|
|
@@ -33,171 +33,57 @@ class Log {
|
|
|
}
|
|
|
|
|
|
Java.perform(function () {
|
|
|
- const aoks = Java.use('aoks')
|
|
|
- aoks.$init.overload('aokt', 'android.os.Handler').implementation = function (aokt, handler) {
|
|
|
- Log.i(`${this.a.value}`)
|
|
|
- return this.$init(aokt, handler)
|
|
|
- }
|
|
|
- aoks.d.overload('boolean', 'java.util.Map').implementation = function (b, map) {
|
|
|
- Log.e(`${map.keySet().toArray()}, ${this.a.value._f.value}`)
|
|
|
- // Log.e(`${map.get('UPI_FEATURES_ENABLED')}`)
|
|
|
- // Log.e(`${map.get('515039672404610')}`)
|
|
|
- // Java.cast(map.get('515039672404610'), Bundle).putString('IMSI', '515039672404610')
|
|
|
- return this.d(b, map)
|
|
|
- }
|
|
|
-
|
|
|
- const Reiceiver = Java.use('com.google.android.gms.constellation.util.OnSyncCompletedListener$Receiver')
|
|
|
- Reiceiver.onReceiveResult.overload('int', 'android.os.Bundle').implementation = function (i, bundle) {
|
|
|
- Log.e(`i=${i}, ${bundle}`)
|
|
|
- return this.onReceiveResult(i, bundle)
|
|
|
- }
|
|
|
-
|
|
|
- const aokt = Java.use('aokt')
|
|
|
- aokt.$init.overload(
|
|
|
- 'android.content.Context',
|
|
|
- 'aoli',
|
|
|
- 'com.google.android.gms.constellation.VerifyPhoneNumberRequest',
|
|
|
- 'java.lang.String',
|
|
|
- 'aoiy'
|
|
|
- ).implementation = function (context, aoli, request, str, aoiy) {
|
|
|
- Log.e(`${request.a.value} ${request.b.value}`)
|
|
|
- trace('[aokt]')
|
|
|
- return this.$init(context, aoli, request, str, aoiy)
|
|
|
- }
|
|
|
- aokt.c.overload(
|
|
|
- 'com.google.android.gms.constellation.VerifyPhoneNumberRequest',
|
|
|
- 'com.google.android.gms.constellation.VerifyPhoneNumberResponse',
|
|
|
- 'int'
|
|
|
- ).implementation = function (request, response, i) {
|
|
|
- Log.e(`${request.a.value} ${request.b.value}`)
|
|
|
- return this.c(request, response, i)
|
|
|
- }
|
|
|
-
|
|
|
- const BaseBundle = Java.use('android.os.BaseBundle')
|
|
|
- BaseBundle.getInt.overload('java.lang.String', 'int').implementation = function (key, i) {
|
|
|
- const value = this.getInt(key, i)
|
|
|
- // Log.e(`[BaseBundle]${key}, ${i} -> ${value}`)
|
|
|
- if (key == 'sim_slot_index') {
|
|
|
- Log.e(`[BaseBundle]sim_slot_index`)
|
|
|
- return 0
|
|
|
- }
|
|
|
- return this.getInt(key, i)
|
|
|
- }
|
|
|
+ const System = Java.use('java.lang.System')
|
|
|
+ // System.load.overload('java.lang.String').implementation = function (library) {
|
|
|
+ // Log.e('Loading library:', library)
|
|
|
+ // return this.load(library)
|
|
|
+ // }
|
|
|
+ // System.loadLibrary.overload('java.lang.String').implementation = function (library) {
|
|
|
+ // Log.e('Loading library1:', library)
|
|
|
+ // return this.loadLibrary(library)
|
|
|
+ // }
|
|
|
+ // 定位 __system_property_read_callback 函数地址
|
|
|
+ // 假设我们已经 hook 了 __system_property_read_callback,并获得参数 args[0] 为 pi
