/bd;", "Lvhvlnqgy/w;", "Lvhvlnqgy/W;", "Lvhvlnqgy/a;"]:
|
|
print("===", cls, "===")
|
|
refs = sorted(set(re.findall(cls.encode() + rb"->[^\x00]{1,80}", data)))
|
|
for r in refs[:30]:
|
|
print(r.decode("ascii", "ignore"))
|
|
print()
|
|
|
|
print("=== R callers (who invokes R.a/R.b) ===")
|
|
for m in sorted(set(re.findall(rb"Lvhvlnqgy/[^;]+;->[a-zA-Z]+[^\x00]{0,40}Lvhvlnqgy/R;", data))):
|
|
print(m.decode("ascii", "ignore"))
|
|
|
|
print("\n=== bd throw sites ===")
|
|
for m in sorted(set(re.findall(rb"[^\x00]{0,40}Lvhvlnqgy/bd;", data))):
|
|
s = m.decode("ascii", "ignore")
|
|
if "vhvlnqgy" in s:
|
|
print(s)
|