Mars
59970a84a8
新增 MariBank/SeaBank PH Root 与 SHPSSDK bypass、riskToken 净化及 Up/Suncorp/ubank 消息 Hook；整理 reverse/ 脚本与 Frida 工具链，并补充当日工作说明文档。
21 lines
881 B
Python
21 lines
881 B
Python
# -*- coding: utf-8 -*-
|
|
import re
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
SO = Path(__file__).resolve().parent.parent / "extracted" / "native" / "libshpssdk_bank.so"
|
|
ndk = Path(r"C:\Users\Administrator\AppData\Local\Android\Sdk\ndk\21.4.7075529\toolchains\llvm\prebuilt\windows-x86_64\bin")
|
|
readelf = ndk / "llvm-readelf.exe"
|
|
out = subprocess.check_output([str(readelf), "-Ws", str(SO)], universal_newlines=True, errors="replace")
|
|
print("=== JNI Java_* ===")
|
|
for line in out.splitlines():
|
|
if "Java_com_shopee" in line:
|
|
print(line)
|
|
print("\n=== risk/root/token strings in .dynsym FUNC ===")
|
|
data = SO.read_bytes()
|
|
for m in re.finditer(rb"[\x20-\x7e]{4,}", data):
|
|
s = m.group().decode("latin1")
|
|
if any(k in s.lower() for k in ["risk", "root", "hook", "token", "proc/", "magisk", "xposed", "emulator", "assess"]):
|
|
if len(s) < 120:
|
|
print(s)
|