|
|
|
+ Interceptor.attach(Module.findExportByName(null, '__system_property_read_callback'), {
|
|
|
+ onEnter: function (args) {
|
|
|
+ var pi = args[0]
|
|
|
+ console.log('-------------------------')
|
|
|
+ console.log('prop_info 地址: ' + pi)
|
|
|
|
|
|
- const PhoneNumberVerification = Java.use('com.google.android.gms.constellation.PhoneNumberVerification')
|
|
|
- PhoneNumberVerification.$init.overload(
|
|
|
- 'java.lang.String',
|
|
|
- 'long',
|
|
|
- 'int',
|
|
|
- 'int',
|
|
|
- 'java.lang.String',
|
|
|
- 'android.os.Bundle',
|
|
|
- 'int',
|
|
|
- 'long'
|
|
|
- ).implementation = function (str, j, i, i2, str2, bundle, i3, l) {
|
|
|
- Log.e(`PhoneNumberVerification.$init(str=${str}, j=${j}, i=${i}, i2=${i2}, str2=${str2}, i3=${i3}, l=${l}`)
|
|
|
- // print bundle
|
|
|
- const keySet = bundle.keySet().toArray()
|
|
|
+ // 读取 serial(4 字节)
|
|
|
+ var serial = Memory.readU32(pi)
|
|
|
+ console.log('serial: ' + serial)
|
|
|
|
|
|
- for (let i = 0; i < keySet.length; i++) {
|
|
|
- const key = keySet[i]
|
|
|
- Log.i(`PhoneNumberVerification(key: ${key}, value: ${bundle.get(key)})`)
|
|
|
- }
|
|
|
+ // 定义 offset 值,PROP_VALUE_MAX 一般为 92
|
|
|
+ var PROP_VALUE_MAX = 92
|
|
|
|
|
|
- return this.$init(str, j, i, i2, str2, bundle, i3, l)
|
|
|
- }
|
|
|
+ // 读取 name,name 在 union 后,即 pi + 4 + PROP_VALUE_MAX
|
|
|
+ var namePtr = pi.add(4 + PROP_VALUE_MAX)
|
|
|
+ var nameStr = Memory.readCString(namePtr)
|
|
|
+ console.log('name: ' + nameStr)
|
|
|
|
|
|
- const VerifyPhoneNumberRequest = Java.use('com.google.android.gms.constellation.VerifyPhoneNumberRequest')
|
|
|
- VerifyPhoneNumberRequest.$init.overload(
|
|
|
- //String str, long j, IdTokenRequest idTokenRequest, Bundle bundle, List list, boolean z, int i, List list2
|
|
|
- 'java.lang.String',
|
|
|
- 'long',
|
|
|
- 'com.google.android.gms.constellation.IdTokenRequest',
|
|
|
- 'android.os.Bundle',
|
|
|
- 'java.util.List',
|
|
|
- 'boolean',
|
|
|
- 'int',
|
|
|
- 'java.util.List'
|
|
|
- ).implementation = function (str, j, idTokenRequest, bundle, list, z, i, list2) {
|
|
|
- Log.e(`VerifyPhoneNumberRequest.$init(
|
|
|
- str=${str}, j=${j}, idTokenRequest=${idTokenRequest}, bundle=${bundle}, list=${list}, z=${z}, i=${i}, list2=${list2})`)
|
|
|
- // print bundle
|
|
|
- const keySet = bundle.keySet().toArray()
|
|
|
- for (let i = 0; i < keySet.length; i++) {
|
|
|
- const key = keySet[i]
|
|
|
- Log.i(`VerifyPhoneNumberRequest.Bundle(key=${key}, value=${bundle.get(key)})`)
|
|
|
- }
|
|
|
-
|
|
|
- return this.$init(str, j, idTokenRequest, bundle, list, z, i, list2)
|
|
|
- }
|
|
|
- const SetAsterismConsentRequest = Java.use('com.google.android.gms.asterism.SetAsterismConsentRequest')
|
|
|
- SetAsterismConsentRequest.$init.overload(
|
|
|
- 'int',
|
|
|
- 'int',
|
|
|
- 'int',
|
|
|
- '[I',
|
|
|
- 'java.lang.Long',
|
|
|
- 'int',
|
|
|
- 'android.os.Bundle',
|
|
|
- 'int',
|
|
|
- 'java.lang.String',
|
|
|
- 'java.lang.String',
|
|
|
- 'java.lang.String',
|
|
|
- 'java.lang.String',
|
|
|
- 'java.lang.String',
|
|
|
- 'java.lang.String',
|
|
|
- 'java.lang.String',
|
|
|
- 'java.lang.String',
|
|
|
- 'int'
|
|
|
- ).implementation = function (
|
|
|
- i,
|
|
|
- i2,
|
|
|
- i3,
|
|
|
- iArr,
|
|
|
- l,
|
|
|
- i4,
|
|
|
- bundle,
|
|
|
- i5,
|
|
|
- str,
|
|
|
- str2,
|
|
|
- str3,
|
|
|
- str4,
|
|
|
- str5,
|
|
|
- str6,
|
|
|
- str7,
|
|
|
- str8,
|
|
|
- i6
|
|
|
- ) {
|
|
|
- Log.i(
|
|
|
- `SetAsterismConsentRequest.$init(
|
|
|
- i=${i}, i2=${i2}, i3=${i3}, iArr=${iArr}, l=${l},
|
|
|
- i4=${i4}, bundle=${bundle}, i5=${i5}, str=${str},
|
|
|
- str2=${str2}, str3=${str3}, str4=${str4}, str5=${str5},
|
|
|
- str6=${str6}, str7=${str7}, str8=${str8}, i6=${i6})`
|
|
|
- )
|
|
|
- // print bundle
|
|
|
- const keySet = bundle.keySet().toArray()
|
|
|
- for (let i = 0; i < keySet.length; i++) {
|
|
|
- const key = keySet[i]
|
|
|
- Log.i(`SetAsterismConsentRequest.Bundle(key=${key}, value=${bundle.get(key)})`)
|
|
|
+ var valueStr = ''
|
|
|
+ // 判断是否为 long 属性(is_long() 判断逻辑)
|
|
|
+ if ((serial & (1 << 16)) !== 0) {
|
|
|
+ // long 属性: offset 存在于 union.long_property.offset,
|
|
|
+ // offset 地址 = pi + 4 (union 开始) + 56(error_message 长度)
|
|
|
+ var offset = Memory.readU32(pi.add(4 + 56))
|
|
|
+ var longValuePtr = pi.add(offset)
|
|
|
+ console.log('long_property.offset: ' + offset)
|
|
|
+ try {
|
|
|
+ valueStr = Memory.readCString(longValuePtr)
|
|
|
+ } catch (e) {
|
|
|
+ valueStr = '读取 long_value 出错: ' + e
|
|
|
+ }
|
|
|
+ } else {
|
|
|
+ // 非 long 属性,值直接存储在 union.value 中,起始于 pi + 4
|
|
|
+ try {
|
|
|
+ valueStr = Memory.readCString(pi.add(4))
|
|
|
+ } catch (e) {
|
|
|
+ valueStr = '读取 inline value 出错: ' + e
|
|
|
+ }
|
|
|
+ }
|
|
|
+ console.log('value: ' + valueStr)
|
|
|
}
|
|
|
-
|
|
|
- return this.$init(i, i2, i3, iArr, l, i4, bundle, i5, str, str2, str3, str4, str5, str6, str7, str8, i6)
|
|
|
- }
|
|
|
-
|
|
|
- const SetAsterismConsentResponse = Java.use('com.google.android.gms.asterism.SetAsterismConsentResponse')
|
|
|
- SetAsterismConsentResponse.$init.overload('int', 'java.lang.String', 'java.lang.String').implementation = function (
|
|
|
- i,
|
|
|
- str,
|
|
|
- str2
|
|
|
- ) {
|
|
|
- Log.i(`SetAsterismConsentResponse.$init(i=${i}, str=${str}, str2=${str2})`)
|
|
|
- return this.$init(i, str, str2)
|
|
|
- }
|
|
|
-
|
|
|
- const EventManager = Java.use('com.google.android.gms.constellation.EventManager')
|
|
|
- EventManager.onHandleIntent.overload('android.content.Intent').implementation = function (intent) {
|
|
|
- Log.i('EventManager.onHandleIntent(intent)')
|
|
|
- return this.onHandleIntent(intent)
|
|
|
- }
|
|
|
+ })
|
|
|
})
|